Who this notice is for
Not Our Jurisdiction (NOJ) publishes legal information and free self-help tools for parents in England. NOJ is the data controller for the personal data described here. We are not a law firm and do not provide legal advice.
For a privacy request, email hello@notourjurisdiction.co.uk with “privacy” in the subject line.
Visiting the website
The public site is hosted by Vercel. Like other web hosts, Vercel receives technical request data such as an IP address, browser information, the requested page and the time of the request so it can deliver and protect the site. We do not use those logs to build parent profiles.
Production analytics uses Plausible Analytics only when its site-specific tracker has been configured. Unconfigured builds collect no analytics. Plausible is cookieless. Before any event is sent, the site removes the whole query string from the page URL. The site accepts only fixed event names and fixed enum properties; it never sends names, email addresses, form messages, search text, letter contents, plan contents or checklist answers. See our Cookies notice.
Our lawful basis for limited hosting and aggregate analytics is our legitimate interest in running a secure site and understanding whether its public information and tools are useful.
Contact, questions and tips
The contact and suggestion pages are deliberately email lanes, not case-upload tools. Do not send a child’s name, date of birth, school, diagnosis, EHC plan, correspondence or any combination of facts that could identify a family.
Direct server delivery is disabled unless the email provider, destination, allowed origin and an external rate limiter have all been configured and tested. In the normal fallback, submitting the form opens a draft in your own email app; nothing is sent until you press Send there. That email passes through your email provider, ImprovMX forwarding for the NOJ domain, and our Gmail intake mailbox. If direct delivery is later enabled, the message also passes through Vercel and the single transactional-email provider named in the live deployment configuration before reaching the same mailbox. The selected rate-limiting provider would receive a salted hash of the client network address and a short-lived attempt count, not the form content. Direct delivery is not live now; before it is enabled, this notice must be updated to name both the selected email provider (Resend or Postmark), the selected rate-limiting provider and their transfer safeguards.
We use a message only to read and respond to the contact you initiated and to improve general public information. Original messages are never automatically copied into the research corpus, shared memory, Notion or an AI prompt. If a question identifies a useful general topic, a founder may manually write a new, de-identified topic after removing the original wording and identifying details. We do not publish the original message or your contact details.
Our retention policy is to keep routine contact, question and tip mail for no more than 90 days before moving it to Trash. This is currently a manual control while the dedicated Gmail labels and scheduled deletion job are deployed and tested: the intake mailbox is reviewed and mail older than 90 days is removed manually. During this interim, any necessary retention hold is recorded and reviewed manually. Once automation is live, only a message carrying the explicit retention-hold label will be exempt. Holds are used only where a rights request, complaint, legal obligation or active security/safeguarding issue requires it, and are removed when the reason ends. The scheduled control’s operational record will contain only deletion counts and a last-success time, never message content.
Our lawful basis for handling an enquiry is our legitimate interest in responding to contact that you initiated. If an unsolicited message contains identifying child data, we minimise and delete it and do not place it in an AI pipeline.
Newsletter requests
The newsletter form asks only for an email address. A request currently reaches the same inbox and is added to the mailing list manually; a successful form response means we received the request, not that an automated subscription has already happened. We use the address only for NOJ updates and keep it until you unsubscribe. The lawful basis is consent, which you give by asking to join and can withdraw at any time by emailing us.
Newsletter addresses are not copied into the research corpus, shared memory, Notion or AI prompts.
Your rights
Depending on the processing, you may ask us to:
- give you a copy of personal data we hold;
- correct inaccurate data;
- delete data;
- restrict its use;
- provide data you supplied in a portable form;
- consider an objection to processing based on legitimate interests; or
- stop consent-based processing when you withdraw consent.
Email hello@notourjurisdiction.co.uk. We may need enough information to identify the relevant message, but we will not ask for a child’s plan to verify a request. We normally respond within one month.
You may also complain to the Information Commissioner’s Office at ico.org.uk/make-a-complaint.
Plan Check is not live
NOJ does not currently accept real EHC plans or other real child documents. Plan Check remains synthetic-only until the ICO registration, commercial processor terms, DPIA, privacy documentation, professional indemnity insurance, reviewed customer terms and tested deletion controls are all complete. This notice will be expanded before any real plan is accepted.