Privacy notice
Last updated 14 October 2026. This notice explains what Coverlist collects, why, and what it never keeps.
Who we are
Coverlist is run by Atlian Limited, registered in England and Wales, company number 16251177, registered office 4th Floor, Silverstream House, 45 Fitzroy Street, London W1T 6EB. We are the controller of the personal data described here.
Questions about your data: privacy@coverlist.co.uk.
What we never collect
- Your contract file. Your browser opens it on your device. The file is never sent to us.
- Your cover list. It is made on your device and we don't keep a copy.
- Contract text after your check. The insurance pages we check are held in memory only while the check runs, then discarded. They are never written to a database, file or log, and never used to train AI.
What we collect, why and for how long
| What | Why | Lawful basis | How long |
|---|---|---|---|
| The text of the insurance pages you check, which may include names or contact details of the parties | To make your cover list | Legitimate interests: providing the check you asked for | Only while the check runs, usually under a minute |
| Name, work email and brokerage, when you download a PDF | To know who uses Coverlist, and to reply if you contact us | Legitimate interests | 24 months after your last download, or until you ask us to delete them |
| Your choice to receive update emails | To tell you when Coverlist reads new contract forms | Consent, which you can withdraw at any time | Until you unsubscribe |
| Check records: the contract form, page counts, timings and outcome, with no contract text | To keep the service working and improve accuracy | Legitimate interests | 24 months |
| A scrambled (hashed) form of your IP address | To limit each visitor to 10 checks an hour and stop abuse | Legitimate interests: security | 24 hours |
| Browser signals read by Cloudflare Turnstile when you start a check | To stop automated abuse | Legitimate interests: security | Not kept by us |
| Pages visited and buttons used, through Google Analytics | To see how Coverlist is used | Consent, through the cookie banner | 14 months |
| Emails you send us | To answer you | Legitimate interests | 2 years |
We only send update emails to people who tick the box asking for them. Where we rely on legitimate interests, we have weighed them against your rights, and you can object at any time.
Who processes data for us
Each provider works only on our instructions, under its data processing terms.
| Provider | What for | Where |
|---|---|---|
| Amazon Web Services (Amazon Bedrock) | Reads the insurance pages during a check, set to keep nothing | London, UK |
| Lovable (hosting, built on Supabase) | Runs the website and checking service; stores download details and check records | Europe |
| Cloudflare (Turnstile) | Bot protection when you start a check | Cloudflare's global network |
| Google (Google Analytics) | Website analytics, only with your consent | United States and elsewhere |
Data sent outside the UK
The AI model that reads contract pages runs in London. Where other data leaves the UK, we rely on UK adequacy regulations, the UK Extension to the EU-US Data Privacy Framework where the provider is certified, or the ICO's International Data Transfer Agreement or Addendum.
Your rights
You can ask us to:
- show you the personal data we hold about you
- correct it
- delete it
- restrict how we use it, or object to it, including anything based on legitimate interests
- give you a copy in a portable format, where we rely on your consent
You can withdraw consent for update emails or analytics at any time. Email privacy@coverlist.co.uk. There is no fee, and we reply within one month.
We don't make decisions about people by automated means. The AI reads contract clauses, not people. Coverlist is for professionals and is not meant for anyone under 18.
Complaints
Please tell us first at privacy@coverlist.co.uk, and we will acknowledge your complaint within 30 days. You can also complain to the ICO at ico.org.uk/make-a-complaint or on 0303 123 1113.
Changes to this notice
We will update the date at the top when this notice changes. If a change affects how we use your details, we will email you first where we have your address.