Privacy Policy

Last updated: April 2026

1. Who We Are

Westminster Brief (westminsterbrief.co.uk) is an independent parliamentary research tool. This site is operated as a personal sole-trader project. Data controller: Mark Forde. Contact: hello@westminsterbrief.co.uk.

This policy explains what personal data we collect, why, and how we protect it.

2. Data We Collect

Account data

When you register, we store:

• Your email address — used to identify your account and for any service communications
• A hashed password — we never store your password in plain text

Usage data (Smart Alerts)

If you use the Smart Alerts feature, we store the keywords and stakeholders you choose to track so we can run scans on your behalf. This data is linked to your account and deleted if you remove the item or close your account.

Cached parliamentary data

To reduce API load times, we cache publicly available parliamentary data (questions, member details, debate transcripts). This contains no personal data about you — it is public record data about MPs and parliamentary proceedings.

Data we do NOT collect

• We do not use cookies for tracking or analytics
• We do not collect IP addresses or browsing behaviour
• We do not share any data with third parties for advertising

3. How We Use Your Data

• Email address — to manage your account login and, if you opt in, send service updates
• Tracked topics / stakeholders — solely to power your Smart Alerts scans

We do not sell, rent, or share your personal data with any third party, except as required to operate the service (see section 4).

4. Third-Party Services

Westminster Brief is hosted on Railway (railway.app), which processes data on servers in the United States. By using this service you consent to this transfer. Railway's privacy policy is available at railway.app/legal/privacy.

Search queries (not your account data) are sent to Google Gemini API to generate AI summaries. Google's data handling for API calls is governed by Google's API terms of service. We do not send your email address or account information to Google.

5. Data Retention

• Account data is retained for as long as your account is active
• Alert history is retained until you delete the alert or your account
• Cached parliamentary data has a rolling 7-day TTL for member data; transcript and question caches are permanent (they are public records that do not change)

6. Your Rights (UK GDPR)

Under UK GDPR you have the right to:

• Access the personal data we hold about you
• Correct inaccurate data
• Delete your account and associated personal data
• Object to processing in certain circumstances

To exercise any of these rights, email mark@westminsterbrief.co.uk. We will respond within 30 days.

7. Security

Passwords are stored using industry-standard one-way hashing (PBKDF2-SHA256). All data in transit is encrypted via HTTPS. We take reasonable technical precautions to protect your data, but no internet service can guarantee absolute security.

8. Changes to This Policy

We may update this policy as the service evolves. The date at the top of this page reflects the most recent revision. Significant changes will be communicated via the service.

9. Contact

For any privacy-related queries, email mark@westminsterbrief.co.uk.