Privacy Policy

1. Data controller

The data controller for this Service is:

What If Now Ltd
Dublin, Ireland
Email: hello@whatifnow.ie

2. What data we collect

When you use righttostay.ie, we collect the following data:

We do not collect names, email addresses, phone numbers, payment information, or location data (beyond what is implicit in an IP address).

No account is required to use this Service. We do not ask you to register, log in, or provide any identifying information.

3. Special category data

Under Article 9 of the GDPR, certain types of personal data are classified as “special category” data and require additional safeguards. When you describe your tenancy situation, your question may contain sensitive personal information, such as:

• Health or disability information
• Family or relationship circumstances
• Ethnic or national origin
• Financial hardship

We do not request or require this information. If you choose to include it in your question, it will be processed solely for the purpose of generating your answer. We strongly encourage you to include only the information necessary to describe your tenancy situation.

4. Lawful basis for processing

Our lawful basis for processing your data is consent under Article 6(1)(a) of the GDPR. By actively submitting your question, you consent to the processing described in this policy.

Where your question contains special category data, our lawful basis is explicit consent under Article 9(2)(a) of the GDPR, demonstrated by your voluntary submission of the question.

You may withdraw consent at any time by ceasing to use the Service. As we do not store questions persistently, there is no ongoing processing to withdraw from.

5. How we process your data

When you submit a question:

1. Your question is sent from your browser to our server.
2. Our server forwards the question to Vertex AI (Google Gemini) for answer generation.
3. The AI generates a response based on its training data and our grounding sources (RTB decisions and Irish tenancy legislation).
4. The answer is returned to your browser and displayed.

Your question is processed in real time. It is not stored persistently and there is no conversation history.

6. Sub-processors

We have a Data Processing Agreement in place with Google Cloud in accordance with Article 28 of the GDPR.

7. Data retention

8. Cookies and analytics

We use essential cookies for the basic operation of the website. These do not require your consent.

We also use Google Analytics 4 (measurement ID G-4XH7PPYK7K) to understand how the site is used so we can improve it. Google Analytics is only loaded if you click “Accept” on our cookie banner. If you decline, no analytics cookies are set and no requests are sent to Google.

If you accept:

• Cookies named _ga and _ga_* are set in your browser by Google Analytics.
• Your IP address is anonymised before being sent to Google (the anonymize_ip setting is enabled).
• We do not use Google Ads, advertising cookies, remarketing, or any other third-party trackers.

You can withdraw your consent at any time by clearing your browser’s cookies for this site, which will remove the analytics cookies and prompt the consent banner again on your next visit.

The site loads web fonts from fonts.googleapis.com and fonts.gstatic.com. These are used to display the site’s typography and are not used for analytics or tracking.

Our native iOS and Android apps do not use Google Analytics. They send anonymised event data to our own backend at /api/track for the same purpose — understanding usage so we can improve the apps.

9. Your rights

Under the GDPR, you have the following rights in relation to your personal data:

In practice, as we do not store questions persistently and do not create user accounts, the exercise of these rights is limited. Server logs containing your IP address are automatically deleted after 30 days.

To exercise any of these rights, please contact us at hello@whatifnow.ie.

10. Right to complain

If you are unsatisfied with how we handle your personal data, you have the right to lodge a complaint with:

Data Protection Commission (DPC)
21 Fitzwilliam Square South
Dublin 2, D02 RD28
Ireland

Website: www.dataprotection.ie
Phone: +353 (0)1 765 0100 / 1800 437 737

11. Children

This Service is not intended for children under the age of 18. We do not knowingly collect personal data from children. If you are under 18, please do not use this Service. If you believe a child has submitted data through this Service, please contact us at hello@whatifnow.ie and we will take steps to delete the relevant server logs.

12. International transfers

We do not transfer your personal data outside the European Economic Area (EEA). All processing occurs within the EU, specifically in the europe-west1 (Belgium) region of Google Cloud Platform.

13. Optional case-pack hand-off to a solicitor (draft — not yet enabled)

We are preparing an optional, opt-in feature that lets you send your question, the AI answer, and (if you choose) contact details or an uploaded notice to a Stare-licensed solicitor of your choice. We call this a case-pack hand-off. It is described in our public architecture decision record ADR-0011.

This section is draft pending a Law Society referral opinion. The hand-off is not enabled in the live product until that opinion is received and adopted. When it does go live, this section will be re-published with the date adoption was confirmed.

13.1 What we share, only if you ask us to

You decide what is sent, on a per-pack basis, with one toggle per field. The defaults are minimum-disclosure. Required fields are the anonymised question, the AI answer, your jurisdiction, and the dispute type. Everything else — your contact details, any document you upload — is off by default and you switch it on before submitting. You see the redacted text we will share with the firm, before you tick.

13.2 You choose the firm. We do not match.

You pick the firm from a directory you can sort by neutral attributes (proximity, language, accepts-legal-aid, declared practice areas, response-time SLA). We do not rank firms by how good a fit they are for your case. We do not use AI to match you to a firm. Where we apply a routing rule (jurisdiction, dispute type, urgency, language), it is a deterministic rule published in our public source code and visible in the audit log.

13.3 No referral fees, ever

We do not take a referral fee, conversion fee, or any payment from solicitors keyed to the volume of cases you or others send. The Stare licence the firm pays us is a flat subscription for our B2B precedent-intelligence product; it does not vary with case-pack flow. This is required by Solicitors Act 1954 s.59, the Solicitors (Advertising) Regulations 2019, and the Legal Services Regulation Act 2015 s.213.

13.4 Lawful basis

Sharing the case-pack with the solicitor is lawful under Article 6(1)(a) GDPR — explicit consent, given by you on a per-pack basis at the moment of submission. Where your question contains special category data (Article 9 — health, family, ethnicity, religion), our basis is Article 9(2)(a) — explicit consent, again captured in the per-pack consent panel.

13.5 The technical path

Your selected pack is sent from righttostay.ie to a Cloud Run service we operate called the case-pack-broker, in europe-west1 (Belgium). The broker re-runs the anonymisation regex pass, signs the envelope, and notifies the firm’s Stare inbox. The firm then either claims the pack (becomes your data controller for the file going forward) or declines it (the pack times out and is deleted).

13.6 Two controllers, one consent

Until the firm claims, What If Now Ltd is the data controller for the consent record, the broker envelope, and the delivery audit log.

From the moment the firm claims, the firm is your independent data controller for the pack content as their matter file. We are not their processor and they are not ours. Each side is responsible for its own controller obligations.

The firm becomes a recipient class: Stare-licensed solicitors of your choice for the purposes of Article 13(1)(e) GDPR. We do not transfer your data to any other recipient class for this hand-off.

13.7 Retention

13.8 Your rights, depending on what stage the pack is at

The case-pack hand-off creates a moment when responsibility shifts from us to the firm. Where you direct your GDPR request depends on where the pack is at that moment.

13.9 What we do not do

• We do not host the channel between you and the solicitor after hand-off. Their email or phone reply to you goes through their own systems, not ours.
• We do not charge you for the hand-off. We do not receive a payment from the firm based on whether you went ahead. The hand-off is free and stays free.
• We do not certify your identity, the truth of your facts, or the validity of your matter to the firm. The firm runs its own intake and conflict check. The pack accelerates that work; it does not replace it.
• We do not guarantee a firm will accept your pack. If no firm claims, the pack expires and is deleted. Threshold (1800 454 454) and FLAC (flac.ie) are alternative routes that do not require a case-pack.

13.10 The firm is not yet your solicitor

Sending a case-pack to a firm does not make that firm your solicitor. The firm becomes your solicitor only when you and they sign an engagement letter. Until then the firm has no duty of care to you, and the pack is a prospective-client handover. The pack header tells the firm this in the same words.

13.11 More on what the firm receives and what they must do

If you want to read the privacy notice we give to firms when we onboard them to the inbound inbox — covering what they get, their controller obligations, retention, and EEA-only processing — it is published at company/legal/stare-firm-onboarding-privacy-notice.md. The Data Protection Impact Assessment for the case-pack hand-off is at company/legal/dpia-case-pack-handoff.md.

14. Changes to this policy

We may update this Privacy Policy from time to time. Changes will be effective when posted on this page, and the “Last updated” date will be revised accordingly. We encourage you to review this policy periodically.