Introduction
I use AI in my work. This page explains how, and what happens to your information.
It covers two periods: before you instruct me, and after. Different people are responsible for your information in each of them.
Before you instruct me
When you first contact me you are dealing with Steven Mather Solicitor, a trading name of Kesters Nook Limited (company number 12174386). Kesters Nook Limited is not authorised or regulated by the Solicitors Regulation Authority and does not give legal advice.
At that stage I am responsible for the information you send me: your enquiry, our first conversation, and any documents you share so I can work out whether I can help and what it will cost.
I treat that information as confidential from the first email. The duty of confidentiality applies to prospective clients as well as clients, and I apply it whether or not you go on to instruct me.
I may use AI tools at this stage, for example to summarise a document you have sent or to produce a note of our call. The controls set out below apply.
If you do not instruct me, I keep your enquiry and any documents for twelve months so I can run conflict checks and pick up where we left off if you come back. I then delete them. If you want them deleted sooner, ask and I will.
I will not use documents you send me for anything other than assessing your matter. They are not used as examples, in marketing or in training material, and the AI providers I use are not permitted to train their models on them.
You do not have to send documents before you have an engagement letter. Tell me the outline of the problem and I will scope it from that.
After you instruct me
Legal work is carried out through Nexa Law Limited, which is authorised and regulated by the Solicitors Regulation Authority under SRA number 633024. From the point you instruct me, Nexa Law is responsible for the information on your matter file and Nexa Law’s privacy notice applies to it. I act as a consultant solicitor within that structure.
How I use AI
I use AI for research and first pass analysis, summarising long documents and disclosure bundles, first drafts of contracts and correspondence, comparing versions of documents, transcribing calls to produce notes, and administrative work.
In each case the output is a starting point. The advice you receive is mine.
What I do not use AI for
I do not use AI to decide anything about your matter. No decision affecting you is made by a machine alone.
I do not put health information, or information about criminal offences, into an AI tool unless I have assessed that particular use and am satisfied it is appropriate.
I do not use free or personal AI accounts for your work. It runs through business accounts held under commercial terms, with a written data processing agreement, on settings that exclude your data from model training.
I do not send you, the other side or a court anything produced by an AI tool that I have not read and checked.
Checking the work
I review everything an AI tool produces before it is used.
Any case, statute, statutory instrument or piece of regulator guidance I refer to is checked against the primary source. I do not rely on an AI tool’s summary of what a case says. Using AI does not change my/Nexa’s responsibility to you, or the professional indemnity insurance that sits behind the work.
Confidentiality and privilege
Where confidential information goes into an AI tool, the provider is engaged under written terms requiring it to process that information only on my instructions, to exclude it from model training, to limit how long it keeps it, and to meet security obligations.
Disclosure to a supplier on those terms does not waive privilege. I may limit what goes into what the task needs, and redact where the task allows.
Data protection
The AI providers I use act as processors under contracts meeting the requirements of Article 28 of the UK GDPR. Using an AI tool does not change why I am processing your information. Before you instruct me the purpose is assessing and scoping your matter. After you instruct me it is delivering the legal services you have engaged me for.
Most AI providers, including the ones I use, run on infrastructure in the United States. Sending information to them is a restricted transfer under Chapter V of the UK GDPR. No adequacy decision covers these transfers, so they are made under the UK International Data Transfer Addendum to the European Commission standard contractual clauses, supported by a transfer risk assessment.
Retention by providers is limited by contract. I delete conversations and uploaded material from AI tools once the task is finished. Where a use of AI is likely to result in a high risk to individuals, I carry out a data protection impact assessment first.
What I cannot promise
Your information will leave the United Kingdom. None of the main AI tools offers a UK-only service. The protection is contractual rather than geographic, and I cannot contract away the possibility of access by United States authorities under US law.
No provider offers zero retention as standard. The retention periods are short and contractually limited, but they exist.
AI output can be wrong, and it can be wrong convincingly. My review is the control against that. It is applied carefully and it is not infallible.
Providers change their terms, their sub-processors and their default settings. I review the tools I use periodically rather than continuously.
Recordings
I sometimes record and transcribe calls and meetings so I can produce an accurate note, including at first enquiry. I will tell you before I do. If you would rather I did not, I will not. Recordings and transcripts form part of the file.
Restrictions you should tell me about
I do not offer an AI free service. AI assistance is part of how the work gets done.
Your own policy, your insurer, your regulator, or a confidentiality agreement in a transaction may restrict the use of third party AI tools. Non disclosure agreements in business sales increasingly do. If that applies to you, tell me at the start and we will agree in writing what restrictions I work under. It may affect cost and timescales, and I will tell you if it does.
This page does not override an agreement I have signed on your matter. If a confidentiality agreement restricts AI processing, that agreement governs.
Services that are not legal advice
Some of what I offer is not regulated legal advice and is not delivered through Nexa Law. That includes AI assisted document review, and exit and deal preparation services provided on a commercial basis.
Those services use AI more extensively. They are not covered by solicitors’ regulation or the protections that go with it, and they are not advice on your specific position. The terms of each service say who you are contracting with. If you are not sure which you are buying, ask me.
Your rights and complaints
You have rights over your personal information under the UK GDPR, including access, correction, deletion, restriction, objection and portability. Before you instruct me, contact me to exercise them. After you instruct me they are exercised against Nexa Law Limited under its privacy notice. Either way, you can complain to the Information Commissioner’s Office at ico.org.uk.
If you are unhappy with the service you have received on a legal matter, my complaints information page explains how to raise it.
Questions
If you want to know how AI has been used on your matter, or on your enquiry, ask me and I will tell you.