Privacy Policy

Last updated: 22 September 2026

In brief: You do not need an account to use DossierShift. Your interview is processed to provide the service. We retain interview content for product learning only if you choose to allow it. We do not currently use advertising or analytics cookies.

1. Who we are

DossierShift is operated by Murray Lorne Shawn McLaughlin, a sole trader trading as DossierShift. Murray Lorne Shawn McLaughlin is the data controller for personal information processed by DossierShift.

Postal address:
Murray Lorne Shawn McLaughlin
31 Bedford Square
Brighton BN1 2PL
United Kingdom

Privacy enquiries: [email protected]

2. What DossierShift does

DossierShift is an AI-assisted exploratory service. It conducts a conversational interview, creates a Human Dossier from the conversation, and suggests possibilities for the user to explore.

No visitor account is required. DossierShift is designed to work without asking for your name, email address or other direct identifiers as part of the interview.

3. Information we process

Depending on how you use DossierShift, we may process:

Interview content: the answers and other text you enter during the conversation, together with AI-generated responses.
Dossier and possibilities: the Human Dossier and suggested possibilities generated from your conversation.
Session information: a randomly generated session identifier, timestamps and your product-learning consent setting.
Product-learning information: if you opt in, DossierShift retains learning events associated with the session, which may include conversation content, generated results and your reaction to a suggested possibility.
Technical information: hosting, security and network providers may process technical information needed to deliver and protect the service, such as IP addresses, request information and network or security logs.

Because the interview uses free-form text, information you enter may itself identify you or another person even though DossierShift does not ask you to identify yourself.

Please do not enter sensitive personal information such as medical details, identification numbers, financial information, or private information about other people. DossierShift does not need this information to provide the interview.

4. Why we use information and our lawful bases

Providing the DossierShift service. We process the information you submit so that we can conduct the interview and generate your Human Dossier and possibilities. Our lawful basis is that this processing is necessary to provide the service you have requested and to perform our agreement with you.

Optional product learning. If you select the option to allow your conversation to be retained and used for product learning, our lawful basis for that additional use is your consent. You can use DossierShift without giving this consent, and you may withdraw it.

Security and operation. We may process limited technical information where necessary for our legitimate interests in operating, securing, troubleshooting and protecting DossierShift. We seek to limit this processing to what is proportionate for those purposes.

We may also process information where necessary to comply with a legal obligation.

5. AI processing

DossierShift uses OpenAI's API to generate conversational responses, the Human Dossier and suggested possibilities. Information needed for those requests is therefore transmitted to and processed by OpenAI.

DossierShift configures its OpenAI Responses API requests with response storage disabled. OpenAI states that API inputs and outputs are not used to train its models by default unless the customer has chosen to opt in. OpenAI may separately retain limited API data in abuse-monitoring systems for up to 30 days, subject to its applicable policies, legal requirements and any account-level data controls.

Your choice about DossierShift product-learning retention does not prevent the processing required to generate AI responses while you are using the service. That processing is necessary to provide DossierShift itself.

6. Product-learning consent

The product-learning option is off unless you choose it. If it remains off, DossierShift does not retain your conversation as product-learning events in its learning database.

If you turn product learning on, learning events associated with that session may be retained so that we can evaluate and improve DossierShift.

If you later turn product learning off during that session, retained learning events for that session are deleted. A minimal session record may remain temporarily until the short session-metadata retention period described below expires.

7. How long we keep information

We aim to keep information only for as long as it is needed for the purposes described in this policy.

If product-learning consent is off, DossierShift keeps only minimal server-side session metadata and periodically deletes it after approximately 24 hours.
If product-learning consent is on, the session and its learning events are normally retained for up to 90 days for pilot product learning and are then periodically deleted.
If product-learning consent is withdrawn, the retained learning events for that session are deleted and the remaining minimal session record is subject to the short retention period above.

These DossierShift retention periods do not replace separate, limited retention that may occur within infrastructure or AI providers for security, abuse prevention, legal compliance or service operation.

8. Browser storage

DossierShift uses browser storage to make the service work. The current interview and anonymous session identifier are stored in sessionStorage, which is designed to last for the browser tab/session. Your product-learning consent preference is stored in localStorage so that DossierShift can remember your choice.

You can remove this browser-stored information using your browser's site data controls. Starting a new DossierShift interview clears the current interview and session identifier while retaining your product-learning preference.

DossierShift does not currently use advertising or behavioural analytics cookies. If our use of cookies or similar technologies changes, we will review the consent requirements and update this policy.

9. PDF downloads

If you choose “Save My Dossier,” DossierShift sends the generated Dossier and possibilities to its server to create the PDF. This PDF-generation request does not make an additional AI request and the PDF endpoint does not add the document to DossierShift's learning database. The generated file is returned to your browser for download.

10. Service providers

DossierShift currently relies on service providers including:

OpenAI — AI processing used to conduct the interview and generate results.
Railway — application hosting, computing and persistent storage.
Cloudflare — network delivery, DNS, security and related infrastructure services.

These providers may process information on our behalf or process limited service and security information under their own applicable terms and privacy obligations.

11. International processing

DossierShift uses providers whose operations may involve processing or transferring information outside the United Kingdom.

Where UK data-protection law requires safeguards for an international transfer, we rely on the transfer mechanisms applicable to the relevant provider and service, such as recognised adequacy arrangements or contractual safeguards. Provider infrastructure and processing locations can change, so we do not represent that all processing occurs exclusively in the United Kingdom.

12. Security

We use reasonable technical and organisational measures appropriate to the nature of the pilot service. These include HTTPS in transit, restricted administrative access, separation of the public service from the internal pilot review interface, and limited retention.

No internet service can guarantee absolute security. Please avoid entering information that DossierShift does not need, particularly sensitive personal information.

13. Automated processing

DossierShift uses AI to analyse the conversation and generate exploratory descriptions and possibilities. These outputs are intended to help you reflect and explore. They are not employment decisions, psychological assessments, predictions, or decisions that determine your legal rights.

DossierShift does not make hiring, eligibility or other similarly significant decisions about you.

14. Your data-protection rights

Depending on the circumstances and the lawful basis involved, UK data-protection law may give you rights including access to your personal information, correction, erasure, restriction of processing, objection to certain processing, and data portability. Where processing is based on consent, you may withdraw that consent at any time without affecting the lawfulness of processing that took place before withdrawal.

DossierShift deliberately avoids requiring an account or direct identity information. This means we may sometimes be unable to connect an anonymous session to a particular person without additional information from that person. If you contact us about a session, please provide any session information available to you that can reasonably help us identify the relevant data.

To exercise a data-protection right or ask a privacy question, contact [email protected].

15. Complaints

If you have a concern about our use of your personal information, please contact us first so that we can investigate it.

You also have the right to complain to the UK Information Commissioner's Office (ICO), the UK's data-protection regulator.

16. Changes to this policy

We may update this Privacy Policy as DossierShift develops or if our legal, technical or operational requirements change. The date at the top of this page shows when the policy was last updated. If we introduce a materially different use of personal information, we will update the information provided to users as appropriate before beginning that processing.

17. Contact

General support: [email protected]
Privacy: [email protected]