Legal

Privacy policy

This policy explains what we collect when you ask for a case review, why we collect it, who we pass it to, and what you can ask us to do with it. Because this site asks about an injury, most of what you tell us is information about your health, and this policy is written around that fact rather than around it.

The short version

We collect what you type into the case review form, plus the technical details of the submission itself.
What you tell us about your injury is health information. We treat it as the sensitive category it is, we ask for your explicit permission before we do anything with it, and that permission is the only thing that allows us to pass it on.
We pass your details to one or more independent attorneys or law firms who may be able to help you. That is the entire point of the form, and it is what your consent covers.
Attorneys pay us for that. We never pass your details to unrelated advertisers, data brokers, list buyers, insurers or employers, and you can tell us to stop at any time.
You can ask us to delete everything we hold about you at any time, by emailing contact@compensationguardians.com.

Who is responsible for your data

Compensation Guardians is the controller of the personal data described here. The registered company behind the brand, its address and its director of publication are set out under Publisher in our terms. You can reach us about anything in this policy at contact@compensationguardians.com.

The company behind Compensation Guardians is established in France, so the EU General Data Protection Regulation applies to our processing wherever in the world the people concerned are located. If you are a United States resident, your state may give you additional rights, which are set out below.

What we collect

What you tell us

Your first and last name, phone number, email address, the state you were hurt in, what happened to you, roughly when it happened, and, on the form at the foot of the home page, where your claim currently stands with the insurer and anything you choose to write in the optional description.

Please do not send us medical records, imaging, social security numbers, bank details or copies of documents. The form does not ask for them and we do not need them. If an attorney needs documents they will ask you directly, through a channel they control.

Information about your health

The form asks what happened to you, and every answer to that question says something about your physical condition. Under article 9 GDPR that is a special category of personal data. Several United States privacy laws reach the same conclusion by a different route and call it sensitive personal information or consumer health data.

We process it only on the basis of the explicit consent you give when you tick the box and submit the form, and only for the purpose that box describes: connecting you with an attorney who may be able to help with your claim. There is no other lawful basis we rely on for it, which means withdrawing your consent stops the processing outright rather than moving it onto some other footing. You can withdraw it at any time by emailing us.

We are not a HIPAA covered entity. HIPAA applies to health plans, clearinghouses and healthcare providers, and we are none of those, so what you send us is not protected by it. That is a reason to send us less rather than more: the categories on the form are enough for an attorney to decide whether to call you, and the detail belongs in the conversation with them.

What the submission tells us

The time you submitted, the page you submitted from, the referring website, any campaign parameters in the link you arrived by, your IP address and your browser’s user agent. The last two are kept as evidence of the consent you gave, because a record of consent that cannot be tied to a submission is not a record of anything.

The record of your consent, kept by someone other than us

The claim review page runs a script from TrustedForm, a service operated by ActiveProspect, Inc. While you are filling the form in it records the page as it appeared on your screen, the exact consent wording you were shown, the technical details of your device and browser, and the timing of your interactions with the form.

It is configured to withhold the contents of the form. The only answers it is allowed to read are your first and last name, your phone number, your email address and your state, so that an attorney who receives your details can check they match the certificate. Everything you told us about your injury is withheld from it, including the category you picked and everything you wrote in your own words, and stays in our own database. This is the same line the Telegram alert draws, and for the same reason: nothing that describes your health goes anywhere it does not have to.

From that it issues a certificate, held on ActiveProspect’s own servers, and gives us a link to it which we store alongside your submission. The reason it exists is that every other record of your consent on this page is written by us, and we are the party it would be protecting. A certificate written by an independent third party is the only way we, or an attorney who receives your details, can show later what you were actually shown and what you actually agreed to. Attorneys who buy claim reviews increasingly require one.

If you block scripts, the certificate is simply not created. Your submission goes through exactly as it would otherwise.

Why we process it, and on what basis

To connect you with an attorney. Basis: your consent, given by ticking the box on the form. For the health information specifically, your explicit consent under article 9(2)(a) GDPR.
To contact you about your submission, including to check a detail or to tell you nobody is able to take it on. Basis: your consent.
To keep a record of that consent, including the independent certificate described above, so we can show what you agreed to and when. Basis: our legal obligation and our legitimate interest in defending a claim.
To detect spam and abuse of the form. Basis: our legitimate interest in keeping the service working.
To measure which campaigns work. Basis: our legitimate interest in running the business. This uses the campaign parameters, not what you told us about your injury. We do not build advertising audiences out of health information and we do not hand it to an advertising platform.
To meet our legal, accounting and tax obligations. Basis: legal obligation.

Who we share it with

Independent attorneys and law firms. This is the purpose of the form. Your details go to one or more attorneys or firms who practice workers compensation law in the state you were hurt in and who handle the kind of claim you described. They are independent businesses and separate controllers of your data once they receive it: how they store it, how long they keep it and how they contact you is governed by their own privacy policy, not ours. We do not control whether any of them decides to contact you or take your case. They also receive the link to your consent certificate, which is the point of it: it is how they satisfy themselves that you asked to be contacted, before they call you. The attorneys, firms, advertisers and marketing vendors this can run to are named on our marketing partners page.

Never your employer or their insurer. We do not contact the employer you describe, we do not sell to insurance carriers or claims administrators, and we do not supply data to anything that screens or scores injured workers. Nothing you send us goes to the other side of your claim.

Our service providers. The five companies below process your data on our instructions, under a written agreement, and are not permitted to use it for anything else.

Vercel Inc.: Website hosting and server logs. United States. 440 N Barranca Avenue #4133, Covina, CA 91723.
Supabase Inc.: Database storage for everything you enter on the form. United States. Data is stored in the AWS US East (North Virginia) region.
ActiveProspect, Inc.: TrustedForm, the independent record of your consent described above. United States, 7000 N MoPac Expressway, Austin, TX 78731. It receives the page as it appeared to you, the consent wording you were shown, your device and browser details and your name, phone number, email address and state. It receives nothing about your injury.
PostHog, Inc.: Website analytics and session recording, described under Cookies and tracking. United States. Data is stored in PostHog’s United States cloud region. It receives nothing you enter on the form and nothing about your injury.
Telegram: An alert telling us a submission has arrived, so somebody can act on it quickly. Telegram FZ-LLC, Dubai, United Arab Emirates. The alert is a copy of the submission rather than a summary of it, because if our database is unreachable it is the only copy that exists and we have to be able to reconstruct the record from it. It therefore carries your name, phone number, email address and state, how long ago you were hurt and whether you saw a doctor, the links to your consent certificate, the campaign your visit came from, and the IP address and browser recorded as consent evidence. Because whether you saw a doctor describes your health, the alert does carry health information, in the coarse form the form offers and no finer. It still does not carry what you wrote in your own words about your injury, only the fact that you wrote something.

Meta, for advertising measurement. Meta is not a service provider of the kind above. Through the advertising pixel described under Cookies and tracking, Meta Platforms Ireland Limited (Merrion Road, Dublin 4, D04 X2K5, Ireland) decides for itself part of what happens to the data it receives, so we and Meta are jointly responsible for collecting it and passing it on, and Meta’s own terms govern what it does with the data afterwards. Meta never receives your answers or anything you wrote about your injury.

Nobody else. We do not sell or rent your personal information to data brokers, list buyers or unrelated advertisers, and we do not use what you told us about your injury to target you with advertising for anything else.

Where required by law, including to respond to a lawful request from a court, a regulator or a law enforcement authority.

International transfers

We are established in France and the attorneys we work with are in the United States, so your data is transferred outside the European Economic Area. So are the services we use to run the site: what you submit is stored by Supabase in the United States, the site itself is hosted by Vercel in the United States, the record of your consent is held by ActiveProspect in the United States, analytics records and session recordings are held by PostHog in the United States, and the alert that tells us you have been in touch is delivered by Telegram in the United Arab Emirates. Data collected by the Meta pixel is received by Meta Platforms Ireland Limited and transferred by Meta to its parent in the United States under the EU-US Data Privacy Framework, to which Meta is certified. Your data therefore leaves the EEA from the moment you press the button, before any attorney has seen it. In ActiveProspect’s case it leaves before that, because the certificate is created while you are still filling the form in, which is part of why nothing about your injury is allowed into it.

Where that transfer involves personal data protected by the GDPR, we rely on the European Commission’s standard contractual clauses or on your explicit consent to the transfer, given when you submit the form knowing it is going to a United States attorney, and we check what safeguards are in place before transferring. The United Arab Emirates has no adequacy decision from the European Commission, which is why the Telegram alert is kept to the contact details and the shape of your claim and never carries your own description of your injury.

How long we keep it

Submissions: up to three years from the date you submitted, which is roughly the period during which a workers compensation claim and any appeal may still be live and an attorney may need to come back to it. Then deleted.
Consent records: five years, because that is longer than the period in which a claim about the contact you received could be brought against us. This includes the certificate held by ActiveProspect, which we retain for the same period. A certificate we do not retain is deleted by ActiveProspect, after 90 days where the form was submitted and after three days where it was not.
Suppression lists: indefinitely. If you ask us never to contact you again, we have to keep enough of your details to honour that. A suppression record holds your phone number and email address and never anything about your injury. See our do not call policy below.
Analytics: records of how this site is used are kept for up to 12 months. Session recordings are deleted automatically after 30 days.

Your rights

Wherever you are, you can ask us to give you a copy of what we hold, correct it, delete it, or stop using it. Email contact@compensationguardians.com and we will respond within one month. We will not charge you and we will not treat you differently for asking.

If the GDPR applies to you, you also have the right to object to processing based on legitimate interests, the right to data portability, the right to withdraw consent at any time without affecting what we did before you withdrew it, and the right to complain to a supervisory authority. In France that is the CNIL.

If you are a United States resident, your state may give you the right to know what is collected, to delete it, to correct it, to limit how sensitive information is used, to opt out of sale or sharing and of targeted advertising, and not to be discriminated against for exercising any of them.

Consumer health data laws. Washington’s My Health My Data Act and Nevada’s SB 370 give consumer health data its own regime, separate from the general privacy law in those states. If you are covered by one of them, you have the right to know what consumer health data we hold and who we have shared it with, the right to withdraw your consent to our collecting or sharing it, and the right to have it deleted, including from our backups and from anyone we passed it to. Those laws also require your separate, signed authorization before consumer health data may be sold. Email us and we will tell you what we hold, what we shared, and with whom.

About “sale”. Attorneys pay us when we pass them a submission. California and several other states define a sale broadly enough that this may count as one, even though we are doing exactly what you asked us to do and only what the form said we would. We would rather say that plainly than rely on a technicality. You can opt out at any time. Before you submit, opting out means not submitting. Afterwards, email us and we will stop passing your details on and tell you who already has them. We never disclose your information for cross-context behavioral advertising, and we do not knowingly sell or share the personal information of anyone under 16.

Once an attorney has your details they are a separate controller, so a deletion request to us does not reach their copy. We will tell you who we passed it to so you can ask them directly.

How we protect it

Submissions are transmitted over TLS and stored in a database that is not reachable from the public internet with the keys the website uses. Access is limited to the people who need it to run the service. No system is perfect, and we will tell you and the relevant authority without undue delay if a breach affects your data.

Cookies and tracking

Meta advertising pixel

This site carries the Meta advertising pixel on every page. It places two cookies in your browser: _fbp, which identifies your browser to Meta, and, if you arrived from a Meta advertisement, _fbc, which identifies the advertisement you clicked. It reports to Meta which page of this site you viewed. Together these let us measure which of our advertising leads to claim reviews.

When you submit the claim review form and your claim is one an attorney in our network may be able to take, we also send a record of that submission to Meta from our own server. That record carries the two identifiers above, your network address and browser description, and an irreversibly hashed copy of your name, email address, telephone number and state. Meta uses the hashes to recognise a submission it has already shown an advertisement to. The contact details themselves are not sent in a readable form.

Nothing about your injury goes to Meta. Not your answers, not what you wrote in your own words, and not whether you saw a doctor. We do not build advertising audiences out of health information.

Our lawful basis for the pixel is our legitimate interest in measuring and improving our own advertising. You can object at any time by writing to us, and you can stop it yourself by blocking third party cookies or scripts in your browser, or through the advertising controls in your Meta account.

Analytics and session recording

Every page also carries PostHog, which we use to see how people move through this site and where they give up on it. It stores one cookie in your browser, with a name beginning ph_ and ending _posthog, holding randomly generated identifiers for your browser and your current visit. The same values are kept in your browser’s local storage so that they survive between visits.

PostHog records which pages you open and in what order, the clicks you make outside the claim review form, the page you arrived from and any campaign parameters in the link you followed, and your browser, operating system and screen size. Your network address is used to derive an approximate location, no more precise than a city. We do not attach your name or any other contact detail to what PostHog records, and we do not keep a profile of you there.

We also record sessions: a replay of this site as it appeared on your screen, rebuilt from the page and from your mouse movement, taps and scrolling.

The claim review form is left out of both. In a recording the form, and the message you see after sending it, appear as a blank box. Clicks inside it are not recorded, and anything typed anywhere on the site is masked before it leaves your browser. What PostHog learns about the form is which question you reached and, if your claim is one an attorney in our network may be able to take, that it was sent. It never learns your answers, what you wrote, or whether your claim qualified.

The requests PostHog makes go through this site’s own domain rather than PostHog’s, so an extension that blocks analytics by hostname will not recognise them. Blocking third party scripts or cookies in your browser still stops them. Our lawful basis is our legitimate interest in understanding and improving how this site works, and you can object at any time by writing to us.

Everything else

We do not run Google Analytics or any analytics besides PostHog. Fonts are served from the site’s own domain.

Where a campaign link carries parameters such as utm_source or a click identifier, we read them from the URL and store them with your submission so we know which campaign it came from.

Besides the Meta pixel and PostHog, one third party script runs on this site, and only on the claim review page: the TrustedForm script described above. It is there to document your consent, not to profile you, and it is configured so that nothing you say about your injury reaches it. It records the session whether or not you go on to submit the form, but if you do not submit, nothing about that session ever reaches us and ActiveProspect deletes it after three days. If you have scripts blocked it does not run at all.

Do not call policy

Compensation Guardians maintains an internal do not call list. If you ask us to stop contacting you, we add you to it and we keep you on it permanently. You do not have to give a reason and you do not have to have submitted a form to ask.

Text messages: reply STOP to any message. That stops messages to that number immediately.
Email: use the unsubscribe link in any email, or write to contact@compensationguardians.com.
Calls: tell the caller you want to be put on the do not call list, or email contact@compensationguardians.com with the phone number you want suppressed.
Everything at once: email us and say so. Include the phone number and email address you want removed, so we can match them to your record.

A request takes effect as soon as we process it and within 10 business days at the latest. Honouring it means being able to recognize you next time, so we keep your phone number and email address on a suppression list indefinitely, as set out in the retention table above. That record exists only to stop contact. If you also want the rest of your submission deleted, including everything you told us about your injury, ask for that separately and we will do both.

Attorneys who already have your details. If you submitted the case review form, your details went to one or more independent attorneys or law firms, as the form said they would. They are separate businesses with their own contact practices and their own do not call obligations, and our suppression list does not reach them. Ask the attorney directly, and if you tell us who contacted you we will pass the request on and tell you who we sent it to.

How we call in the first place. We contact people who asked us to, by ticking the consent box on the form, and people who have an existing enquiry with us. We do not buy calling lists, and we do not obtain numbers from accident reports, hospital records, police logs or any other public filing. We identify ourselves and the purpose of the call at the start, we call between 8am and 9pm in your local time, and we honour a request made to anyone on our side.

You can also register your number with the United States National Do Not Call Registry at donotcall.gov or by calling 1-888-382-1222 from the number you want registered. Note that consent you have given to a specific company overrides that registry for that company, which is why asking us directly is the faster route.

If we get it wrong, tell us. Email contact@compensationguardians.com with the number, the date and roughly the time, and we will trace it, stop it, and tell you what happened.

Children and changes to this policy

The service is for adults. We do not knowingly collect personal data from anyone under 16; if you believe a child has submitted the form, email us and we will delete it. Minors are injured at work and are entitled to workers compensation like anyone else, and a parent or guardian is welcome to use the form on their behalf.

If we change this policy we will update the date below. Material changes to how we share your data will not be applied retroactively to submissions made under an earlier version. Because our basis for handling health information is your consent, a material change to what we do with it means asking you again rather than announcing it here.

Last updated: 24 October 2026