Privacy Policy

What we collect

• Account data: email address and a hashed password. We never store your plaintext password.
• Files you upload: contracts, case files, and other documents you submit for review, drafting, or chat.
• Conversations and drafts: prompts, retrieved citations, generated responses, and draft versions.
• Usage events: token counts, retrieval results, and verification outcomes for quotas, billing, and quality auditing.
• Request metadata: IP address, user agent, and request id on authenticated requests. Retained for 30 days for abuse prevention and debugging.

Optional analytics

Optional analytics starts only after consent. First-party storage measures allowlisted public page visits, explicit link clicks and engagement with coarse language/device categories and approved campaign labels. We do not replay browsing before consent. Declining does not affect legal tools, accounts or billing.

With account consent, allowlisted signup, email verification, qualified grounded Personal Q&A success and verified paid milestones may be sent by our server to PostHog in the United States. Public page and signup-start events may also be sent with browser consent. Events use dedicated random analytics identifiers, not application account IDs. No legal questions, answers, titles, files, audio, names, emails, full URLs, referrers, IP addresses or user agents are exported as event properties. Profile processing and GeoIP enrichment are disabled; the processor can see the server network source.

Browser consent and saved account consent are separate. The first-party analytics cookie expires after 90 days, but expiry and logout do not withdraw a saved account grant. Manage both on this privacy page, including when measurement is suspended. Withdrawal stops future collection and cancels pending exports. Records already sent to the processor are not automatically erased retrospectively. Cookie expiry is not physical deletion, and we do not currently enforce automatic analytics-record deletion on a fixed schedule.

Contact [email protected] for access or deletion requests. Requests are reviewed, including applicable business-record obligations and processor retention; we do not promise immediate physical erasure or zero vendor retention. A shared off marker and temporary cancellation capabilities prevent delayed browser acceptance. A failed account withdrawal can retain an actor-bound retry marker in this tab, without credentials. This marker cannot withdraw another account.

What we do NOT collect

• Government IDs, financial account numbers, or biometric data.
• Cross-site tracking cookies.
• Advertising profiling analytics.

How your data is used

• To answer legal questions, draft documents, and run contract reviews.
• To enforce per-user quotas and rate limits.
• To investigate abuse, debug incidents, and improve answer quality.

Third-party processors

• PostHog (United States): consented allowlisted analytics events only, as described above. Processor retention and deletion handling are separate from stopping future collection.
• Speech transcription: after recording stops, Q&A recordings are sent to Mistral; draft recordings are sent to OpenAI to return editable text. Sent attempts can consume the independent transcription-seconds allowance, including attempts whose completion is uncertain after cancellation, timeout or connection loss. Their reserved seconds remain counted until the outcome is resolved; cancellation does not prove that provider processing stopped. This allowance is not a money charge to Personal credits. The app does not persist audio recordings. Vendor retention and training policies are separate and depend on the applicable provider terms and account settings.
• LLM provider: prompts and retrieved sources are sent for generation according to the active provider configuration.
• Mistral OCR: low-confidence scanned PDFs may be processed as described in the OCR Disclosure.
• Object storage, Postgres, and Redis operate inside our infrastructure footprint.

Data isolation

Each user has a scoped view of cases, files, drafts, conversations, and contract reviews. Cross-user access is enforced at the database query layer and verified by tests.

Retention and deletion

• Files and derived records are kept for the lifetime of your account.
• Deleting a file removes its object from storage when no other reference to the same content exists.
• Account deletion cascades to user-owned tables and removes object storage data within 30 days.

Security

• TLS in transit.
• Encryption at rest for object storage and managed Postgres.
• JWT access tokens expire quickly and refresh tokens rotate on use.
• Uploads pass MIME allowlist and magic-byte checks before storage.
• Rate limits and token quotas reduce the blast radius from credential leaks.