Privacy Policy

• Account data: email address and a hashed password. We never store your plaintext password.
• Files you upload: contracts, case files, and other documents you submit for review, drafting, or chat.
• Conversations and drafts: prompts, retrieved citations, generated responses, and draft versions.
• Usage events: token counts, retrieval results, and verification outcomes for quotas, billing, and quality auditing.
• Request metadata: IP address, user agent, and request id on authenticated requests. Retained for 30 days for abuse prevention and debugging.

• When enabled, analytics starts only after you accept. Declining does not affect accounts, legal tools, or billing. We measure allowlisted public page visits, explicit button/link clicks, and engagement, with coarse language and device categories. We do not replay browsing before consent.
• A secure first-party analytics cookie expires after 90 days. Sessions restart after 30 minutes of inactivity. Only registered campaign and ad identifiers are used for first and last eligible acquisition touches within 30 days. No full URLs, search strings, IP addresses, full user agents, legal content, recordings, or advertising-platform delivery are included in analytics records.
• Raw analytics has a 90-day retention policy; identity-free daily totals have a 13-month policy. Withdraw consent using Optional analytics on public pages or this privacy page. Withdrawal clears the analytics identifier and its server associations and stops collection. A non-identifying off preference may remain to remember your choice.
• Only after you choose to accept, a temporary cancellation token is shared between your tabs while the choice is being saved. It cannot identify analytics visits or authorize collection. Its server-side hash prevents a delayed acceptance from undoing withdrawal; failed cancellations remain available for retry.

• Government IDs, financial account numbers, or biometric data.
• Cross-site tracking cookies.
• Advertising profiling analytics.

• To answer legal questions, draft documents, and run contract reviews.
• To enforce per-user quotas and rate limits.
• To investigate abuse, debug incidents, and improve answer quality.

• Speech transcription: after recording stops, Q&A recordings are sent to Mistral; memo recordings are sent to OpenAI to return editable text. The app does not persist audio recordings. Vendor retention and training policies are separate and depend on the applicable provider terms and account settings.
• LLM provider: prompts and retrieved sources are sent for generation according to the active provider configuration.
• Mistral OCR: low-confidence scanned PDFs may be processed as described in the OCR Disclosure.
• Object storage, Postgres, and Redis operate inside our infrastructure footprint.

Each user has a scoped view of cases, files, drafts, conversations, and contract reviews. Cross-user access is enforced at the database query layer and verified by tests.

• Files and derived records are kept for the lifetime of your account.
• Deleting a file removes its object from storage when no other reference to the same content exists.
• Account deletion cascades to user-owned tables and removes object storage data within 30 days.

• TLS in transit.
• Encryption at rest for object storage and managed Postgres.
• JWT access tokens expire quickly and refresh tokens rotate on use.
• Uploads pass MIME allowlist and magic-byte checks before storage.
• Rate limits and token quotas reduce the blast radius from credential leaks.