Privacy Policy

Account information. Your name, email address, firm name, role, and authentication credentials (passwords are stored as bcrypt hashes; we never see your plaintext password).

Customer Data. Documents you upload, prompts you submit, conversations you have with the AI Assistant, agent runs, and research queries.

Billing information. Plan, subscription status, and payment method tokens stored by our payment processor (Stripe). We do not store full card numbers on our servers.

Usage information. Log data including IP address, browser type, pages visited, timestamps, and product events used to operate, secure, and improve the Service.

Cookies. See our Cookie Policy for details.

We use personal data to:

• Provide, maintain, and secure the Service
• Authenticate users and manage firm workspaces
• Process payments and manage subscriptions
• Generate AI responses through our model providers
• Send transactional emails (account, billing, security)
• Detect, investigate, and prevent abuse and security incidents
• Comply with legal obligations and enforce our Terms

For users in the EEA and UK, we process personal data on the bases of (a) performance of a contract, (b) compliance with legal obligations, (c) legitimate interests in operating and securing the Service, and (d) consent where required (e.g., non-essential cookies).

We do not use Customer Data to train foundation models. We pass prompts and document context to third-party model providers (e.g., Anthropic) under contractual terms that prohibit them from training models on your data.

We share personal data only with:

• Subprocessors that help us operate the Service. See our Subprocessors list.
• Other Members within your firm workspace (limited to what their role permits).
• Law enforcement or regulators when required by valid legal process, with notice to you where permitted.
• Acquirers in the event of a merger, acquisition, or sale of assets, subject to equivalent privacy protections.

We do not sell personal data and we do not share it for cross-context behavioral advertising.

We retain account and Customer Data for as long as your account is active. Within 30 days of account termination, we delete Customer Data from production systems. Backups expire on our standard retention schedule (typically 90 days). Audit logs may be retained longer where required for security or compliance.

We implement administrative, technical, and physical safeguards including TLS 1.2+ in transit, AES-256 at rest, role-based access controls, audit logging, and least-privilege access for employees. See our Security page for more detail.

We are headquartered in the United States and our primary infrastructure is located in the US. If you access the Service from outside the US, your data will be transferred to and processed in the US. Where required, we rely on Standard Contractual Clauses to lawfully transfer personal data out of the EEA/UK.

Depending on your jurisdiction, you may have the right to access, correct, delete, restrict processing of, or port your personal data, and to object to certain processing. EEA/UK users may lodge complaints with their supervisory authority. California residents have rights under the CCPA/CPRA.

To exercise rights, email privacy@elawplatform.com. We will respond within the timeframes required by applicable law.

The Service is not directed to children under 18 and we do not knowingly collect personal data from children. If you believe a child has provided us with personal data, contact us and we will delete it.

We may update this Privacy Policy from time to time. Material changes will be communicated through the Service or by email at least 30 days before they take effect.

Privacy questions? Email our Data Protection contact at privacy@elawplatform.com.