Privacy Policy

www.ai.law Corp. ("AI.Law") operates the AI.Law website and platform. This Policy describes how AI.Law collects, uses, discloses, and retains personal information and how individuals can exercise privacy choices. The Terms of Service govern the service contract. Acknowledging this Policy does not provide consent for every processing activity or waive privacy rights.

A "Customer" is the person or organization holding an account. "Authorized Users" are people permitted to use that account. "Subscriber Content" includes uploaded or imported files, matter and client records, prompts, chats, generated work, and derived content.

AI.Law determines the purposes of its own account administration, billing, security, and permitted analytics. When processing Subscriber Content on a Customer's instructions, AI.Law acts on that Customer's behalf under the applicable agreement. The Subscriber determines the authority for collecting client and third-party information and providing it to the platform. Individuals whose information appears in a firm's records should ordinarily direct requests to that firm; AI.Law will assist or route requests as appropriate.

AI.Law obtains information from individuals, their organizations, authorized collaborators, selected integrations, service providers, public sources used for requested research, and use of the website and platform. Sources and categories include:

Category	Examples and source
Identifiers and Subscriber records	Names, contact details, account and organization IDs, authentication information, and preferences supplied during registration or account administration.
Commercial and professional information	Plan selections, invoices, payment status, usage charges, firm details, and professional roles. Payment processors handle full payment-card details; AI.Law receives transaction and payment-method information.
Subscriber Content	Matter records, communications, documents, audio, images, video, and generated or inferred information. Depending on what a Subscriber supplies, these may include protected characteristics, employment or education records, and sensitive health, financial, identifying, or other personal information.
Internet activity and device information	IP addresses, browser and device information, persistent browser and session identifiers, approximate location, referring pages, campaign information, and activity described below.
Support and communications	Messages, AI Troy conversations, feedback, support requests, and information provided during troubleshooting.
Usage inferences	Information about feature adoption, account activity, and support or service needs derived from service use.

These categories describe current collection and collection during the preceding 12 months, depending on how the service was used. AI.Law uses and discloses them for the purposes and to the recipient categories described in this Policy. Subscriber Content can contain personal information about people who never visit AI.Law.

AI.Law uses information to establish accounts; store and organize records; provide requested AI and other features; enable authorized collaboration and integrations; administer subscriptions, usage limits, and payments; deliver service notices; provide support; diagnose failures; protect accounts; investigate misuse; and meet legal obligations.

AI.Law also uses permitted activity records and feedback to understand adoption, improve usability and reliability, and measure marketing. Marketing messages and optional tracking remain subject to the choices below. Subscriber Content is not used for targeted advertising or to build advertising profiles. A new incompatible use requires the notice, permission, or other legal basis applicable to that use.

Activity inside an account is associated with users and organizations. Records can include pages and tools used, clicks and selections, click location, session and sign-in times, time spent, workflow progress, viewed or exported results, errors, and related matter or document identifiers. These records are personal information even when AI.Law later combines them into reports. Subscriber Content incidentally captured in activity, diagnostic, or billing records retains the protections for Subscriber Content.

AI.Law records AI and other resource consumption, including feature and processing activity, usage quantities, processing time, errors, and associated charges or credits. Records may be attributed to a user, organization, matter, or document for service operation, support, plan administration, usage limits, and billing. Internal processing-cost records differ from customer-facing allowance measures and charges. Authorized organization administrators may receive account administration and usage information appropriate to their permissions.

Browser storage can maintain random visitor and session identifiers. A visitor identifier and marketing attribution may be connected to an account after registration, subject to applicable choices. API and security records can contain IP addresses and browser information. Session replay is disabled on the website and platform. Diagnostic event records support troubleshooting and remain subject to this Policy.

AI.Law does not use Subscriber Content to train or fine-tune AI models and does not authorize its AI providers to do so. AI providers process content supplied for requested features. Using content as context for a response differs from changing a model's trained parameters. A firm's settings, examples, and feedback may be used within that firm's workspace to tailor its results.

No-training commitments do not mean that every provider retains no data. Transient processing, safety and abuse-monitoring records, caches, and files or indexes stored to support a feature have different retention arrangements. The AI Provider Schedule identifies active providers, relevant service categories, processing locations, retention periods or criteria, deletion arrangements, and any specifically applicable zero-retention controls. AI.Law does not represent that all features operate under zero-data-retention arrangements. The schedule is available with the service's privacy information and through the contact details below.

Confidential client information is not placed in shared training, testing, evaluation, or product-knowledge datasets. Reusable product-help information must contain no Subscriber or client facts, matter information, identifying details, or excerpts of Subscriber Content. Rewording those facts does not make them eligible for shared reuse.

Supported upload controls allow Customers to store files without enabling AI analysis. Once an AI exclusion takes effect, the excluded file's contents, retained extraction data, and content-bearing metadata such as filenames, titles, and descriptions are unavailable to AI processing. This includes background analysis and retrieval unless an authorized user enables processing again. Storage, authorized human access, and necessary non-AI security functions can continue. A privilege or sharing label does not itself disable AI.

An exclusion does not reverse earlier provider processing or remove material already saved in a separate draft, summary, or message. The control explains its scope and any additional deletion steps.

AI Troy processes its own help conversations and relevant account context. Authorized personnel and AI review services may review those conversations to answer questions, investigate problems, and assess support quality. Product-help reuse outside the originating account is limited to the information described in Section 5.

Routine access to Subscriber Content for support requires Subscriber authorization. Access is limited to what the task needs, recorded, and ended when no longer needed. Troubleshooting may use a temporary support session or controlled test copy; copies receive equivalent protection and are removed after the task under the retention rules below. Narrow access necessary to investigate an urgent security incident or meet a legal obligation may occur without advance permission, with notice when appropriate and lawful.

AI.Law discloses information as needed to hosting, authentication, storage, AI, payment, communications, support, security, analytics, and diagnostic providers. Providers handling information on AI.Law's behalf are subject to confidentiality, purpose restrictions, and appropriate data-protection terms. Certain payment, legal, or other recipients may have independent legal responsibilities. Recipient access is limited to the relevant service.

Subscriber Content and collaboration information may be disclosed to the Customer's authorized users and to recipients or integrations the Subscriber selects. Those recipients' practices and permissions also matter. Third-party sites and independently selected services have their own privacy policies.

Analytics and advertising partners may receive identifiers, internet activity, approximate location, and campaign information for the purposes and under the choices below. Subscriber Content is not disclosed for those advertising purposes.

AI.Law may disclose necessary information to professional advisers, authorities, or other parties to comply with law, protect against security threats, or establish or defend legal claims. Required disclosures of Subscriber Content are subject to the notice and protection provisions in the Terms. A corporate transaction may involve limited disclosures to advisers or prospective successors under confidentiality restrictions; a successor must respect applicable commitments.

Cookies, pixels, local storage, and similar technologies support authentication, security, preferences, analytics, and marketing. Necessary service functions and records remain active when optional tracking is declined. Optional analytics and advertising technologies operate subject to the choices presented and any required consent. Creating an account or accepting the Terms overrides prior existing privacy choices; choices may be changed afterward through the Privacy Choices control.

The website's Privacy Choices control permits changes to optional tracking settings, including a request not to sell or share personal information or use it for targeted advertising. AI.Law does not sell Subscriber Content or share it for cross-context behavioral advertising. Website and account identifier disclosures to advertising partners can constitute a sale or sharing under privacy law; the control applies to those disclosures, including the identifier and activity categories described above.

AI.Law honors recognized opt-out preference signals, including Global Privacy Control, for applicable sale, sharing, and targeted-advertising choices. A signal applies to the browser or device and to an associated account when required and identifiable. AI.Law does not require identity verification to submit these opt-outs. Conventional Do Not Track is not treated as a service-wide opt-out, although individual tools may honor it. The Privacy Choices control and recognized signals described above provide the available service-wide choices.

Browser settings can block or remove storage, although essential features may be affected. Choices may need to be repeated on a different browser or after storage is cleared. Marketing emails include an unsubscribe method; essential account, security, and transaction notices may continue. Minimal suppression information is retained to respect an opt-out.

AI.Law uses the following retention schedule. A shorter valid deletion instruction or legal deadline controls where applicable.

Information	Retention period
Subscriber Content and account records	While the organization remains open and directs storage. Full organization termination starts a limited 30-day export period; live content is deleted no later than day 30. Canceling only a paid plan may leave a free account open.
Requested content deletion	Removal from AI.Law-controlled live systems within 30 days after an authorized request is verified, including originals, extracted text, indexes, saved chats, and outputs within its scope. Requested content is promptly restricted from ordinary use while deletion completes. A request can shorten the export period; the earlier applicable deletion deadline controls.
Routine backups of deleted information	Expire within 30 days after live deletion and no later than day 60 after termination or the verified request, whichever deadline is earlier. Backups are restricted from ordinary use; deletion instructions are reapplied before restored data returns to service.
Identified product analytics and detailed usage events	Up to 12 months from collection. Necessary billing evidence is retained separately.
Raw diagnostic and security logs	Up to 90 days from collection, unless specific evidence is preserved for a documented incident or legal hold.
Support and AI Troy conversations	Up to 12 months after resolution or, without a resolved request, the last interaction.
Billing and tax records	Seven years after the transaction, limited to necessary accounting and transaction evidence.
Contract and assent records	The Subscriber relationship plus seven years, without retaining matter content for that purpose.
Ordinary marketing-prospect records	Up to 24 months after the last interaction; unsubscribing ends marketing use sooner. Minimal suppression records remain while needed to honor the choice.
AI provider records and stored resources	Provider-hosted files, indexes, and resources that AI.Law can directly delete follow the live-system deletion deadline. Provider-controlled safety records and other retention obligations follow the AI Provider Schedule; no universal provider-retention period applies.

Contract and assent records include necessary evidence of the subscription offer presented, express consent to automatic-renewal or continuous-service terms, required subscription notices, and cancellation. These records follow the customer-relationship-plus-seven-years period stated above. They are limited to information needed to establish the accepted terms and the handling of notices and cancellation. Matter files, chats, and other Customer Content are not retained for this purpose.

Subscriber Content within support, diagnostic, activity, or billing records follows its applicable content-deletion deadline. Only necessary records that do not retain that content follow a longer category period, subject to the specific retention exceptions below. Moving content to a different record does not extend its retention.

A documented legal obligation, dispute, or security incident may require limited information to be retained longer. AI.Law restricts that information from unrelated use, reviews the need, and deletes it when the reason ends. A hold is not a reason to keep an entire matter when narrower records suffice. Privacy-request records are retained for required recordkeeping periods. De-identified statistics may be retained longer only where they cannot reasonably identify an individual and are protected against re-identification; hashing alone does not establish that result.

Authorized users can use available download, export, and deletion tools or contact AI.Law. Exporting creates a copy and does not itself delete account information. The organization export supplies selected structured records and document metadata and extracted text; original files and some generated work use separate download or export tools. An export is not a complete or restorable backup merely because a file was generated.

The Terms describe assistance during the 30-day exit period. Where security restrictions prevent self-service access, AI.Law provides a secure authorized alternative when lawful. Deleting an individual login does not necessarily delete organization records. Export is not a prerequisite to valid deletion. Statutory access and portability rights remain independent of product-export coverage.

AI.Law uses reasonable administrative, technical, and organizational safeguards appropriate to the information, including access restrictions, confidentiality obligations, and protection of information in transit and storage. No system eliminates every security risk. AI.Law investigates incidents and provides notices required by law and its applicable agreements.

AI.Law is based in the United States. Information may be processed in the United States and other countries where disclosed providers or authorized support personnel operate. The provider schedule identifies material locations and any agreed restrictions. A storage location does not establish that every processing activity occurs there. Where international-transfer safeguards are legally required, AI.Law uses an applicable lawful transfer arrangement and makes information about it available on request. Use of the service alone is not consent to a restricted transfer.

Depending on applicable law, individuals may request access to personal information and information about its sources, purposes, recipients, and retention; a portable copy; correction; deletion; restriction; or an explanation of a refusal. They may withdraw consent, object to qualifying processing, and opt out of sale, sharing, targeted advertising, or qualifying profiling and automated decisions. Withdrawal does not invalidate earlier lawful processing. Rights and exceptions depend on the applicable law and processing role.

California residents may request categories and specific pieces of information, exercise sale/sharing opt-outs, and limit qualifying uses of sensitive information. AI.Law uses sensitive information only for requested services, authorized support, security, and legal obligations, not advertising. California direct-marketing disclosure inquiries may be submitted through the same contacts. AI.Law does not knowingly sell or share personal information of people under 16.

Requests may be sent to privacy@ai.law or support@ai.law, made by calling +1 614-279-9035, or sent to the postal address below. No account is required. AI.Law verifies identity and authority proportionately when needed for access, correction, or deletion; an authorized agent may act with appropriate authority. Verification information is used only for verification and security. AI.Law does not demand confidential client details merely to identify a request.

AI.Law responds within applicable legal deadlines, generally 45 days for covered US state requests and one month for EEA/UK requests. California's 45-day period runs from receipt, including verification time; other jurisdictions' verification rules apply. AI.Law gives notice of permitted extensions. Requests are ordinarily free, subject only to legally permitted exceptions. Refusals explain the reason and applicable appeal route. An appeal may be sent to the same contacts; individuals may also contact the relevant attorney general or data-protection authority. AI.Law does not unlawfully discriminate for exercising privacy rights.

The service is focused on the United States; geographic availability is governed by the Terms. Applicable privacy rights are not determined solely by citizenship or excluded by that contract.

Where GDPR or UK rules apply, AI.Law relies, as appropriate, on contractual necessity, legal obligations, consent, or legitimate interests in service administration, security, and permitted improvement, balanced against individual rights. Customer-directed processing follows the Customer's lawful instructions. Special-category and criminal-offence information requires the additional legal authority applicable to that information. Uploading information does not by itself establish another person's explicit consent. Individuals may object to legitimate-interest processing and complain to the relevant supervisory authority, including the UK Information Commissioner's Office.

Accounts are for adults at least 18 years old, or the older local age of majority. The service is not directed to children. Subscriber Content may lawfully concern minors; that differs from offering accounts to children. Suspected unauthorized child-account collection should be reported so AI.Law can investigate and take appropriate action.

AI.Law updates this Policy as practices change, identifies its effective date, and gives notice of material changes. Required consent is obtained separately. A policy update does not retroactively authorize inconsistent uses or override an existing privacy choice.

Privacy questions and requests: privacy@ai.law or support@ai.law.

Postal address: www.ai.law Corp., Attn: Privacy Team, 485 Metro Place South, Suite 300, Dublin, OH 43017, USA.