Privacy policy — Legalnaut A Markdown version of this page is available at https://legalnaut.com/policy.md for AI and LLM tools. Privacy policy ============== LAST UPDATED 2026-09-16 This policy covers the website legalnaut.com and the Legalnaut application. It explains what we collect, why, where it goes, how long we keep it and what you can ask of us. Where the GDPR applies, we are the processor of the case material you import and the controller of your account data; where Singapore's Personal Data Protection Act applies, the same split holds. 1. Who we are ------------- **A2Z WEB PTE. LTD.**, 7 Temasek Boulevard, #12-07 Suntec Tower One, Singapore 038987, registration 202614429R. Write to for anything in this policy. 2. Definitions -------------- **Workspace**: one case file inside Legalnaut, with its own storage and its own members. **Case material**: the documents you import, the text extracted from them and the analysis derived from that text. **Account data**: what identifies a person who signs in. **Sub-processor**: a company that processes data on our behalf to provide the service. 3. What we collect ------------------ **Account data.** Name, e-mail address, password hash, workspace membership and role, the language and appearance you chose, and whether you switched on two-factor authentication. **Case material.** Whatever you import. In litigation that routinely includes names, contact details, employment and financial details, correspondence and recordings, and may include special categories of data. We treat it as confidential material belonging to you. **Usage data.** Server logs with IP address, browser and the pages requested; error reports; and the audit log of consequential actions in a workspace (who filed, confirmed, exported or deleted what, and when). **Billing data.** Handled by Stripe. We receive the subscription status, the plan and the last four digits of the card; we never see or store a card number. We do not buy data about you and we do not track you across other sites. 4. Why we process it, and on what basis --------------------------------------- - **To provide the service** you or your firm subscribed to: contract. - **To process case material** on your behalf: your documented instructions, under the [data processing agreement](/dpa). - **To bill you** and keep the records the law requires: contract and legal obligation. - **To keep the service secure**, detect abuse and investigate incidents: our legitimate interest in running a service that lawyers can rely on. - **To write to you about your account** (an invoice, a deadline reminder you set, a workspace about to be erased): contract. We send no marketing to application users without consent. Case material is processed only to provide the service. It is never used to train models, ours or anyone else's, and it is never sold or shared for any other purpose. 5. Cookies ---------- The application sets a session cookie that keeps you signed in, a security token that protects forms from forgery, and two preferences: your theme and whether the sidebar is collapsed. They are first-party and expire with the session or when you change the preference. The public site sets no analytics cookie unless you consent to one; today none is in use. 6. Sub-processors ----------------- ProcessorPurposeLocationHetzner Online GmbHApplication hosting and case-file storageFalkenstein, Germany (EU); data centre certified to ISO/IEC 27001:2022Amazon Web ServicesTextract: OCR of scanned pages when local extraction fails; SES: outgoing e-mailFrankfurt (eu-central-1, EU)OpenAI; AnthropicDocument analysis, summaries, drafts and chat answersUnited States, under Standard Contractual Clauses; no training on customer contentStripeSubscription billingUnited States / EUZoho MailThe forwarding address that imports correspondenceEUWe give notice before adding a sub-processor that touches case material, and you may object. The [data handling and compliance](/data-handling-and-compliance) page says what each provider does with what it receives. 7. International transfers -------------------------- Case material is stored in the European Union. Analysis by a language model sends the text of a document, or the part of it needed for the task, to OpenAI or Anthropic in the United States. Those transfers are made under Standard Contractual Clauses and processing agreements that prohibit training on the content and limit its retention. Account and billing data may be processed by Stripe in the United States under the same clauses. On the Enterprise plan the application can run on your own servers, in the region you choose, and case material is then not transferred anywhere. 8. Retention ------------ Case material is kept for as long as your workspace exists. No schedule deletes the records of a paid workspace. If a subscription lapses, the workspace becomes read-only; clearing it is a deliberate action, and the erasure then waits through a grace period with a warning e-mail, in which one click keeps the file. The one exception is a trial that ended and was never used: it is scheduled for deletion after a documented number of days, with the same warning and grace period (the current figures are on the [security page](/security)). Account data is kept while the account exists and for 30 days after it is closed. Invoicing records are kept for five years under Singapore tax law. Server and application logs are kept for 14 days. The audit log of a workspace lives and dies with the workspace. 9. Your rights -------------- If the GDPR applies to you, you have the right to access, rectification, erasure, restriction, portability and objection, and the right to complain to a supervisory authority. Under the PDPA you have the rights of access and correction and may withdraw consent. For case material, address the request to the firm that runs the workspace, because it decides what is in the file; we assist it. For account data, write to us. We answer verified requests within 30 days, and you can export a whole workspace yourself at any time from its privacy settings. 10. Security ------------ TLS 1.2 or better in transit. Hashed passwords. Optional two-factor authentication. Each workspace kept apart from every other. Access to production restricted on the principle of least privilege. A2Z WEB PTE. LTD. is SOC 2 Type II certified; the data centre is certified to ISO/IEC 27001:2022. What the software does with evidence and with AI output is on the [security page](/security). No transmission over the internet is completely secure. If you believe an account has been compromised, write to us immediately. 11. Children ------------ Legalnaut is a professional tool. It is not offered to anyone under 18, and we do not knowingly collect account data from anyone under that age. Case material may contain data about minors; the firm that imports it is responsible for having the right to process it, and the application keeps such details to the minimum in what it generates. 12. Links to other sites ------------------------ The site links to third parties (a court, a regulator, a provider's documentation). Their policies apply there, not this one. 13. Changes ----------- Material changes are announced in the application, and to the owner of every workspace by e-mail, before they take effect. The date at the top is the date of the current version. 14. Contact ----------- , or by post to the address in section 1. SCREENSHOT ![]()