Back to home
Trust & Security

Privacy Policy

Last updated: June 5, 2026. This policy outlines how we protect and govern your legal documents, drafts, and account information.

Zero AI Training: We never use your drafts, contracts, or chat history to train AI models.
Row-Level Isolation: All workspace assets are protected by PostgreSQL RLS in Supabase.
Data Portability: Export your templates, metadata, and generated drafts in DOCX/Markdown anytime.

1. Introduction & Scope

LegalAI Workspace ("we", "us", or "our") values the trust you place in us when sharing your contracts, drafts, templates, and company information. This Privacy Policy explains how we collect, process, store, and safeguard your data when you visit our website, register an account, and use the LegalAI software workspace platform (the "Services").

By accessing or using the Services, you acknowledge that you have read and understood this Privacy Policy.

2. Information We Collect

To provide our document generation, review, and AI assistant capabilities, we collect the following categories of information:

  • Account Credentials: Name, email address, password, and profile metadata (including avatar images you upload).
  • Workspace & Contract Inputs: Form variables, text snippets, and document contents entered into templates to compile drafts.
  • Counter-party Documents: Text contents or files uploaded to the Reviewer panel for risk analysis reports.
  • AI Assistant Conversations: Text prompts, legal questions, and chat history processed by the AI panel.
  • Transactional Data: Payment tokens and billing history managed securely by Stripe. We do not store raw card numbers.
  • Telemetry and Logs: IP address, device properties, request parameters, and action histories stored in our usage logs.

3. How We Process Data and AI Integrity

Our Core Services rely on Large Language Models (LLMs) to construct and audit agreements. Our processing principles are strictly governed:

  • No Foundation Model Training: We have contractually opted-out of having your content used by our LLM providers (including Google Gemini and Groq) to train their foundational models. Your uploads remain entirely yours.
  • API Data Isolation: Data sent to LLM endpoints is processed statelessly. It is not stored by the model providers and is deleted immediately post-generation.
  • Anonymized Requests: We strip account-level user identifiers (such as emails or user IDs) from prompt payloads before they are routed to third-party AI APIs.

4. Storage, Security & Supabase Integration

We host our infrastructure using premium cloud providers and managed databases.

All accounts, profiles, documents, chat histories, and usage logs are stored in a secure Postgres database powered by Supabase. We utilize strictRow-Level Security (RLS) policies. Every SQL query checked at the database level guarantees that only the authenticated user matching the database record owner can retrieve, modify, or delete that data.

Uploaded documents for the reviewer are stored in isolated directories inside Supabase Storage, guarded by identical RLS policies. Data is encrypted in transit using TLS 1.3 and at rest using AES-256 standard encryption.

5. Sharing & Disclosures

We do not sell, rent, or trade your document contents or personal information. We only share data with essential subprocessors required to host and execute the Services:

  • Supabase (Database, Auth, and Storage infrastructure)
  • Stripe (Subscription management and billing)
  • Google AI Studio & Groq API (Stateless LLM processing)

6. Data Retention, Portability & Deletion

You maintain complete ownership of your data. You may download all compiled contracts in Markdown, PDF, or DOCX formats at any time.

If you delete documents or conversations in your Settings or Workspace, they are immediately flagged and deleted from our database tables. If you choose to reset your workspace data, all documents, messages, and reports are permanently deleted from our servers. To fully delete your account and credentials, contact our support team at legalai@zyphro.site.

7. GDPR, CCPA and International Rights

Depending on your location, you may have specific rights regarding your personal data under the General Data Protection Regulation (GDPR) or the California Consumer Privacy Act (CCPA). These include:

  • The right to access, rectify, or request deletion of your account.
  • The right to restrict or object to the processing of your metadata.
  • The right to data portability.

8. Changes to this Policy

We may update this Privacy Policy from time to time. We will notify you of any material changes by posting the new policy on this page and updating the "Last Updated" date.

9. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy, please contact our team at:

LegalAI Workspace Security Team
Email: legalai@zyphro.site