Data Processing Information
Last updated: July 30, 2026 · Alpha/MVP notice
📋 Need a signed DPA?
Organizations requiring a signed DPA or evaluating whether a BAA is available should contact legal@legalitize.com before using the applicable feature. Availability, terms, and timing require written confirmation.
1. Definitions
"Personal Data" means any information relating to an identified or identifiable natural person processed by Legalitize under this DPA.
"Controller" means the Customer who determines the purposes and means of processing personal data.
"Processor" means Shuda Enterprises LLC, operating through its registered Pennsylvania DBA Legalitize, when it processes personal data on documented instructions from a customer.
"Sub-processor" means any third party engaged by Legalitize to assist in processing personal data.
"Protected Health Information (PHI)" means individually identifiable health information as defined under HIPAA, 45 CFR § 160.103.
2. Processing Instructions
Legalitize will process personal data only on documented instructions from the Customer, including those set out in the Terms of Service and this DPA, and solely for the purpose of providing the Legalitize legal practice management platform.
Legalitize will immediately notify the Customer if, in its opinion, any instruction infringes applicable data protection law.
3. Details of Processing
Nature & Purpose
Storage, retrieval, analysis, and AI-assisted processing of legal documents, matter data, and client information for the purpose of providing legal practice management services.
Categories of Data Subjects
Law firm staff (attorneys, paralegals, administrators); clients of Customer law firms; opposing parties and witnesses referenced in legal matters.
Categories of Personal Data
Names, contact information, legal identification numbers, case facts, deposition transcripts, PHI (where applicable), financial records in matters, and other data contained in uploaded documents.
Retention
Retention varies by data type, enabled provider, account status, security needs, and applicable law. Customers may request an export or deletion. Any fixed retention schedule must be stated in a signed customer agreement.
4. Security Measures
Legalitize is in Alpha/MVP development. Current controls and production-readiness work include:
- Transport: HTTPS for public production services
- Access Control: Authenticated access and authorization controls intended to isolate firms, users, matters, and documents
- Credentials: Third-party provider keys are intended to remain server-side
- Development: Dependency, vulnerability, backup, monitoring, audit, and incident-response controls are being hardened before broader availability
- Certifications: No SOC 2, ISO 27001, or HIPAA certification is currently claimed
5. Sub-processors
Legalitize may use the following categories of providers depending on the features enabled for an account. This list is informational and must be confirmed for a particular deployment:
- Cloud hosting, content delivery, database, and private object-storage providers
- AI model and legal-research providers selected for the requested workflow
- Transactional email, monitoring, support, and payment providers
Request the current named provider list and applicable terms at privacy@legalitize.com before submitting confidential information.
6. Data Subject Rights
Legalitize will reasonably assist with verified access, correction, export, and deletion requests as required by applicable law and the written agreement governing the account. Requests may be sent to privacy@legalitize.com.
7. HIPAA Business Associate Agreement
Legalitize does not currently represent that every deployment is HIPAA compliant and does not authorize PHI processing by default. A covered entity or business associate must contact legal@legalitize.com, complete a control review, and receive an executed BAA before using Legalitize for PHI.
8. International Transfers
Organizations requiring Standard Contractual Clauses or another transfer mechanism must arrange those terms in a signed agreement before the relevant international processing begins.
9. Breach Notification
Legalitize will provide breach notices as required by applicable law and any signed customer agreement. Contract-specific deadlines apply only when accepted in writing.
10. Audit Rights
Available security and processing documentation may be requested at legal@legalitize.com. Legalitize does not currently claim that SOC 2 or ISO 27001 audit reports exist.
11. Term & Termination
A signed DPA, when applicable, is coterminous with the governing customer agreement. Export, return, retention, and deletion obligations are those stated in that signed agreement and applicable law.
Contact
Privacy and data-processing inquiries: privacy@legalitize.com
Request contractual terms: legal@legalitize.com