Privacy Policy

Last updated: July 30, 2026 · Effective: July 30, 2026

1. Information We Collect

Account & Profile Data. When you register, we collect your name, email address, bar number (where provided), phone number, and firm affiliation. Billing contacts provide payment information, which is processed exclusively by our PCI-compliant payment processor (Stripe). Legalitize never stores raw payment card numbers.

Matter & Document Data. Documents, notes, case files, AI-generated drafts, billing records, and other content you upload or create within Legalitize (“Customer Content”) are stored on your behalf as a data processor. This content may include protected health information (PHI) and personally identifiable information (PII) belonging to your clients. We do not access this content except as necessary to provide the Service, resolve support requests, or comply with legal obligations.

Usage & Telemetry Data. We automatically collect information about how you interact with the platform: pages visited, features used, session duration, IP address, browser type, operating system, and device identifiers. This data is used exclusively for service improvement, security monitoring, and troubleshooting — never for advertising.

Communications. If you contact our support, sales, or compliance teams, we retain records of those communications to resolve issues and improve our services. We do not record phone calls without your consent.

2. How We Use Your Information

• →Provide, maintain, secure, and improve the Legalitize platform and its features
• →Process transactions and manage your subscription, including invoicing and payment collection
• →Send transactional communications: account verification, password resets, security alerts, and service notices
• →Monitor for security threats, abuse, unauthorized access, and platform integrity issues
• →Generate anonymized, aggregated analytics to improve our AI models — no identifiable client data is used
• →Comply with legal obligations, including responding to lawful court orders and regulatory requests
• →Enforce our Terms of Service and other binding agreements with customers

We do not sell, rent, or trade your personal data or your clients' data to third parties for marketing or advertising purposes under any circumstances.

3. How We Share Information

Service Providers. We use service providers as needed to operate Legalitize, which may include hosting, storage, AI processing, transactional email, monitoring, and payment services. The providers actually enabled for an account may vary by feature and deployment. Contact privacy@legalitize.com for the current provider list before submitting confidential information.

Legal Requirements. We may disclose information when required by applicable law, regulation, valid court order, or lawful government request. Where legally permissible, we will notify you before disclosing and will seek to limit the scope of any required disclosure.

Business Transfers. In the event of a merger, acquisition, financing, or sale of all or substantially all of our assets, your data may be transferred to the successor entity, subject to equivalent privacy protections and prior notice to you.

With Your Consent. We will share your information with third parties when you have given us explicit consent to do so.

4. Data Security

Legalitize is in Alpha/MVP development. Current safeguards and production-readiness work include:

• →Encrypted HTTPS transport for public production services
• →Authenticated access controls intended to separate users, firms, matters, and documents
• →Server-side handling of provider credentials so API keys are not delivered to the Word add-in or browser
• →Dependency, authorization, logging, backup, and incident-response hardening before broader availability
• →Human review and confirmation before AI-assisted legal text is inserted or materially changed

Legalitize does not currently claim SOC 2, ISO 27001, or HIPAA certification. No method of electronic transmission or storage is completely secure. During Alpha/MVP development, do not upload privileged, regulated, or highly sensitive information unless you have received written confirmation that the applicable deployment and controls are suitable for that information.

5. Data Retention

Active Accounts. We retain account and customer content as needed to operate the account, provide requested features, protect the service, and meet applicable legal obligations.

Closure and deletion. During Alpha/MVP development, retention behavior may differ by data type and provider. You may request export or deletion at privacy@legalitize.com. We will explain any information that must be retained for security, dispute, or legal reasons.

6. Your Rights

Applicable privacy rights. Depending on where you live and how you use the service, privacy law may provide rights to access, correct, delete, restrict, object to, or receive a portable copy of personal information. We will evaluate verified requests under the law that applies to the request.

To exercise any of these rights, contact privacy@legalitize.com. We will respond within 30 days (or the applicable statutory deadline). We may need to verify your identity before processing a request.

7. Cookies

We use strictly necessary cookies for session management and security, and optional analytics cookies to understand platform usage patterns. You can manage your cookie preferences from our Cookie Policy page or via your browser settings. We do not use advertising or tracking cookies.

8. Children's Privacy

Legalitize is a professional platform intended exclusively for licensed attorneys and law firm staff. We do not knowingly collect personal information from individuals under 18. If you believe a minor has provided information to us, contact us immediately at privacy@legalitize.com and we will promptly delete the information.

9. International Data Transfers

Legalitize is operated from the United States. Information may be processed in the United States or other locations where an enabled service provider operates. Organizations requiring contractual international-transfer terms should contact us before enabling the relevant processing. Our current data-processing information is available at /dpa.

10. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes via email and prominent in-platform notice at least 30 days before changes take effect. Continued use of the platform after the effective date of updated terms constitutes your acceptance. You may always request the previous version of this policy by contacting us.

11. Contact

For privacy inquiries or data subject requests:

Shuda Enterprises LLC / Legalitize, registered Pennsylvania DBA
521 Jansen Avenue
Essington, PA 19029, United States
(334) AI-LEGAL
privacy@legalitize.com