Privacy Policy

2.1 Information Provided Directly by Users

The Company collects personal information that you voluntarily provide when registering for, accessing, or using the Service, including without limitation:

• Account Registration Information: Email address, full legal name, username, password (encrypted using industry-standard cryptographic algorithms), and security authentication credentials;
• Profile Information: Jurisdiction, state of residence, user preferences, account settings, and notification preferences;
• Legal Case Information: Case titles, case descriptions, case numbers, court jurisdictions, case types, case status information, litigation parties, party roles, party contact information, and any other case-related data or metadata;
• Document Content and Metadata: Legal documents, court filings, pleadings, motions, correspondence, evidence, images, photographs, and any other files or content uploaded to or transmitted through the Service, together with associated metadata including file names, file types, file sizes, upload timestamps, and modification histories;
• Extracted Text and Document Analysis Data: Textual content extracted from uploaded documents through optical character recognition (OCR) or parsing technologies;
• User-Generated Content: Notes, annotations, comments, descriptions, deadlines, calendar entries, task lists, and any other textual or multimedia content created or uploaded by users;
• Communications with the Company: Content of emails, support tickets, feedback submissions, or other communications sent to the Company;
• Consent Records: Records of consent provided or withdrawn for specific data processing activities, including artificial intelligence analysis;
• Payment Information: Payments are processed by Stripe. At checkout, Stripe collects your card or other payment method details, the name and full billing address for the payment, your email address and a phone number. Card numbers are entered on Stripe's own pages and never reach our servers. We keep your Stripe customer and subscription identifiers, your plan, billing cycle and subscription status, and a record of each purchase, refund and credit transaction. The written copy of each purchase that we email to you shows the billing name, the billing address and the card brand and last four digits, which we read from Stripe to send it. When you confirm a change of plan, we record the wording you agreed to, with the time, your IP address and your browser.

2.2 Information Collected Automatically

The Company automatically collects certain information when you access or use the Service through the use of cookies, web beacons, log files, and similar tracking technologies:

• Device Information: Device type, device identifiers, hardware model, operating system type and version, browser type and version, screen resolution, and device settings;
• Network and Connection Information: Internet Protocol (IP) address, Internet Service Provider (ISP), geolocation data (city and state level, derived from IP address), and network connection type;
• Usage and Activity Data: Pages viewed, features accessed, actions performed, buttons clicked, time spent on pages, navigation paths, session duration, frequency of use, and patterns of interaction with the Service;
• Log Data: Access times, error logs, crash reports, performance metrics, server logs, and diagnostic information;
• Referral Information: Referring websites, search terms used to locate the Service, and marketing campaign identifiers;
• Authentication and Security Data: Login timestamps, authentication attempts, session identifiers, and security event logs.

2.3 Information from Third-Party Sources

The Company may receive information about you from third-party sources, including:

• Authentication Providers: If you authenticate through third-party services (e.g., Google OAuth), we may receive basic profile information such as name, email address, and profile picture;
• Analytics Providers: Aggregated usage statistics and analytics data from third-party analytics services;
• Legal Compliance Sources: Information necessary to comply with legal obligations, such as information from courts, law enforcement, or regulatory agencies.

2.4 Sensitive Personal Information

Health information. Legal matters frequently contain health information: medical records in a personal injury claim, psychological evaluations in a custody matter, treatment history in a disability or employment case. Where the documents you upload contain health information, it is governed by our Consumer Health Data Privacy Policy, a separate document that describes what we collect, who processes it, and the specific rights you have over it under Washington's My Health My Data Act and Nevada's SB 370.

3.1 Primary Purposes

We use collected information to:

Provide and Maintain the Service:

• Create and manage user accounts;
• Authenticate users and ensure security;
• Provide case management functionality;
• Store and organize documents;
• Process AI feature requests (when enabled);
• Generate AI-assisted content;
• Track deadlines and send reminders.

Improve and Develop the Service:

• Analyze usage patterns and trends;
• Develop new features and functionality;
• Optimize performance and user experience;
• Conduct research and development;
• Perform testing and quality assurance.

Communicate with Users:

• Send service-related notifications;
• Provide customer support;
• Respond to inquiries and requests;
• Send administrative messages;
• Provide updates about the Service.

Ensure Safety and Security:

• Detect and prevent fraud;
• Monitor for security threats;
• Investigate suspicious activity;
• Enforce our Terms of Service;
• Protect against malicious activity.

Legal and Compliance:

• Comply with legal obligations;
• Respond to legal process;
• Establish, exercise, or defend legal claims;
• Enforce our agreements;
• Protect rights and safety.

3.2 Marketing and Promotional Uses

With your consent, we may use your information to:

• Send promotional emails about new features;
• Inform you about service updates;
• Provide educational content about legal processes;
• Offer special promotions or discounts.

You may opt out of promotional communications at any time.

3.3 AI Training and Improvement

5.1 Service Providers

We share information with third-party service providers that help us operate the Service:

Infrastructure Providers:

• Google (Firebase, Cloud Storage, Cloud Run): Authentication, database, file storage, and converting exhibit files to PDF;
• Vercel: Application hosting and content delivery, so your requests transit their network;
• Supabase: Stores the numeric embeddings used for semantic search across your documents and case notes, with the text each one indexes;
• Voyage AI: Converts the text of your documents and case notes into those embeddings.

AI Services:

Legal Research Sources:

When the AI chat searches for law or checks a citation to answer you, it sends what it searches for (for example a case name, a citation, or a few words describing a legal issue) to the legal research services it searches. These include CourtListener, run by the Free Law Project; the U.S. government's GovInfo, Congress.gov, eCFR, and Federal Register services; official court and government websites; and legal research services for other countries, such as NZLII. Some of its searches, including its web searches, run through Anthropic. What it searches for can include details of your case, including details it read from your email (Section 6.2). Each of these services' own privacy policy governs what it does with a search.

Speech Recognition:

Court Filing and Service of Process:

Payments and Communications:

• Stripe: Payment processing. Card details are handled by Stripe on Stripe's own checkout pages and never reach our servers;
• Resend: Sends transactional email such as notifications and account messages.

Analytics and Monitoring:

• PostHog: Product analytics and session replay. Replays are configured to hide all on-screen text and all form inputs, and we do not record console output or network request bodies, so document contents are never captured;
• Sentry: Application error and crash reporting;
• Vercel Web Analytics: Aggregate page traffic, without cookies and without a persistent per-visitor identifier.

These four receive account and diagnostic information only, never the contents of your documents.

All service providers are contractually required to protect the confidentiality and security of Personal Information, use it only as necessary to provide services, and comply with applicable privacy laws. The complete, current list is maintained at prosei.ai/security and in Annex II of our Data Processing Agreement.

5.2 Legal Disclosure

We may disclose information when required by law or in good faith belief that disclosure is necessary to:

• Comply with legal obligations;
• Respond to subpoenas, court orders, or legal process;
• Enforce our agreements and policies;
• Protect our rights, property, or safety;
• Protect the rights, property, or safety of others;
• Investigate fraud or security threats.

5.3 Business Transfers

In the event of a merger, acquisition, reorganization, sale of assets, or bankruptcy, information may be transferred as part of the transaction. We will notify you of any change in ownership or control of Personal Information.

6.1 Permissions We Request

We request only the permissions required by the feature you choose to connect, and we request them at the moment you connect it:

• Gmail, read (gmail.readonly): permits us to read messages in your mailbox so that case-related correspondence can be displayed inside the Service and filed under the correct case, and so that the AI chat, once you have allowed it to, can search your mailbox and read messages in it when you use it (Section 6.2);
• Gmail, send (gmail.send): permits us to send only those messages you expressly submit for sending from within the Service, whether you wrote the message yourself or reviewed a draft the AI chat prepared and pressed Send. The AI chat cannot send email from your account. We do not otherwise send, forward, delete, or modify any message on your behalf;
• Google Calendar (calendar.events.owned): permits us to create, update, and delete calendar entries that the Service creates on a calendar you own, for the deadlines and hearings you track. We do not read your existing calendar entries;
• Google Drive (drive.file): permits us to access only the specific files you select through Google's file picker, and files the Service itself creates. We cannot see any other file in your Drive;
• Account identity (userinfo.email, userinfo.profile): your email address and basic profile information, used to identify the connected account and to support signing in with Google.

We do not request permission to read your existing calendar entries, to browse your Drive, or to modify or delete your email.

6.2 How We Use It

Gmail. When you connect a Gmail account, we periodically retrieve recent messages and store, for each one, the subject, sender, recipients, message body, timestamps, the names, types, and sizes of any attachments, the Gmail identifiers of the message and of its conversation, and the message headers that link a reply to the message it answers. We use this to display your correspondence inside the Service and to associate each message with the correct case by comparing its participants against the party email addresses recorded in that case. We do not retrieve the attachments themselves.

Gmail and the AI chat. When you use the AI chat in a case, it can list the email threads filed under that case, search your whole connected Gmail mailbox, and read any conversation in it, not only mail filed under a case, to answer your questions or to write an email you ask for. It is told to search and read your email when you ask about your email or ask it to write one, but the chat decides when doing so helps it answer you, so it may search or read your email for a question that is not only about email. It reaches your mailbox only while it is answering you in a conversation. What it finds and reads (for a search, the subject, the people, the date, and a short excerpt of each conversation it finds; for a conversation it reads, the subject, sender, recipients, dates, and text of its messages, and the file names of any attachments, but not the attachments themselves) is sent to our artificial intelligence provider, Anthropic (Section 5.1), to answer you.

Your permission first. The AI chat reads none of your email, in your mailbox or filed under a case, until you allow it. Before it first reads your email, it asks for your permission on a card in the conversation, which links to this Policy, and it reads nothing until you press Allow there. You can instead turn it on in Settings, Email, which shows the same notice. If you choose Not now, it reads nothing, and it asks again the next time it would read your email. Your permission lasts until you turn it off, which you can do at any time in Settings, Email. From then on the chat reads none of your email, and does not ask, until you turn it on again there. Turning it off does not remove what the chat has already read and carried into your conversations, documents, deadlines, and case notes; that stays and is used as described below. We keep a record of when and where you allowed it or turned it off, and of the version of this Policy and the wording of the permission notice you were shown when you allowed it.

Where what the chat reads can go next. What the chat reads becomes part of that conversation. Details from your email (for example a date or an amount) can then be carried into the chat's answers, any draft it writes, the documents it creates or edits in the case (such as a motion or a court form), the deadlines it adds to the case's calendar, the notes and case facts it saves for the case, and the summaries made of the conversation, one when a long conversation is condensed and one when you start a new conversation in the case. All of these are saved with the conversation or the case, can be sent to Anthropic again as context on later requests in that case, and are otherwise kept and used like the rest of your AI chat conversations, case documents, deadlines, and case notes. A deadline the chat adds is also copied to your Google Calendar if you have connected one and its automatic syncing of deadlines is on, as described under Google Calendar below. In particular, case notes are reorganized, and can be analyzed, by automated processes that run in the background and send them to Anthropic, and they are indexed for search: their text is sent to Voyage AI, and the text and its search index are stored with Supabase (Section 5.1). When the chat searches legal sources or the web to answer you, what it searches for can include details it read from your email, as it can include any other information about your case, and it goes to the services Section 5.1 names under Legal Research Sources.

Our staff and support do not see it. Our staff, including our support team, and the automated tool that drafts our support replies do not see the email the AI chat reads, or anything the chat carries out of it. Once the chat has read your email in a case, nothing in that case's AI chat conversations from that point on, your own messages included, is shown to our staff or given to that tool, and neither are the notes and case facts the chat saves in that case from then on, the summaries of its conversations, or the drafts, documents, and deadlines it writes there. Writing to our support team is not permission for anyone to see any of it, and this stays so if you later turn off the chat's access to your email. Section 6.4 lists the only cases in which a person may read Google user data.

Drafts from the AI chat. The AI chat can write a draft email and show it to you on a card in the conversation. Nothing is sent unless you review the draft, change it if you wish, and press Send yourself. The AI chat cannot send email from your account. When you press Send on a draft for a connected Gmail account, the message is sent under the gmail.send permission described in Section 6.1.

Google Calendar. We create, update, and remove calendar entries corresponding to deadlines and hearings you record in the Service. We do not read entries created by you or by any other application.

Google Drive. We retrieve the content of files you explicitly select in order to store and analyze them within your case, and we write documents you export from the Service.

We do not use Google user data for advertising, we do not sell it, and we do not use it to train any artificial intelligence or machine learning model.

6.3 Storage, Sharing, and Deletion

Google user data is stored in our Firebase infrastructure under access controls that restrict each record to the account that created it. OAuth access and refresh tokens are encrypted at rest using AES-256-GCM and are never transmitted to your browser.

Email content and artificial intelligence. The AI chat is the only part of the Service that reads messages from a connected Gmail account, whether synchronized or read from your mailbox when the chat searches or reads it, and gives them to an artificial intelligence model, as Section 6.2 describes: only once you have allowed it to, only while it answers you, and only through our artificial intelligence provider Anthropic (the chat's email tool is never offered to another provider's model). Details the chat carries from them into its answers, drafts, documents, deadlines, case notes and facts, conversation summaries, and searches are then processed as Section 6.2 describes, and those carried into case notes are also held in the search index it describes. None of it is shown to our staff or given to the automated tool that drafts our support replies (Section 6.2). We do not use any of it to train artificial intelligence or machine learning models, and Anthropic does not use it for model training (Section 5.1).

Documents you import from Google Drive are treated as ordinary case documents once imported, which means that if you then use an AI feature on such a document, its text is processed as described in Section 5.1.

You may disconnect a Google account at any time from Settings, which removes our stored tokens and ends further access. You may separately revoke our access from your Google Account permissions page. Deleting your Prosei AI account deletes synchronized email, calendar records, and imported documents as described in Section 18.

6.4 Limited Use Commitment

Prosei AI's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements.

Specifically, we affirm that we:

• limit our use of Google user data to providing and improving the user-facing features described in this Section;
• do not transfer Google user data to third parties except as necessary to provide those features (such as sending the email the AI chat reads to Anthropic, which it does only once you have allowed it to read your email, indexing case notes through Voyage AI and Supabase, and the chat's searches of the legal research services named in Section 5.1, as described in Section 6.2), to comply with applicable law, or in connection with a merger or acquisition as described in Section 5.3;
• do not use Google user data for serving advertisements of any kind;
• do not allow any person to read Google user data, except where you give explicit permission, where it is necessary for security purposes such as investigating abuse, to comply with applicable law, or where the data has been aggregated and anonymized;
• do not use Google user data to develop, improve, or train generalized artificial intelligence or machine learning models.