Privacy Policy

2.1 Information Provided Directly by Users

The Company collects personal information that you voluntarily provide when registering for, accessing, or using the Service, including without limitation:

• Account Registration Information: Email address, full legal name, username, password (encrypted using industry-standard cryptographic algorithms), and security authentication credentials;
• Profile Information: Jurisdiction, state of residence, user preferences, account settings, and notification preferences;
• Legal Case Information: Case titles, case descriptions, case numbers, court jurisdictions, case types, case status information, litigation parties, party roles, party contact information, and any other case-related data or metadata;
• Document Content and Metadata: Legal documents, court filings, pleadings, motions, correspondence, evidence, images, photographs, and any other files or content uploaded to or transmitted through the Service, together with associated metadata including file names, file types, file sizes, upload timestamps, and modification histories;
• Extracted Text and Document Analysis Data: Textual content extracted from uploaded documents through optical character recognition (OCR) or parsing technologies;
• User-Generated Content: Notes, annotations, comments, descriptions, deadlines, calendar entries, task lists, and any other textual or multimedia content created or uploaded by users;
• Communications with the Company: Content of emails, support tickets, feedback submissions, or other communications sent to the Company;
• Consent Records: Records of consent provided or withdrawn for specific data processing activities, including artificial intelligence analysis;
• Payment Information: If and when payment features are implemented, billing addresses, payment card information (processed through third-party payment processors), and transaction history.

2.2 Information Collected Automatically

The Company automatically collects certain information when you access or use the Service through the use of cookies, web beacons, log files, and similar tracking technologies:

• Device Information: Device type, device identifiers, hardware model, operating system type and version, browser type and version, screen resolution, and device settings;
• Network and Connection Information: Internet Protocol (IP) address, Internet Service Provider (ISP), geolocation data (city and state level, derived from IP address), and network connection type;
• Usage and Activity Data: Pages viewed, features accessed, actions performed, buttons clicked, time spent on pages, navigation paths, session duration, frequency of use, and patterns of interaction with the Service;
• Log Data: Access times, error logs, crash reports, performance metrics, server logs, and diagnostic information;
• Referral Information: Referring websites, search terms used to locate the Service, and marketing campaign identifiers;
• Authentication and Security Data: Login timestamps, authentication attempts, session identifiers, and security event logs.

2.3 Information from Third-Party Sources

The Company may receive information about you from third-party sources, including:

• Authentication Providers: If you authenticate through third-party services (e.g., Google OAuth), we may receive basic profile information such as name, email address, and profile picture;
• Analytics Providers: Aggregated usage statistics and analytics data from third-party analytics services;
• Legal Compliance Sources: Information necessary to comply with legal obligations, such as information from courts, law enforcement, or regulatory agencies.

2.4 Sensitive Personal Information

Health information. Legal matters frequently contain health information: medical records in a personal injury claim, psychological evaluations in a custody matter, treatment history in a disability or employment case. Where the documents you upload contain health information, it is governed by our Consumer Health Data Privacy Policy, a separate document that describes what we collect, who processes it, and the specific rights you have over it under Washington's My Health My Data Act and Nevada's SB 370.

3.1 Primary Purposes

We use collected information to:

Provide and Maintain the Service:

• Create and manage user accounts;
• Authenticate users and ensure security;
• Provide case management functionality;
• Store and organize documents;
• Process AI feature requests (when enabled);
• Generate AI-assisted content;
• Track deadlines and send reminders.

Improve and Develop the Service:

• Analyze usage patterns and trends;
• Develop new features and functionality;
• Optimize performance and user experience;
• Conduct research and development;
• Perform testing and quality assurance.

Communicate with Users:

• Send service-related notifications;
• Provide customer support;
• Respond to inquiries and requests;
• Send administrative messages;
• Provide updates about the Service.

Ensure Safety and Security:

• Detect and prevent fraud;
• Monitor for security threats;
• Investigate suspicious activity;
• Enforce our Terms of Service;
• Protect against malicious activity.

Legal and Compliance:

• Comply with legal obligations;
• Respond to legal process;
• Establish, exercise, or defend legal claims;
• Enforce our agreements;
• Protect rights and safety.

3.2 Marketing and Promotional Uses

With your consent, we may use your information to:

• Send promotional emails about new features;
• Inform you about service updates;
• Provide educational content about legal processes;
• Offer special promotions or discounts.

You may opt out of promotional communications at any time.

3.3 AI Training and Improvement

5.1 Service Providers

We share information with third-party service providers that help us operate the Service:

Infrastructure Providers:

• Google (Firebase, Cloud Storage, Cloud Run): Authentication, database, file storage, and converting exhibit files to PDF;
• Vercel: Application hosting and content delivery, so your requests transit their network;
• Supabase: Stores the numeric embeddings used for semantic search across your documents;
• Voyage AI: Converts document text into those embeddings.

AI Services:

Speech Recognition:

Court Filing and Service of Process:

Payments and Communications:

• Stripe: Payment processing. Card details are handled by Stripe on Stripe's own checkout pages and never reach our servers;
• Resend: Sends transactional email such as notifications and account messages.

Analytics and Monitoring:

• PostHog: Product analytics and session replay. Replays are configured to hide all on-screen text and all form inputs, and we do not record console output or network request bodies, so document contents are never captured;
• Sentry: Application error and crash reporting;
• Vercel Web Analytics: Aggregate page traffic, without cookies and without a persistent per-visitor identifier.

These four receive account and diagnostic information only, never the contents of your documents.

All service providers are contractually required to protect the confidentiality and security of Personal Information, use it only as necessary to provide services, and comply with applicable privacy laws. The complete, current list is maintained at prosei.ai/security and in Annex II of our Data Processing Agreement.

5.2 Legal Disclosure

We may disclose information when required by law or in good faith belief that disclosure is necessary to:

• Comply with legal obligations;
• Respond to subpoenas, court orders, or legal process;
• Enforce our agreements and policies;
• Protect our rights, property, or safety;
• Protect the rights, property, or safety of others;
• Investigate fraud or security threats.

5.3 Business Transfers

In the event of a merger, acquisition, reorganization, sale of assets, or bankruptcy, information may be transferred as part of the transaction. We will notify you of any change in ownership or control of Personal Information.

6.1 Permissions We Request

We request only the permissions required by the feature you choose to connect, and we request them at the moment you connect it:

• Gmail, read (gmail.readonly): permits us to read messages in your mailbox so that case-related correspondence can be displayed inside the Service and filed under the correct case;
• Gmail, send (gmail.send): permits us to send only those messages you compose and expressly submit for sending from within the Service. We do not send, forward, delete, or modify any message on your behalf;
• Google Calendar (calendar.events.owned): permits us to create, update, and delete calendar entries that the Service creates on a calendar you own, for the deadlines and hearings you track. We do not read your existing calendar entries;
• Google Drive (drive.file): permits us to access only the specific files you select through Google's file picker, and files the Service itself creates. We cannot see any other file in your Drive;
• Account identity (userinfo.email, userinfo.profile): your email address and basic profile information, used to identify the connected account and to support signing in with Google.

We do not request permission to read your existing calendar entries, to browse your Drive, or to modify or delete your email.

6.2 How We Use It

Gmail. When you connect a Gmail account, we periodically retrieve recent messages and store, for each one, the subject, sender, recipients, message body, timestamps, and the Gmail message identifier. We use this to display your correspondence inside the Service and to associate each message with the correct case by comparing its participants against the party email addresses recorded in that case. We do not retrieve attachments.

Google Calendar. We create, update, and remove calendar entries corresponding to deadlines and hearings you record in the Service. We do not read entries created by you or by any other application.

Google Drive. We retrieve the content of files you explicitly select in order to store and analyze them within your case, and we write documents you export from the Service.

We do not use Google user data for advertising, we do not sell it, and we do not use it to train any artificial intelligence or machine learning model.

6.3 Storage, Sharing, and Deletion

Google user data is stored in our Firebase infrastructure under access controls that restrict each record to the account that created it. OAuth access and refresh tokens are encrypted at rest using AES-256-GCM and are never transmitted to your browser.

Email content is not sent to our artificial intelligence provider. The AI features described in Section 5.1 operate on documents, prompts, and case details that you provide; messages synchronized from a connected Gmail account are not included in that processing.

Documents you import from Google Drive are treated as ordinary case documents once imported, which means that if you then use an AI feature on such a document, its text is processed as described in Section 5.1.

You may disconnect a Google account at any time from Settings, which removes our stored tokens and ends further access. You may separately revoke our access from your Google Account permissions page. Deleting your Prosei AI account deletes synchronized email, calendar records, and imported documents as described in Section 18.

6.4 Limited Use Commitment

Prosei AI's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements.

Specifically, we affirm that we:

• limit our use of Google user data to providing and improving the user-facing features described in this Section;
• do not transfer Google user data to third parties except as necessary to provide those features, to comply with applicable law, or in connection with a merger or acquisition as described in Section 5.3;
• do not use Google user data for serving advertisements of any kind;
• do not allow any person to read Google user data, except where you give explicit permission, where it is necessary for security purposes such as investigating abuse, to comply with applicable law, or where the data has been aggregated and anonymized;
• do not use Google user data to develop, improve, or train generalized artificial intelligence or machine learning models.