LegAI Assistant, Inc. ("Company") is a Delaware, U.S., corporation that operates the Kurzly mobile app and web service. This Privacy Policy explains how we collect, use, store, and protect personal information. We comply with U.S. federal and state privacy laws (including, where applicable, California, Virginia, Colorado, and other state laws). Where you are located in the EU/EEA, the UK, Korea, or another jurisdiction, we also comply with applicable local law (e.g., GDPR, Korean PIPA) to the extent it applies.
1. Information We Collect
- Account data such as email, name, organization details, profile information, authentication tokens, and contact preferences.
- Workspace data including cases, evidence, timelines, summaries, analyses, chats, plans, and related metadata; and, where community features are offered and you use them, community data such as posts, comments, and report records.
- Usage data such as device identifiers, IP address, browser/OS information, timestamps, feature usage, logs, and cookies. This may include an anonymous device identifier used to count landing/marketing page visits (cookie or local storage).
- How you found us: when you create an account, the campaign tags on the link you first followed, whether it was an ad click (which kind of ad click id only, never its value), the domain of the site that linked to us (never the full address), the first page you opened and when, and whether you used the web or our app. It is recorded once on your account so we can tell which channels bring people. Before you accept cookies, it is not stored on your device.
- Plan and usage metering such as subscription tier and monthly AI usage allowance and consumption (for fair use and billing).
- Billing data such as invoicing contact details and payment method references (full card numbers are not stored by us).
2. How We Use Information
- To operate authentication, case/evidence management, AI analysis, chat, export, and collaboration; and, where community features are offered, posts, comments, reporting, and moderation.
- To improve performance, reliability, and security, including abuse prevention.
- To provide customer support and service notices.
- To comply with legal obligations and protect rights and safety.
3. AI Processing and Model Policy
- AI features, including summaries, timelines, analysis, legal research, and chat, run on Google’s Gemini models through Google Cloud Vertex AI. The input data each feature needs is sent to Vertex AI for processing.
- Evidence files you upload are read by the same Gemini models on Vertex AI. Gemini transcribes audio and video, and for video it also analyzes what appears on screen. Gemini reads images and scanned PDFs directly. We do not use a separate speech-recognition or optical character recognition (OCR) service.
- In chat, the AI can use tools built into Vertex AI: web search with Google Search, opening a web link you share, and running calculations as code. These tools run within Google Cloud. Under Google’s terms for its web search feature (Grounding with Google Search), Google keeps logs of search queries and related context for up to three days, not linked to you or to us, and uses them only to debug that feature.
- When AI retrieves reference material, minimal request data (such as search queries) may be sent to external legal and web search providers to fetch public sources only. Your case documents are not transmitted, although a query the AI composes may contain case-related terms such as names or dates.
- The external providers we use, by jurisdiction: Korea — National Law Information Center Open API. United States — CourtListener (case law) and Congress.gov (federal bills and statutes). European Union — EUR-Lex. Germany — Gesetze im Internet and EUR-Lex. United Kingdom — legislation.gov.uk. Japan — e-Gov statute API. All jurisdictions — Google web search (Grounding with Google Search on Vertex AI). Retrieved results are used only to produce your answer; we do not accumulate or redistribute them.
- We do not use your case data to train or fine-tune AI models. The Google Cloud terms that govern Vertex AI also prohibit Google from training its models on customer data.
- Processing is limited to service delivery purposes and subject to provider data protection terms.
3A. Google Workspace and Gmail Data
- If you choose Import from Gmail, Kurzly requests the Google gmail.readonly scope only when you connect Gmail through a separate OAuth consent flow.
- Gmail data is used only to search and rank candidate messages related to your case and to import messages you explicitly select as case evidence. Kurzly does not continuously sync your mailbox or import emails in the background.
- Imported email content (.eml) and message/thread metadata are stored as evidence for the selected case and follow the same retention and deletion controls as other evidence.
- Gmail refresh tokens are encrypted and stored server-side. You can disconnect Gmail in the import dialog; Kurzly deletes the stored token and requests revocation at Google.
- Google Workspace API data, including Gmail data, is not used to develop, improve, or train generalized AI or ML models.
4. Retention
- Personal data is retained only as long as necessary for the stated purposes and legal obligations.
- After account closure, workspace data is deleted or anonymized unless legal retention applies. Cases created in incognito mode are deleted automatically after they expire. Where you have used community features, posts and comments may be removed on request or under policy; report and moderation records may be retained for safety and compliance for a limited period.
- Deleting a case deletes the case and everything attached to it: its evidence records and files (including files collaborators uploaded), its analysis, notes and history, generated documents, integrity certificates, and any share links made from it. Deleting your account does the same for every case you own, and also deletes your profile, your files and your other records. What remains: your name, email and messages in cases you joined as a collaborator (they are part of that owner’s case), and billing records that Stripe, Apple and Google keep under their own policies.
- Backups: we keep backups of our database for up to 98 days, and deleted uploaded files stay recoverable for 7 days. Data you delete, including a deleted case or account, can therefore remain in backups for up to 98 days before it is permanently removed.
- Billing records (such as invoices, payments, and subscription history) are kept for as long as tax and accounting laws require, including after you close your account. Stripe and the app stores keep their own records under their own policies.
5. Sharing and Processors
- We may engage cloud, authentication, payment, analytics, support, legal/web search, and abuse-prevention (App Check / reCAPTCHA Enterprise) processors as needed to provide the service. The providers we use today are listed in section 5A.
- Hosting, our database, storage of uploaded files, and account authentication run on Google Cloud Platform and Firebase (Cloud Firestore, Cloud Storage, Cloud Run, Firebase Authentication, Firebase App Check). Account information and your case and evidence data are stored and processed on that infrastructure.
- Processors are bound by confidentiality and security obligations and may not use data for unrelated purposes.
- We may disclose information when legally required.
5A. Service Providers We Use
- Google Cloud and Firebase (Google LLC): hosting, sign-in, database, file storage, push notifications (Firebase Cloud Messaging), and abuse prevention (Firebase App Check with reCAPTCHA Enterprise).
- Google Vertex AI (Google LLC): AI processing of the case data each feature needs, as described in section 3. AI chat answers are written in Japan (Tokyo region; see section 6).
- Stripe, Inc.: payments for subscriptions bought on the web. You enter card details on Stripe’s checkout page; we never receive full card numbers.
- Apple (App Store) and Google (Google Play): payments and refunds for subscriptions bought in our mobile apps.
- RevenueCat, Inc.: keeps track of in-app subscription status. It receives your Kurzly account ID and your App Store or Google Play purchase records.
- PostHog, Inc. (United States): product analytics such as pages viewed and features used, linked to your account ID once you sign in (we do not send your email). On the website, only after you accept analytics cookies; in our iOS and Android apps it is on by default and can be turned off under Account → Cookie settings.
- Functional Software, Inc. (Sentry): error reports, such as the page, browser, and error message, used to find and fix bugs.
- Google Analytics for Firebase and Firebase Performance Monitoring (Google LLC): usage statistics and page-load measurements. On the website, only after you accept analytics cookies; in our iOS and Android apps they are on by default and can be turned off under Account → Cookie settings.
- Google Ads (Google LLC): conversion measurement, which tells us whether a sign-up came from one of our ads. Only on the website, and only after you accept analytics cookies; never in the mobile apps.
- Google Workspace (Google LLC): sends our service emails, such as invitations and notifications, and hosts our support and privacy mailboxes.
- Microsoft Corporation (Office Online viewer): when you preview a Word, Excel or PowerPoint evidence file, a private download link to that file is sent to Microsoft, which fetches the file to display it. Nothing is sent if you do not preview such a file.
- OpenTimestamps public calendar servers and FreeTSA (freetsa.org): when evidence is processed, a SHA-256 fingerprint (hash) of the file is sent to these timestamping services to prove when the file existed. They receive only the fingerprint, never the file or its contents.
- The legal and web search providers listed in section 3: they receive search queries only.
5B. Cookies and Local Storage
- Necessary (always on, because the service does not work without them): session (the sign-in cookie, up to 5 days, not readable by page scripts); Firebase Authentication’s sign-in state, kept in your browser’s local storage; legai-language and legai-language-user-set (your language, 1 year); legai-sidebar-collapsed (a layout preference, 1 year); kurzly_brief_share_unlock (remembers that you opened a password-protected shared brief); case:<case ID>:briefEdit (an unsaved edit of a lawyer brief, kept only on this device until you save or discard it, sign out, or delete the case; a copy older than 30 days is discarded); and the entries reCAPTCHA Enterprise stores so Firebase App Check can tell people from automated traffic.
- Your cookie choice: cookieConsentStatus and the time you chose (cookieConsentDecidedAt) are saved in local storage, not a cookie, so we remember your answer.
- Home-page headline test and visit count: on your first visit to our home page we set kurzly_hero, a cookie (about 1 year) that keeps showing you the same version of the headline we are testing. On the English home page we also save kurzly:heroVariant (the version shown) in local storage. These two hold only which of three headline versions you see, so they are set without waiting for the cookie banner, and they are not shared with third parties. The random ID we use to count unique visitors (kurzly:marketingDeviceId, sent only to our own server) is created only after you accept analytics, and Reject deletes it.
- Analytics and advertising (only after you accept): Google Analytics for Firebase sets the _ga and _ga_<ID> cookies (up to 2 years), used together with Firebase Performance Monitoring and Google Ads conversion measurement; PostHog stores a ph_<project>_posthog cookie and a local storage entry. On the website, none of these are loaded unless you accept. In our iOS and Android apps, analytics other than Google Ads is on by default.
- To change your choice or withdraw consent, use Cookie settings (at the bottom of our pages, in Account, or at the top of this page) and choose Reject. Analytics stops at once and the identifiers listed above are deleted. In the mobile apps, use Account → Cookie settings. You can also write to privacy@kurzly.net.
6. Data Location and Multi‑Jurisdiction
- We are a U.S. company. Data may be stored and processed in the United States and in other regions where we or our service providers operate (e.g., Korea and Japan).
- AI chat answers are written by Gemini in Google Cloud’s Tokyo region (asia-northeast1) in Japan, so your questions, the conversation, and the case material needed to answer them are processed there. So that the next question about the same case is answered faster, the case material may be held there temporarily, for about 10 minutes after it was last used. Supporting steps, such as classifying a question or suggesting follow-up questions, run on Google Vertex AI’s default route (e.g., the United States), and if the Tokyo region has not started answering after about 15 seconds or is busy, the same request may also be sent to the same Gemini model on that route. Either way it is processed by Google LLC, and the terms in section 3, including no training on your data, apply unchanged.
- We comply with U.S. federal and state privacy laws, including where applicable the California Consumer Privacy Act (CCPA/CPRA), Virginia CDPA, Colorado CPA, and similar state laws. Where you are in the EU/EEA, the UK, Korea, or another jurisdiction, we comply with applicable local law (e.g., GDPR, Korean Personal Information Protection Act) to the extent it applies to our processing.
- Residents of California and other U.S. states with privacy laws, and of the EU/EEA, UK, or Korea, may have additional rights (access, deletion, portability, opt‑out of sale/sharing, correction). Submit requests to privacy@kurzly.net.
7. Your Rights
- Under U.S. and applicable state law you may request access, correction, deletion, and related rights. California and other state residents, and users in the EU/EEA, UK, or Korea, may have additional rights under local law (e.g., CCPA, GDPR).
- Requests can be submitted to privacy@kurzly.net or +1-978-878-7437. Identity verification may be required.
8. Security Measures
- We use encryption in transit and at rest, access controls, and security monitoring.
- Access to personal data is restricted on a need-to-know basis and auditable.
9. Children's Privacy
- The service is not intended for individuals under 18.
- If we discover child personal data, we will delete it promptly.
10. Policy Updates
- We may update this policy to reflect legal or service changes.
- Material changes will be announced before they take effect.
11. Contact
- Privacy Officer, LegAI Assistant, Inc.
- Email: privacy@kurzly.net
- Phone: +1-978-878-7437
- Address: 1111B South Governors Avenue, Dover, DE 19904, USA