LegAI Assistant, Inc. ("Company") is a Delaware, U.S., corporation that operates the Kurzly mobile app and web service. This Privacy Policy explains how we collect, use, store, and protect personal information. We comply with U.S. federal and state privacy laws (including, where applicable, California, Virginia, Colorado, and other state laws). Where you are located in the EU/EEA, the UK, Korea, or another jurisdiction, we also comply with applicable local law (e.g., GDPR, Korean PIPA) to the extent it applies.
1. Information We Collect
- Account data such as email, name, organization details, profile information, authentication tokens, and contact preferences.
- Workspace data including cases, evidence, timelines, summaries, analyses, chats, plans, and related metadata; and, where community features are offered and you use them, community data such as posts, comments, and report records.
- Usage data such as device identifiers, IP address, browser/OS information, timestamps, feature usage, logs, and cookies. This may include an anonymous device identifier used to count landing/marketing page visits (cookie or local storage).
- Plan and usage metering such as subscription tier and monthly AI usage allowance and consumption (for fair use and billing).
- Billing data such as invoicing contact details and payment method references (full card numbers are not stored by us).
2. How We Use Information
- To operate authentication, case/evidence management, AI analysis, chat, export, and collaboration; and, where community features are offered, posts, comments, reporting, and moderation.
- To improve performance, reliability, and security, including abuse prevention.
- To provide customer support and service notices.
- To comply with legal obligations and protect rights and safety.
3. AI Processing and Model Policy
- To provide AI features, relevant input data may be processed by model providers (Google Vertex AI, OpenAI).
- Audio and video evidence you upload is sent to and processed by OpenAI’s speech recognition service (Whisper) to produce a text transcript. Optical character recognition on images and scanned documents uses Google Document AI.
- When AI retrieves reference material, minimal request data (such as search queries) may be sent to external legal and web search providers to fetch public sources only. Your case documents are not transmitted, although a query the AI composes may contain case-related terms such as names or dates.
- The external providers we use, by jurisdiction: Korea — National Law Information Center Open API. United States — CourtListener (case law) and Congress.gov (federal bills and statutes). European Union — EUR-Lex. Germany — Gesetze im Internet and EUR-Lex. United Kingdom — legislation.gov.uk. Japan — e-Gov statute API. All jurisdictions — Google Programmable Search. Retrieved results are used only to produce your answer; we do not accumulate or redistribute them.
- We apply policy controls so customer case data is not used to train or fine-tune public models.
- Processing is limited to service delivery purposes and subject to provider data protection terms.
3A. Google Workspace and Gmail Data
- If you choose Import from Gmail, Kurzly requests the Google gmail.readonly scope only when you connect Gmail through a separate OAuth consent flow.
- Gmail data is used only to search and rank candidate messages related to your case and to import messages you explicitly select as case evidence. Kurzly does not continuously sync your mailbox or import emails in the background.
- Imported email content (.eml) and message/thread metadata are stored as evidence for the selected case and follow the same retention and deletion controls as other evidence.
- Gmail refresh tokens are encrypted and stored server-side. You can disconnect Gmail in the import dialog; Kurzly deletes the stored token and requests revocation at Google.
- Google Workspace API data, including Gmail data, is not used to develop, improve, or train generalized AI or ML models.
4. Retention
- Personal data is retained only as long as necessary for the stated purposes and legal obligations.
- After account closure, workspace data is deleted or anonymized unless legal retention applies. Cases created in incognito mode are deleted automatically after they expire. Where you have used community features, posts and comments may be removed on request or under policy; report and moderation records may be retained for safety and compliance for a limited period.
5. Sharing and Processors
- We may engage cloud, authentication, payment, analytics, support, legal/web search, and abuse-prevention (App Check / reCAPTCHA Enterprise) processors as needed to provide the service.
- Hosting, our database, storage of uploaded files, and account authentication run on Google Cloud Platform and Firebase (Cloud Firestore, Cloud Storage, Cloud Run, Firebase Authentication, Firebase App Check). Account information and your case and evidence data are stored and processed on that infrastructure.
- Processors are bound by confidentiality and security obligations and may not use data for unrelated purposes.
- We may disclose information when legally required.
6. Data Location and Multi‑Jurisdiction
- We are a U.S. company. Data may be stored and processed in the United States and in other regions where we or our service providers operate (e.g., Korea).
- We comply with U.S. federal and state privacy laws, including where applicable the California Consumer Privacy Act (CCPA/CPRA), Virginia CDPA, Colorado CPA, and similar state laws. Where you are in the EU/EEA, the UK, Korea, or another jurisdiction, we comply with applicable local law (e.g., GDPR, Korean Personal Information Protection Act) to the extent it applies to our processing.
- Residents of California and other U.S. states with privacy laws, and of the EU/EEA, UK, or Korea, may have additional rights (access, deletion, portability, opt‑out of sale/sharing, correction). Submit requests to privacy@kurzly.net.
7. Your Rights
- Under U.S. and applicable state law you may request access, correction, deletion, and related rights. California and other state residents, and users in the EU/EEA, UK, or Korea, may have additional rights under local law (e.g., CCPA, GDPR).
- Requests can be submitted to privacy@kurzly.net or +1-978-878-7437. Identity verification may be required.
8. Security Measures
- We use encryption in transit and at rest, access controls, and security monitoring.
- Access to personal data is restricted on a need-to-know basis and auditable.
9. Children's Privacy
- The service is not intended for individuals under 18.
- If we discover child personal data, we will delete it promptly.
10. Policy Updates
- We may update this policy to reflect legal or service changes.
- Material changes will be announced before they take effect.
11. Contact
- Privacy Officer, LegAI Assistant, Inc.
- Email: privacy@kurzly.net
- Phone: +1-978-878-7437
- Address: 1111B South Governors Avenue, Dover, DE 19904, USA