Privacy Policy

1. Information We Collect

We collect several types of information in connection with your use of the Service:

1.1 Account and Registration Information

When you create an account, we collect:

• Name
• Email address
• Phone number
• Law firm or organization name
• Bar number and jurisdiction
• Job title and role
• Billing and payment information (processed through third-party payment processors)

1.2 User Content and Case Documents

You and your firm upload documents and information to the Service, including but not limited to:

• Case complaints and pleadings
• Discovery requests and responses
• Client documents and evidence
• Attorney work product
• Notes, annotations, and comments
• Any other documents or information you choose to upload

We treat all User Content as highly confidential and subject to attorney-client privilege. We do not access, review, or use User Content except as necessary to provide the Service to you or as required by law.

1.3 Usage and Technical Information

We automatically collect certain technical information when you use the Service:

• IP address and device identifiers
• Browser type and version
• Operating system
• Access times and dates
• Pages viewed and features used
• Search queries and prompts entered into the Service
• Error logs and diagnostic information
• Cookies and similar tracking technologies (see Section 8)

1.4 Communications

We collect information when you communicate with us, including:

• Support requests and correspondence
• Feedback and survey responses
• Messages sent through the Service

2. How We Use Your Information

We use the information we collect for the following purposes:

2.1 To Provide and Operate the Service

• Creating and managing your account
• Processing your User Content through AI models to generate draft discovery responses
• Storing and organizing your documents and case materials
• Providing search, analysis, and document management functionality
• Authenticating users and enforcing account security

2.2 To Improve and Develop the Service

• Analyzing usage patterns to improve Service functionality
• Identifying and fixing technical issues
• Developing new features and capabilities
• Conducting research and development on AI-assisted legal technology

IMPORTANT: We do not use your User Content (case documents, client information, or attorney work product) to train or improve AI models. Your confidential case materials remain confidential and are used solely to provide services to you.

2.3 To Communicate with You

• Sending service announcements and updates
• Responding to your support requests
• Providing security alerts and notifications
• Notifying you of changes to our Terms of Service or Privacy Policy
• Sending billing statements and payment confirmations

2.4 To Ensure Security and Compliance

• Detecting and preventing fraud, abuse, or unauthorized access
• Enforcing our Terms of Service
• Complying with legal obligations and court orders
• Protecting our rights, property, and safety

3. How We Share Your Information

We implement strict limitations on information sharing to protect attorney-client privilege and maintain confidentiality.

3.1 Third-Party Service Providers

We share information with third-party service providers who perform services on our behalf:

AI Model Providers: We use Amazon Web Services (AWS) Bedrock to access third-party artificial intelligence services (including large language models from providers such as Anthropic) to process your User Content and generate AI-assisted draft responses. According to AWS Bedrock's data protection policies:

• Amazon Bedrock does not store or log your prompts and completions (User Content)
• Amazon Bedrock does not use your prompts and completions to train any AWS models and does not distribute them to third parties
• Underlying model providers (such as Anthropic) do not have access to your data processed through AWS Bedrock's secure Model Deployment Accounts
• Data in transit is encrypted and AWS maintains strict security controls consistent with industry standards

Cloud Infrastructure Providers: We use AWS cloud hosting services to store and process data. These providers are bound by confidentiality obligations and security standards.

Payment Processors: We use Stripe to handle billing and payment information. We do not store full credit card numbers on our systems.

3.2 Law Firm Administrators

If you are part of a law firm account, the firm administrator may access information about your account usage, including activity logs and billing information.

3.3 Cross-Firm Data Isolation

We maintain strict tenant isolation. We will never share your User Content with other law firms, including firms adverse to you in litigation. Our technical architecture prevents any cross-firm data access.

3.4 Legal Requirements

We may disclose information if required by law, including:

• In response to valid subpoenas, court orders, or other legal process
• To comply with regulatory requirements
• To protect our rights, property, or safety, or the rights, property, or safety of others
• In connection with the investigation of fraud, security breaches, or illegal activity

We will notify you of legal demands for your information unless prohibited by law or court order, and we will provide you an opportunity to challenge such demands where legally permissible.

3.5 Business Transfers

If Inquisita is involved in a merger, acquisition, asset sale, or bankruptcy, your information may be transferred as part of that transaction. We will notify you before your information becomes subject to a different privacy policy.

3.6 With Your Consent

We may share information with third parties when you explicitly consent to such sharing.

3.7 We Do Not Share, Sell, or Rent Information

We never sell, rent, or share your information for marketing purposes or with data brokers. We do not allow third parties to use your User Content for their own purposes.

4. Data Retention

4.1 User Content

We retain your User Content for as long as your account remains active. Upon termination of your account:

• You have thirty (30) days to download your User Content
• After thirty (30) days, we delete User Content from our production systems
• We may retain copies in backup systems for up to ninety (90) days for disaster recovery purposes, after which all copies are permanently deleted

4.2 Account Information

We retain account registration information for as long as your account is active, plus a reasonable period thereafter for business record-keeping, legal compliance, and dispute resolution purposes.

4.3 Usage and Technical Information

We retain usage logs and technical information for up to two (2) years for security monitoring, debugging, and Service improvement purposes.

4.4 Legal Holds

If we receive a litigation hold notice or preservation demand, we will preserve relevant information as required by law, even if it would otherwise be deleted under our normal retention schedule.

5. Data Security

We implement administrative, technical, and physical safeguards designed to protect your information:

5.1 Encryption

• Data in transit is encrypted using TLS 1.2 or higher
• Data at rest is encrypted using AES-256 encryption or equivalent
• Database encryption using AWS KMS with tenant isolation via IAM ABAC

5.2 Access Controls

• Attribute-Based Access Control (ABAC) for tenant isolation
• Role-based access controls for internal personnel
• Principle of least privilege for all system access

5.3 Network Security

• Firewall protection and intrusion detection systems
• Regular security audits and penetration testing
• Automated vulnerability scanning
• Network segmentation and isolation

5.4 Personnel Security

• Background checks for employees with access to systems
• Confidentiality agreements for all personnel
• Security awareness training
• Immediate revocation of access upon employee termination

5.5 Compliance Framework

We are designing our security architecture with HIPAA and SOC 2 compliance standards in mind, though we do not yet certify compliance with these frameworks. We continuously assess our security posture against industry best practices.

5.6 Limitations

No method of transmission over the Internet or electronic storage is 100% secure. While we use commercially reasonable efforts to protect your information, we cannot guarantee absolute security. You acknowledge this inherent risk when using the Service.

6. Your Rights and Choices

Depending on your jurisdiction, you may have certain rights regarding your personal information:

6.1 Access and Correction

You may access and update your account information at any time through your account settings. You may also contact us to request access to other personal information we hold about you.

6.2 Data Portability

You may download your User Content at any time through the Service interface. We will provide your data in a commonly used, machine-readable format.

6.3 Deletion

You may delete your account at any time, which will trigger our data deletion procedures described in Section 4. You may also request deletion of specific information by contacting us at privacy@inquisita.ai.

6.4 Opt-Out of Communications

You may opt out of promotional communications by following the unsubscribe instructions in those messages. You cannot opt out of transactional or service-related communications (account notifications, security alerts, etc.).

6.5 Cookie Management

You can manage cookie preferences through your browser settings (see Section 8).

6.6 State-Specific Rights

For California Residents (CCPA/CPRA):

• Right to know what personal information we collect, use, and disclose
• Right to request deletion of personal information
• Right to opt out of "sales" of personal information (we do not sell personal information)
• Right to non-discrimination for exercising privacy rights
• Right to correct inaccurate personal information

For Colorado, Virginia, Connecticut, and Other Applicable States: You may have similar rights to access, correct, delete, and obtain copies of your personal information, as well as rights to opt out of certain processing activities.

To exercise these rights, contact us at privacy@inquisita.ai. We will respond within the timeframes required by applicable law.

7. International Data Transfers

Our Service is operated in the United States. If you access the Service from outside the United States, your information will be transferred to, stored, and processed in the United States. U.S. data protection laws may differ from those in your jurisdiction.

8. Cookies and Tracking Technologies

8.1 What We Use

We use cookies, web beacons, and similar technologies to:

• Authenticate your login session
• Remember your preferences and settings
• Analyze Service usage and performance
• Detect and prevent fraud

8.2 Types of Cookies

Essential Cookies: Required for the Service to function (authentication, security, load balancing). These cannot be disabled.

Analytics Cookies: Help us understand how users interact with the Service. We use these to improve functionality and user experience.

8.3 Your Choices

You can configure your browser to refuse all cookies or indicate when a cookie is being sent. However, if you disable essential cookies, you may not be able to use the Service.

8.4 Do Not Track

Some browsers transmit "Do Not Track" signals. We do not currently respond to Do Not Track signals because there is no industry standard for how to interpret them.

9. Children's Privacy

The Service is not directed to individuals under the age of 18. We do not knowingly collect personal information from minors. If you believe we have collected information from a minor, contact us immediately at privacy@inquisita.ai, and we will delete such information.

10. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by:

• Posting the updated Privacy Policy on this page with a new "Last Updated" date
• Sending you an email notification to the address associated with your account
• Displaying a prominent notice within the Service

Your continued use of the Service after the effective date of changes constitutes acceptance of the updated Privacy Policy. If you do not agree to the changes, you must stop using the Service and terminate your account.

11. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, contact us:

For data subject requests (access, deletion, correction), please use privacy@inquisita.ai and include:

• Your full name
• Email address associated with your account
• Law firm name
• Specific nature of your request
• Any information that will help us verify your identity

We will respond to verified requests within the timeframes required by applicable law.