Privacy Policy

1. Overview

Lagelia (“Lagelia,” “we,” “us”) provides an AI-powered legal operating system exclusively to licensed attorneys and their law firms. This Privacy Policy explains how we collect, use, disclose, and safeguard information when you use our website and our platform (the “Service”).

Key commitments in plain English:

• We do not sell your data. Ever.
• Your matter documents, chats, and drafts are never sent to an outside AI model provider, so no third party can retain them or train on them.
• We preserve attorney-client privilege. Your matters are scoped to your firm.
• We store and process your data in the United States.
• You can export or delete your data at any time.

2. Who We Are

Lagelia is operated from the United States. For any privacy question or request, contact us at legal@lagelia.ai.

3. Information We Collect

3.1 Account information

Name, email address, firm name, state bar number (if provided), billing information, and authentication data.

3.2 Matter content

Documents, evidence, exhibits, chats, and drafts you upload or generate within a matter. This content is scoped to your firm and the users you authorize, and it is processed only on infrastructure we operate.

3.3 Usage data

Product analytics (features used, performance metrics, error reports) to operate and improve the Service. We avoid collecting analytics that include matter content.

3.4 Device & log data

IP address, browser type, operating system, referring URLs, timestamps, and similar technical metadata.

4. How We Use Information

• To provide, maintain, and improve the Service.
• To process billing and subscription management.
• To communicate with you about your account, support, and service updates.
• To detect, investigate, and prevent security incidents and misuse.
• To comply with legal obligations.

5. How We Share Information

We share information only with the following categories of recipients, and only as necessary:

• Sub-processors (cloud infrastructure, authentication, payment processors) who process data on our behalf under contractual data-protection obligations. A current list of sub-processors is maintained in our Data Processing Agreement and provided upon request. No AI model provider is a sub-processor, because we do not send your content to any.
• Public legal data services and web search, at your direction. When you run web research or a public legal lookup, the search terms you provide (which may be derived from your matter) are sent to third-party public services, such as court-record and attorney-directory databases and a web search provider, to return results. These requests are made only when you initiate them.
• Your firm. Users within the same firm account may have access to shared matters and firm-wide settings based on role.
• Legal obligations. We may disclose information if required by law, court order, or to protect rights and safety.
• Business transfers. In the event of a merger, acquisition, or asset sale, data may transfer with appropriate notice.

We do not sell personal information.

6. Matter Content & Attorney-Client Privilege

We recognize that matter content may be subject to attorney-client privilege, work-product protection, and professional confidentiality obligations. We treat all matter content as privileged by default. We do not access matter content except as strictly necessary to operate the Service, comply with law, or at your authorized request (e.g., technical support).

7. AI Model Processing

The Service does not use large language models operated by third-party providers. Language model inference and embedding generation run on models we host on infrastructure we operate. Your prompts and matter content are never transmitted to OpenAI, Anthropic, Google, or any other model provider.

This is a structural guarantee rather than a contractual one. There is no outside provider in the chain, so there is no provider to retain your content, train on it, log it, or receive legal process for it. Prompts and matter content are used only to generate the output you asked for.

8. Data Retention

We retain account information for the life of your account and for a reasonable period thereafter to comply with legal and financial obligations. Matter content is retained for the life of your account and is deleted within 30 days of account termination, except where longer retention is required by law.

9. Your Rights

Subject to applicable law, you may:

• Access the personal information we hold about you.
• Correct inaccurate information.
• Request deletion of your personal information.
• Export your data in a portable format.
• Object to or restrict certain processing.

To exercise any right, email legal@lagelia.ai. We will respond within 30 days.

10. California Privacy Rights (CCPA/CPRA)

California residents have the rights above, plus the right to know the categories of personal information collected and shared, the right to correct, the right to delete, and the right to opt out of “sales” or “sharing” (we do not sell or share for cross-context behavioral advertising). We do not discriminate against users who exercise their rights.

11. International Users

Lagelia is designed for users in the United States. Data is stored and processed in the U.S. If you access the Service from outside the U.S., you consent to the transfer of your information to the U.S. for processing.

12. Security

Measures in place today include: all AI processing on infrastructure we operate, with no transmission of your content to any outside model provider; firm-scoped data access on matter and document records; role-based access control on administrative functions; parameterized database queries; path containment checks on file delivery; cryptographically random share and portal tokens with expiry and revocation; upload type restrictions and API rate limiting; and application logs and error monitoring configured to exclude document text and client identifiers.

Not yet in place, and stated here as commitments rather than facts: encryption of stored data at rest, multi-factor authentication, audit logging of record access, and independent penetration testing. Each is on our security roadmap ahead of general availability. SOC 2 Type II certification is on the same roadmap; no audit has commenced, and we will not claim the certification until it is issued. Section 5 of our Data Processing Agreement carries the same split. No system can guarantee absolute security; we continuously improve our controls.

13. Children

The Service is not directed to anyone under 18. We do not knowingly collect personal information from minors.

14. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated via email or in-app notice at least 30 days before they take effect for existing customers.

15. Contact Us

Privacy questions, requests, or concerns: legal@lagelia.ai