Privacy Policy

We collect only the data we need to run the service, bill for it and keep it secure. The categories are the following.

• Account data: your name, work email address, password (stored only as a salted hash), role in the firm (owner, attorney, paralegal or staff), the firm name you enter and your seat assignment.
• Workspace content: documents, contracts, pleadings, discovery, scans, templates, playbooks, notes, intake answers, conflict records, matter names, deadlines, tasks and time descriptions that you or your colleagues upload or type, together with the outputs Jural produces from them (summaries, risk lists, redlines, drafts, research answers, chronologies, time entries).
• Usage data: which modules you open, how many pages are analysed, how many assistant questions, drafts and research questions are used in the billing period, export events and feature settings.
• Billing data: plan, number of seats, billing interval, invoices, payment status and the billing contact. Card details are entered directly with our payment processor; we receive only the card brand, the last four digits, the expiry month and the payment result, never the full card number.
• Technical logs: IP address, browser and device type, time of request, error reports and security events such as failed sign-ins, password resets and changes to roles or access walls.
• Messages you send to [email protected], including any attachments you choose to send.

We do not buy personal data from data brokers and we do not collect sensitive data on purpose. Any sensitive data that appears in workspace content is there because a firm uploaded it as part of a matter, and it is handled under section 4.

We use personal data for these purposes.

• To provide the service you signed up for: create the account, run each module, store the workspace, produce exports and keep usage meters. Where the GDPR or a similar law applies, the legal basis is performance of the contract with the customer and with you as an authorized user.
• To bill the subscription, issue invoices, handle renewals and payment retries and keep accounting records. Legal bases: performance of the contract and compliance with tax and accounting obligations.
• To keep the service secure: detect abuse, block suspicious sign-ins, investigate incidents and keep the activity log. Legal basis: our legitimate interest in protecting the service, our customers and their clients.
• To send service emails such as sign-in codes, security notices, billing receipts, renewal notices and important changes to the service or to these terms. These are part of the contract and are not marketing.
• To answer requests sent to [email protected]. Legal basis: performance of the contract or our legitimate interest in answering you.
• To improve the product using aggregated usage statistics (for example, how often a module is opened or how long a review takes). We do not read workspace content to improve the product and we do not use it to train AI models.
• To comply with law, respond to lawful requests from authorities and establish or defend legal claims.

We do not sell personal data and we do not share it for cross-context behavioral advertising.

For workspace content, the customer firm is the controller (or "business" under US state privacy laws) and Jural acts as a processor (or "service provider"). The firm decides which documents are uploaded, who on its team can see each matter, how long content is kept and when it is deleted. We process workspace content only to provide the service to that firm, under its instructions and the Terms of Service.

If you are a client, opposing party or witness and your information appears in a firm's matter, please contact that law firm directly. If you write to us, we forward your request to the firm and help the firm respond, but we do not decide on the request ourselves.

For account, billing, usage and technical data, Jural is the controller.

We share personal data only with service providers that help us run Jural, and only to the extent each one needs. We name categories of recipients rather than individual companies.

• Hosting provider: stores the application, database and files on servers we control the configuration of.
• Payment processor: handles card payments, subscription charges and invoices.
• Email delivery provider: sends sign-in codes, receipts and service notices.
• AI model providers: process the text of a request (for example, the pages of a contract under review or a research question) to return the model output to Jural. They act under terms that prohibit using customer data to train their models and that limit retention to what is needed to provide and secure the service.

Each provider is bound by a written agreement that requires confidentiality and appropriate security. We may also disclose data when the law requires it, to protect the rights and safety of users or others, or as part of a sale or reorganization of the service, in which case this policy continues to apply to the data transferred.

Jural serves law firms in the United States, and our providers may process data in the United States and other countries. When personal data from the European Economic Area, the United Kingdom or Switzerland is transferred to a country without an adequacy decision, we rely on standard contractual clauses or another transfer mechanism recognized by law, together with additional safeguards such as encryption. You can ask for information about the safeguards at [email protected].

• Workspace content stays for as long as the firm's subscription is active and the firm keeps it. Firms can delete documents and matters at any time. Enterprise customers can also set retention rules that delete content automatically after a period they choose.
• After a subscription ends, workspace content remains available for export for 30 days and is then deleted from active systems. Encrypted backups roll over and are fully removed within a further 35 days.
• Account data is kept while the account exists and for up to 12 months after closure, so that we can answer questions about access history and billing.
• Billing records and invoices are kept for as long as tax and accounting law requires, typically seven years.
• Technical logs are kept for up to 12 months, and security logs connected to an incident for as long as the investigation and any claim require.
• Support emails are kept for up to 24 months.

Deleting a document removes the document, but it does not return pages to the usage meter for the current billing period, because usage is counted as consumption.

We use technical and organizational measures suited to confidential legal work.

• Data is encrypted in transit with TLS and encrypted at rest on our storage and backups.
• Per-matter access walls let a firm decide exactly who can open each matter, and Jural enforces those walls in every module, including search and the knowledge base.
• Roles (owner, attorney, paralegal, staff) and, on Enterprise, custom roles and sign-in through SAML single sign-on.
• An activity log records sign-ins, uploads, exports, approvals, permission changes and deletions, and Enterprise customers can export it.
• Production access is limited to the few people who operate the service, protected by strong authentication and logged.

No system is perfectly secure. We do not claim any security certification or compliance badge. If we become aware of a breach that affects your personal data, we notify the affected customer without undue delay and provide the information the firm needs to meet its own duties.

Jural uses only strictly necessary cookies.

• A session cookie that keeps you signed in.
• A security token cookie that protects forms against cross-site request forgery.
• A preference cookie that remembers settings such as the interface layout.

We do not use advertising cookies, tracking pixels or third-party marketing cookies. Website statistics are collected without cookies and without identifying individual visitors. Because these cookies are needed for the site to work, we do not show a cookie banner. You can delete or block cookies in your browser, but signing in will then not work.

Depending on where you live, you may have the right to:

• know what personal data we hold about you and receive a copy in a portable format;
• correct inaccurate data;
• delete your data, subject to legal retention duties;
• object to or restrict certain processing, including processing based on legitimate interest;
• withdraw consent where processing is based on consent;
• opt out of the sale or sharing of personal data and of targeted advertising (we do neither);
• limit the use of sensitive personal data (we use it only to provide the service);
• appeal our decision on your request;
• not be discriminated against for exercising any of these rights.

Residents of California, Colorado, Connecticut, Virginia, Utah, Texas, Oregon and other US states with comprehensive privacy laws can exercise these rights by writing to [email protected]. If you are in the European Economic Area, the United Kingdom or Switzerland, you have the rights listed in the GDPR or the UK GDPR, and you may also lodge a complaint with your local data protection authority.

We verify requests by confirming control of the email address on the account. An authorized agent may submit a request with written permission from you. We respond within the time the applicable law sets, usually 30 or 45 days. For workspace content, we pass the request to the firm that controls it.

Jural is a professional tool for law firms and is not directed at children. We do not knowingly collect personal data from anyone under 16 as a user of the service. If you believe a child has created an account, write to [email protected] and we will close it. Information about minors may appear in workspace content uploaded by a firm, for example in a family law matter; that content is handled under section 4 and protected by the firm's access walls.

We may update this policy when the service or the law changes. The date at the top shows the latest version. If a change materially affects how we use personal data, we tell account owners by email at least 30 days before it takes effect. Earlier versions are available on request.

Questions, requests and complaints about privacy go to [email protected]. Please include the email address of your Jural account and a short description of your request. You can also read how we handle AI in AI Use and Limits and how payments work in the Refund Policy.