Privacy Policy

1. Data controller

The controller of the processing operations described in this policy is:

• LawyerTools, a simplified joint-stock company with a sole shareholder (société par actions simplifiée à associé unique) with share capital of EUR 100.00;
• Registered office: 53 boulevard de Strasbourg, 75010 Paris, France;
• Registered with the Paris Trade and Companies Register (RCS Paris) under number 101 122 869;
• Contact for any question relating to personal data: privacy@lawyertools.ai.

2. Scope of this policy

This policy covers the processing operations for which LawyerTools acts as data controller, namely the data of visitors to the showcase website and the identity and usage data of holders of an account on the application.

It does not apply to the documents and content that client law firms upload to the application. For such data, the client law firm is the data controller and LawyerTools acts solely in its capacity as data processor within the meaning of Article 28 of the GDPR, within the framework defined by the General Terms of Use and by a separate Data Processing Agreement concluded with the firm.

3. Data collected, purposes and legal bases

3.1 Website visitors

When a visitor uses the contact form, LawyerTools collects their name, email address and the content of their message.

• Purpose: to receive, process and respond to requests submitted via the contact form.
• Legal basis: LawyerTools' legitimate interest in responding to the requests addressed to it (Article 6(1)(f) of the GDPR) and, where applicable, the performance of pre-contractual measures taken at the request of the individual (Article 6(1)(b) of the GDPR).

The website also uses strictly functional browser local storage, intended to remember the visitor's display preference (light or dark theme).

• Purpose: to ensure the proper functioning and usability of the interface.
• Legal basis: LawyerTools' legitimate interest in providing a functional interface (Article 6(1)(f) of the GDPR). This storage is strictly necessary for the service and is exempt from consent.

3.2 Account holders

When an account is created and used, LawyerTools collects the holder's name, their professional email address, the name of their firm or organisation, as well as usage data relating to the service.

• Purposes: creation and management of the account, provision and administration of the service, authentication and security, support and improvement of the service.
• Legal basis: performance of the contract concluded with the holder or their firm and performance of pre-contractual measures (Article 6(1)(b) of the GDPR); LawyerTools' legitimate interest in ensuring the security and proper functioning of the service (Article 6(1)(f) of the GDPR).

Providing this data is necessary for the creation and use of the account and for the performance of the contract. Failing such provision, LawyerTools is unable to create the account, provide the service or ensure its proper functioning and security.

3.3 Optional WhatsApp communication channel

Where the account holder chooses to activate the optional communication channel based on WhatsApp, LawyerTools processes the associated telephone number as well as the content of the messages exchanged through this channel.

• Purpose: to enable the user to interact with the service and to receive responses via WhatsApp.
• Legal basis: the user's consent, evidenced by the voluntary activation of this optional channel (Article 6(1)(a) of the GDPR), and performance of the contract for the processing of the interactions thus initiated (Article 6(1)(b) of the GDPR). This consent may be withdrawn at any time by ceasing to use this channel, without such withdrawal affecting the lawfulness of processing carried out beforehand.

The routing of messages through this channel entails their transmission to Meta Platforms, established in the United States, and therefore a transfer of data outside the European Union governed under the conditions described in Articles 4 and 5. Users are advised not to transmit through this channel any information covered by professional secrecy the disclosure of which would be incompatible with such a transfer.

4. Recipients and processors

The data is intended for the authorised departments of LawyerTools. In order to perform its services, LawyerTools uses the providers listed below, acting as processors and offering appropriate safeguards within the meaning of Article 28 of the GDPR:

LawyerTools neither sells nor rents personal data to third parties for commercial purposes. Data may also be disclosed to administrative or judicial authorities where required by law.

The personal data processed by LawyerTools is not used to train artificial intelligence models. The content transmitted to the artificial intelligence providers mentioned above is not used by them to train or improve their models, as the publisher relies on offerings and configurations that exclude such use, in accordance with the contractual terms applicable to these providers' professional application programming interfaces (APIs).

5. Transfers of data outside the European Union

Some of the providers mentioned in Article 4 are established in, or process data in, the United States. Consequently, personal data — including, in the context of the service, confidential legal documents processed by the artificial intelligence providers — may be transferred outside the European Union.

These transfers are governed by appropriate safeguards within the meaning of Chapter V of the GDPR, namely the Standard Contractual Clauses adopted by the European Commission and/or, where applicable, the provider's adherence to the Data Privacy Framework. A copy of the applicable safeguards may be requested at privacy@lawyertools.ai.

6. Retention periods

• Contact form messages: retained for as long as necessary to process the request and, where applicable, to manage the resulting exchanges; in the absence of any contractual or pre-contractual relationship established as a result of the request, they are deleted or archived within a maximum period of three years from the last contact with the data subject, in accordance with the recommendations of the French Data Protection Authority (Commission nationale de l'informatique et des libertés, CNIL).
• Account data: retained for the entire duration of the relationship with the holder or their firm, then deleted or archived at the end of that relationship, subject to the retention periods imposed by applicable legal obligations. In the context of the beta version, test data may be reset (see the General Terms of Use).
• Messages exchanged via the WhatsApp channel: retained for as long as necessary for interaction with the service and for the traceability of requests, under the same conditions and periods as account data.
• Display preference (local storage): retained on the visitor's device until deleted by the visitor via their browser settings.

7. Security and data isolation

LawyerTools implements appropriate technical and organisational measures to protect data against any destruction, loss, alteration or unauthorised access. In particular, each client firm's data is physically isolated within a dedicated database per firm, ensuring that data is not pooled between client firms.

8. Cookies and tracking technologies

At the launch of the service, the website uses no tracking cookies and no audience-measurement or analytics tools. It relies solely on strictly functional local storage intended to remember the display theme preference (light or dark). This mechanism is not intended to track browsing and is exempt from the requirement to obtain consent pursuant to Article 82 of the French Data Protection Act ("loi Informatique et Libertés").

Accordingly, no consent banner is required. Should an audience-measurement or tracking tool be added at a later stage, this policy would be updated and the consent of the data subjects would be obtained whenever required by law.

9. No automated individual decision-making

The service relies on artificial intelligence technologies intended to assist legal professionals. LawyerTools does not carry out any decision-making based solely on automated processing, including profiling, which produces legal effects concerning individuals or similarly significantly affects them, within the meaning of Article 22 of the GDPR. The outputs produced by the service constitute decision-support, subject to the assessment and control of the professional user, who remains solely responsible for the decisions they make.

10. Your rights

In accordance with the applicable regulations, every data subject has, under the conditions and within the limits provided for by the GDPR, the following rights:

• the right of access to their data;
• the right to rectification of inaccurate or incomplete data;
• the right to erasure of their data;
• the right to restriction of processing;
• the right to data portability;
• the right to object to processing, in particular where it is based on legitimate interest;
• the right to withdraw consent at any time, where processing is based on consent, without such withdrawal affecting the lawfulness of processing carried out beforehand;
• the right to set guidelines for the fate of their data after their death (post-mortem directives).

These rights may be exercised by email sent to privacy@lawyertools.ai. LawyerTools may be required to request proof of identity in the event of reasonable doubt as to the identity of the applicant.

11. Complaint to the CNIL

Every data subject has the right to lodge a complaint with the French Data Protection Authority (Commission nationale de l'informatique et des libertés, CNIL) if they consider that the processing of their data constitutes a breach of the applicable regulations:

• CNIL — 3 Place de Fontenoy, TSA 80715, 75334 PARIS CEDEX 07;
• www.cnil.fr.

12. Amendments to the privacy policy

This policy may be amended in order to reflect changes to the service or to the applicable regulations. The version in force is the one published on the website on the date of consultation. The date of last update appears at the top of this document.