Privacy Policy — Legales.io

1. Who we are

Legales.io is a product of Aldebaran Labs LLC ("we," "us," "our"), an AI software company that provides a legal management platform for law firms, legal ops teams, and asset managers. Our registered contact is info@legales.io.

2. What data we collect

We collect only what's necessary to provide the Service:

Account data: name, email address, and password (or OAuth token if you sign in with Google).
Contract documents: files you upload for AI analysis — PDF, DOCX, or plain text.
Usage data: actions taken within the platform (uploads, queries, status changes), timestamped and linked to your user account.
Billing data: subscription plan and payment status. Card data is processed entirely by our payment processor and is never stored on our servers.
Communications: messages you send us by email.

We don't collect data from visitors who don't create an account.

3. How we use your data

To provide, operate, and improve the platform.
To process your contract documents through our AI engine and return the analysis results.
To send automated reminders, deadline alerts, and confirmation emails as you configure them.
To enforce your plan limits and billing.
To respond to your support requests.
To comply with legal obligations.

We do not sell your data. We do not use the content of your contracts for advertising purposes.

4. AI processing and the content of your contracts

The content of your contracts is processed by Anthropic's Claude API (SOC 2 Type II, ISO 27001, and ISO 42001 certified) solely to generate the analysis results you request. We use retrieval isolation — only the fragments relevant to each query are sent, never the full document. Anthropic does not use your data to train its models, and retains API data only briefly for safety and reliability purposes before automatically deleting it.

We are actively working toward qualifying for Anthropic's API Zero Data Retention tier, which would guarantee that no query content is retained by Anthropic beyond the API response. We're also evaluating routing processing through AWS Bedrock or Google Vertex AI — both platforms have independent data-handling commitments and don't share inputs or outputs with Anthropic — as an additional path to strengthen data handling for security-sensitive clients. We'll update this policy once either configuration is in place.

5. Data storage and security

Database: Supabase (PostgreSQL), hosted on AWS infrastructure. All data is encrypted at rest and in transit (TLS 1.2+).
File storage: contract documents are stored in Supabase Storage, with access strictly restricted to your organization's ID at the database level. No user from another organization can query or retrieve your documents.
Email delivery: automated emails are sent via SendGrid. Your email address is shared with SendGrid solely for message delivery.
Audit log: every AI query, document upload, and automated action is logged with date, time, and user identity.

We are working toward SOC 2 Type II certification. All current controls are operational and contractually enforceable today.

6. Data retention

We retain your account data and documents while your account is active. If you cancel your subscription, your data is retained for 30 days to allow export, then deleted from our production systems. Audit logs may be retained for up to 12 months for compliance purposes.

You can request deletion of your data at any time by writing to info@legales.io.

7. Sharing and disclosure

We share your data only with the following subprocessors, and only to the extent necessary to provide the Service:

Anthropic — AI analysis (query content only, not stored)
Supabase — database and file storage
SendGrid — transactional and automated email delivery
Payment processor — billing and subscription management (card data never reaches our servers)

We may disclose data if required by law, a court order, or to protect the rights and safety of our users.

8. Your rights

Depending on your jurisdiction, you may have the right to:

Access the personal data we hold about you.
Request correction of inaccurate data.
Request deletion of your data (right to be forgotten).
Object to or restrict certain processing.
Data portability — receive your data in a machine-readable format.
Withdraw your consent at any time where processing is based on it.

To exercise any of these rights, write to us at info@legales.io. We'll respond within 30 days.

9. Cookies

We use only strictly necessary cookies — specifically the session token required to keep you logged in. We don't use tracking cookies, advertising pixels, or third-party analytics scripts.

10. Children's privacy

Legales.io is a professional platform intended for business use. We don't knowingly collect data from individuals under 16. If you believe a minor has provided us with personal data, contact us and we'll remove it immediately.

11. Changes to this policy

We may update this policy as our technology or legal obligations change. Material changes will be communicated by email to active subscribers at least 14 days in advance. The effective date at the top of this page will always reflect the current version.

12. Contact

Questions about this policy or your data? Write to us at info@legales.io.

Enterprise customers requiring a Data Processing Agreement (DPA) should contact us — we'll provide one within 5 business days.