Privacy Policy
Effective date: October 15, 2026 Last updated: October 15, 2026
This Privacy Policy explains how LegiMatch, a sole proprietorship based in Coimbatore, Tamil Nadu, India ("LegiMatch", "we", "us") collects, uses, stores, and protects personal data when you use https://legimatch.com, our mobile apps, and related services (the "Service").
LegiMatch is run from India by an individual (sole proprietor). The Service is offered to legal professionals, mainly in the United States.
1. Summary
- We collect only what we need to run the Service.
- Your uploaded documents are never used to train AI models, and we never sell your data.
- Your data is stored on servers in the United States and encrypted in transit and at rest.
- You can delete your uploads and your account at any time.
2. Data We Collect
| Category | Examples | Source |
|---|---|---|
| Account data | Name, email address, firm name, password (stored hashed), bar number and state of admission, country of practice | You |
| Google / Microsoft sign-in data | If you choose "Continue with Google" or "Sign in with Microsoft": your account ID (for Microsoft, your organization's tenant ID and your object ID), name and email address. We never receive your Google or Microsoft password | Google / Microsoft |
| Two-factor data | If you turn on two-factor authentication: the authenticator secret (stored encrypted) and one-time recovery codes (stored only as hashes) | You |
| Security & device data | Signed-in devices (browser and operating system), IP address, the country you sign in from (from our hosting provider's network headers), sign-in history | Automatically |
| Free-trial check data | When you sign up: a random ID kept in your browser and a fingerprint of your device's settings (such as screen size, time zone and graphics), plus your email address, bar number and IP address. We keep these only as scrambled one-way codes, not as readable data, and use them only to stop the same person starting more than one free trial | Automatically / You |
| Uploaded content | Documents and text you submit for research, including any personal information they contain about your clients or other people | You |
| Research history | Your searches, results, saved cases, matters (client folders), notes, highlights, brief checks, alerts, exports | Created by your use |
| Research Librarian conversations | Messages you exchange with the in-app assistant or our support team, and any facts you choose to save to its memory | You |
| Team data | Your firm, role, the colleagues you invite (their email addresses), and which matters you share with them | You / your firm's owner |
| Integration data | If you connect Clio: access tokens (stored encrypted) and the Clio matter IDs you link | Clio |
| Billing & credit data | Plan, AI credit balance and history, top-up orders, billing country and ZIP/postcode, transaction records. Card details are handled by our payment provider; we do not see or store full card numbers. | You / Dodo Payments |
| Usage and device data | IP address, browser and device type, pages viewed, feature usage, error logs | Automatically |
| Communications | Support requests and feedback | You |
| Sales enquiries | The email address you leave when you ask about the Firm plan, used only to reply to you | You |
We do not knowingly collect data from anyone under 18.
3. How We Use Data
We use personal data to:
- (a) provide the Service, including extracting facts from your uploads, finding similar decisions, generating explanations, checking the citations in briefs you upload, answering your questions in the Research Librarian, running your alerts, and sharing matters with the colleagues you choose;
- (b) create and manage your account, and verify professional eligibility;
- (c) process payments and manage subscriptions;
- (d) provide support and send service messages, such as receipts, security alerts, and changes to terms;
- (e) keep the Service secure, prevent fraud and abuse (including account sharing, through device limits and sign-in country checks, and repeat free trials), and fix errors;
- (f) improve the Service using aggregated or de-identified usage statistics, never the contents of your uploads; and
- (g) send product updates and marketing emails. You can unsubscribe from these at any time.
We do not use your uploaded content or research history to train AI models, ours or any third party's.
4. Legal Basis
Where the law requires a legal basis, we rely on:
- the performance of our contract with you;
- your consent (for example, for marketing emails);
- our legitimate interests in operating and securing the Service; and
- compliance with legal obligations.
For Indian law purposes, we process personal data in line with the Digital Personal Data Protection Act, 2023 and the Information Technology Act, 2000 and its rules.
5. Who We Share Data With (Subprocessors)
We share data only with service providers who help us run the Service and who are bound by contracts to protect it:
| Subprocessor | Purpose | Location |
|---|---|---|
| Oracle Cloud Infrastructure | Hosting, database, file storage | United States |
| Cloudflare | Domain name service, network security, secure connection to our servers (traffic passes through Cloudflare) and website visit statistics (Cloudflare Web Analytics, which uses no cookies) | Global network; United States company |
| Anthropic (Claude API) | AI processing of uploads and generation of explanations | United States |
| Dodo Payments | Payment processing, merchant of record, tax handling | India / United States |
| Our email delivery provider | Transactional and support email (e.g. password-reset codes) | European Union / United States |
| Optional "Continue with Google" sign-in | United States | |
| Microsoft | Optional "Sign in with Microsoft" | United States |
| Clio (Themis Solutions Inc.) | Only if you connect it: receiving the documents you choose to send to your Clio matters | United States / Canada (per your Clio region) |
| CourtListener / Free Law Project | Source of public court opinions (no customer data is sent) | United States |
Anthropic's commercial API terms say that API inputs and outputs are not used to train its models by default.
We may also disclose data:
- (a) if required by law, court order, or a valid government request;
- (b) to protect the rights, safety, or property of LegiMatch, our users, or others; or
- (c) to a buyer or successor in a merger, acquisition, or sale of assets, subject to this Policy.
We do not sell or rent personal data, and we do not share it for cross-context behavioral advertising.
6. Where Data Is Stored and International Transfers
Your account data and uploaded content are stored on servers in the United States. Our team is in India and may access data only as needed for support, maintenance, and security, under strict access controls. By using the Service, you understand that your data may be processed in the United States and India.
7. Security
We use reasonable technical and organizational measures, including:
- encryption in transit (TLS) and at rest;
- automatic redaction of common personal identifiers (emails, phone numbers, SSNs, card numbers, street addresses) from uploads, which you can turn off;
- optional automatic deletion of research after a period you choose;
- separation of each customer's uploaded content;
- role-based access, with multi-factor authentication for staff;
- logging and monitoring of administrative access; and
- regular backups.
No system is completely secure. If a breach affects your personal data, we will notify you and the relevant authorities as the law requires.
8. Retention
| Data | How long we keep it |
|---|---|
| Uploaded content and research history | Until you delete it or close your account. Then it is removed from active systems within 30 days and from backups within 90 days. |
| Account data | While your account is active, plus up to 90 days after closure |
| Billing and tax records | As long as tax and accounting laws require (usually up to 8 years) |
| Security and server logs | Up to 12 months |
| Free-trial check codes (scrambled, see section 2) | Up to 3 years, also after an account is closed, so a closed account can't restart its free trial |
9. Your Rights and Choices
Depending on where you live (including under certain US state privacy laws and Indian law), you may have the right to:
- access the personal data we hold about you;
- correct inaccurate data;
- delete your data;
- receive a copy of your data in a portable format;
- withdraw consent or opt out of marketing; and
- appeal or complain about our response.
You can delete uploads and your account directly in the app. For other requests, email [email protected]. We will respond within 30 days and may need to verify your identity. We will not discriminate against you for using these rights.
Information about your clients: if your uploads contain personal data about your clients or other people, you control that data, and we process it on your behalf. Please send their requests to you as their attorney. We will help you respond to them.
10. Cookies
We use only essential cookies, for login and security. At sign-up, our page also keeps a random ID in your browser's local storage to prevent repeat free trials (see section 2). We do not use analytics or advertising cookies. To count website visits we use Cloudflare Web Analytics, which does not set cookies, does not use local storage and does not track you across websites. You can control cookies through your browser settings. Blocking essential cookies may stop the Service from working.
10A. People Named in Court Decisions
Our case library contains published court decisions, which are public records. They may name parties, witnesses, and other people. We show these decisions as the courts published them, for legal research only, and we do not build profiles of the people named in them. If you are named in a decision and believe it should not appear (for example, it was later sealed or expunged, or it reveals sensitive information such as a minor's identity), write to [email protected] with the case citation. We will review the request and, where appropriate, remove or redact the decision.
11. Changes to This Policy
We may update this Policy. We will tell you about material changes by email or in the app before they take effect.
12. Contact and Grievance Officer
LegiMatch Coimbatore, Tamil Nadu, India Privacy questions: [email protected]
Grievance Officer (under the Information Technology Act, 2000 and the DPDP Act, 2023): Grievance Officer, LegiMatch Email: [email protected] We will acknowledge complaints within 24–48 hours and aim to resolve them within 30 days.