Privacy Policy (United States)

Your data is yours, not ours, and keeping it private matters to us — all the more because legal matters are confidential. This policy explains what we collect and why, who can see it, how we use AI, and your rights. In short: we never sell your personal information, never give anyone direct access to your data, and never use your content to train AI models without your organization's explicit opt-in.

Where this policy applies. This policy covers Univalent Legal Platform, operated by Univalent Corporation ("we", "us"), as we provide it to customers located in the United States, and the data we host in the United States. Services provided in Japan, and data hosted in Japan, are covered by our Japanese Privacy Policy instead. This English text is the authoritative version of this policy.

Your organization decides what goes into its workspace and who can see it; we handle that content on its behalf. If you use the Services through an organization, it can also answer questions about how it uses your information.

1. What we collect and why

We collect only what we need to run the Services:

• Account information. Your name, email address, organization, role, language and profile picture, so you can sign in and work with others. Passwords are stored only as irreversible hashes.
• Your content. Consultations, messages, notes, documents and files you or your organization add, so the Services can store them and show them to the people permitted to see them.
• Connected services. If your organization connects Slack, LINE, Notion or email, the messages and profile details those services send us, so conversations reach the right consultation. Their credentials are stored encrypted.
• Security and usage logs. IP addresses, browser details, sign-ins and errors, to keep accounts secure, prevent abuse and fix problems.
• Correspondence. Emails you send us, so we can answer them and refer back later.

We use only the cookies and browser storage the Services need to work, such as keeping you signed in and remembering your theme. We do not use advertising cookies or third-party trackers.

2. How we use AI

Some features, such as the preconsultation assistant, send the text involved to an AI model to produce a response. We use AI providers only under zero data retention: they do not keep your text after responding and do not use it to train their models.

We do not use your content to train AI models. We will only do so if your organization explicitly opts in, after we tell it what would be used, how it would be protected and for what. It can withdraw at any time, and we will not start without its consent.

We may use aggregated or de-identified information about how the Services are used — for example which features are used and how quickly pages load — to operate and improve them. It never includes the content of your consultations, messages or documents, and we do not try to re-identify anyone from it.

3. When we share or access information

We never sell personal information or share it for cross-context behavioral advertising. We share it only:

• With the providers that run the Services, under contracts that limit them to doing so on our behalf: Fly.io (hosting and database), Tigris Data (file storage), Resend (email), and OpenRouter with the AI providers it routes to — DeepInfra, Fireworks AI and Together AI — under zero data retention.
• With services your organization connects, such as Slack, LINE or Notion, when it directs us to.
• Within your organization and with its legal professionals, according to the permissions your organization sets.
• When the law requires it. We disclose data to authorities only when legally compelled, and tell the affected organization first unless we are prohibited from doing so or it is an emergency.
• If our business changes hands. We will tell you before your information is transferred or becomes subject to a different privacy policy.

Our staff look at your content only when needed to help with a support request you make, fix a problem that stops the Services from working, investigate a security or abuse issue, or comply with the law.

4. Where your data is kept

The Services and their database are currently hosted in Tokyo, Japan, and some of the providers above process data in the United States. Wherever your information is processed, it is protected as this policy describes, and we require each provider by contract to protect it to the same standard.

5. How we protect your data

We use reasonable administrative, technical and physical safeguards: connections are encrypted with HTTPS, stored data and files are encrypted, credentials for connected services are encrypted, and every page, file and search checks your permissions. No system is perfectly secure; if a breach affects your information, we will notify your organization, you and the authorities as the law requires.

6. How long we keep it

We keep information as long as your organization's account is active and as needed for the purposes above. Consultations are kept as a record, and removed members' accounts are disabled with their past activity preserved for the organization. When an organization closes its account, we delete its content within 90 days, except where the law requires us to keep something longer.

7. Your rights

We give everyone the same rights wherever they live, including those under the California Consumer Privacy Act and other state privacy laws. You can ask us to:

• tell you what personal information we hold about you and how we use and share it, and give you a copy;
• correct or delete it;
• stop using it for any purpose you can object to;
• reconsider a decision about one of these requests.

Many of these you can do yourself in Settings. For content your organization controls, we may refer your request to it. We will verify your identity before acting, and will not treat you differently for exercising these rights. To make a request, email us at contact@univalent.cc from the address on your account. An authorized agent may make a request on your behalf with your written permission.

8. Children

The Services are not intended for anyone under 18, and we do not knowingly collect information from children.

9. Changes to this policy

We will update this policy as our practices or the law change, and announce material changes in the Services or by email before they take effect. We will not start using information we already hold in a new way, such as for AI training, without consent.

10. Operator and contact

Questions, requests or concerns about your information? Email us at contact@univalent.cc.

Adapted from the 37signals policies, available under the Creative Commons Attribution 4.0 license.