Privacy Policy

1. Introduction

Likan LLC, a Wyoming limited liability company that operates the TheLawGPT service ("Likan", "TheLawGPT", "we", "our" or "us"), is the data controller responsible for your personal information. This Privacy Policy explains how we collect, use, disclose, and protect your information when you use our website and services (collectively, the "Services"), which are powered by multiple third-party AI models, including models from Anthropic, OpenAI, and xAI. See our Trust & Security page for the full list of AI model providers.

This Privacy Policy explains how we handle your information. By using our Services, you acknowledge that you have read and understood this Privacy Policy. The legal bases on which we process your data are described in Section 3, and the rights and choices available to you are described in Section 8.

2. Information We Collect

We collect several types of information from and about users of our Services, including:

2.1 Personal Information

• Contact information (such as your name and email address)
• Account information, such as your username and a securely hashed password — we never store your password in plain text. If you sign in with Google, we receive basic profile information from Google instead of a password.
• Billing information, such as your billing address and subscription details. Your payment card details are processed directly by our payment processor, Dodo Payments, and are never stored on our servers.
• Details you choose to share when contacting us through our support channels

2.2 User Content

When you use our Services, we collect the content you submit, including:

• Legal questions and requests
• Documents uploaded for analysis
• Images uploaded for analysis
• Information about specific legal cases

We understand this content may include sensitive, privileged, or confidential information, including client documents and case details. We treat all User Content as strictly confidential. It is never sold, never used to train, fine-tune, or improve AI models, and never shared except as strictly necessary to deliver the Services to you. See Section 4.2 for our full commitments on how we handle your content.

2.3 Usage Data

We automatically collect certain information about how you interact with our Services, including:

• IP address and device information
• Browser type and operating system
• Pages visited and features used
• Time and date of your visits
• Referral website addresses
• Support metadata such as timestamps, page context, and technical data associated with support conversations

Analytics usage data (such as the pages you visit and features you use) is collected only where you have given consent through our cookie banner. Limited technical logs, such as your IP address, may be processed without analytics cookies for security and fraud-prevention purposes, as described in Section 3.2.

3. Purposes and Legal Bases for Processing

We process your personal data only when we have a valid reason to do so. The purposes and grounds we rely on are described below. For users in the United States, these describe the purposes for which we collect and use your information consistent with applicable state privacy laws. For users in the European Economic Area, the United Kingdom, and Switzerland, these same grounds constitute the "lawful bases" required under the General Data Protection Regulation (GDPR):

3.1 Performance of a Contract

We process your account information, billing details, and the content you submit (prompts, uploaded documents, legal questions) because it is necessary to provide the Services you have signed up for. Without this data, we cannot operate your account or deliver the AI-assisted legal research features.

3.2 Legitimate Interests

We process usage data and technical logs to maintain the security, reliability, and performance of our Services, to detect and prevent fraud or abuse, and to understand how users interact with the platform in aggregate. We have assessed that these interests are not overridden by your rights and freedoms.

3.3 Legal Obligation

We retain certain billing and transaction records to comply with applicable tax, accounting, and financial regulations. We may also disclose data when required by a valid court order or legal authority.

3.4 Consent

We process analytics and tracking data only where you have given your explicit consent via our cookie banner. You may withdraw your consent at any time by clearing your browser cookies and declining on your next visit.

4. How We Use Your Information

4.1 Account and Technical Data

We use account information, billing data, and technical logs to:

• Provide and maintain the Services
• Process transactions and send related information
• Respond to your comments, questions, and requests
• Send you technical notices, updates, security alerts, and administrative messages
• Monitor aggregate, anonymized usage metrics for performance and reliability purposes
• Improve the security and safety of our Services
• Protect our rights, our privacy, our safety, or our property
• Comply with applicable laws and legal obligations

4.2 Content Data — What We Never Do

Your content data — meaning your prompts, legal questions, uploaded documents, and AI outputs — is used solely to deliver the response you requested. We explicitly commit that your content is:

• Never used to train, fine-tune, or improve any AI model
• Never used for product improvement, QA, or benchmarking
• Never analyzed for analytics or profiling purposes
• Never subject to human review, except by authorized personnel in the event of a documented security incident or when required by law, and only to the minimum extent necessary
• Never shared with third parties except as strictly required to process your request (e.g., passing your query to one of our AI model providers)

For the full list of subprocessors who may access your data and under what conditions, see our Trust & Security page.

Confidentiality for legal professionals: We acknowledge that attorneys and law firms may submit content that is subject to attorney-client privilege or professional secrecy obligations. We treat all submitted content as confidential and our data handling commitments above are designed to be consistent with professional conduct rules applicable to legal professionals, including ABA Model Rule 1.6. However, attorneys remain solely responsible for assessing whether use of TheLawGPT is consistent with their applicable professional obligations before submitting privileged or confidential client information.

5. How We Share Your Information

We may share your information in the following circumstances:

5.1 Service Providers

We work with a small number of trusted service providers who process data strictly on our behalf and under our instructions — for example, cloud hosting, our payment processor (Dodo Payments), our AI model providers, and analytics. These providers may only access the limited information needed to perform their specific function, are bound by contractual confidentiality and data-protection obligations, and may not use your data for their own purposes. A full list of our subprocessors is available at thelawgpt.com/trust.

5.2 Legal Requirements

We may disclose your information if required by law or in response to valid requests from public authorities (e.g., court order, government request).

5.3 With Your Consent

We may share your information with third parties when you have given us your consent to do so.

6. Data Security

We implement technical and organizational security measures appropriate to the sensitivity of legal data. These include encryption in transit (TLS 1.3), encryption at rest (AES-256), multi-factor authentication for all internal access, role-based access controls, and a documented incident response procedure with 72-hour breach notification. Full details of our security controls are available at thelawgpt.com/trust.

No method of transmission over the Internet or electronic storage is 100% secure. While we apply industry-standard measures, we cannot guarantee absolute security and encourage users to avoid submitting data beyond what is necessary for their query.

7. Data Retention

We retain different categories of data for different periods, based on their purpose and our legal obligations:

• Account and contact data — retained while your account is active, plus 30 days after deletion to allow for recovery, then permanently deleted.
• Chat history, prompts, and uploaded documents — retained until you delete them, or automatically after 6 months of account inactivity.
• Billing and transaction records — retained for 7 years to comply with applicable tax and accounting regulations.
• Usage and analytics data — retained for 13 months, then aggregated or deleted.
• Support communications — retained for 2 years from the date of last contact.
• Backup copies — may persist for up to 30 days after deletion from active systems, after which they are purged through ordinary backup rotation.

You may request early deletion of your data at any time by emailing [email protected], subject to our legal retention obligations.

8. Your Privacy Rights

8.1 EEA, UK & Switzerland (GDPR)

If you are located in the European Economic Area, United Kingdom, or Switzerland, you have the following rights regarding your personal data:

• Access — request a copy of the personal data we hold about you
• Rectification — ask us to correct inaccurate or incomplete data
• Erasure — request deletion of your personal data
• Restriction — ask us to limit how we process your data
• Objection — object to processing based on legitimate interests
• Portability — receive your data in a structured, machine-readable format
• Withdraw consent — at any time, where processing is based on consent

You also have the right to lodge a complaint with your national data protection authority (e.g., the CNIL in France, the ICO in the UK, or the relevant authority in your country of residence) if you believe we have not handled your data lawfully.

8.2 United States (CCPA/CPRA & State Privacy Laws)

If you are a resident of California or another U.S. state with a comprehensive privacy law (including Virginia, Colorado, Connecticut, Texas, and others), you have the following rights:

• Right to know — what personal information we collect, use, and disclose
• Right to access — request a copy of the personal information we hold about you
• Right to delete — request deletion of your personal information
• Right to correct — request correction of inaccurate personal information
• Right to opt out — of any sale or sharing of personal information for cross-context behavioral advertising
• Right to non-discrimination — we will not discriminate against you for exercising your rights

We do not sell your personal information, and we do not share it for cross-context behavioral advertising. We have never sold the personal information of our users, including any information submitted by legal professionals. You may exercise your rights through an authorized agent acting on your behalf.

To exercise any of the rights above, email us at [email protected]. We will verify your request and respond within the timeframe required by applicable law (within 30 days under GDPR, and within 45 days under most U.S. state laws).

9. Children's Privacy

Our Services are not intended for children under 13 years of age. We do not knowingly collect personal information from children under 13. Users under 18 must have permission from their parent or guardian to use our Services. If you are a parent or guardian and you believe that your child has provided us with personal information, please contact us immediately.

10. International Data Transfers

TheLawGPT is based in the United States. If you are located in the European Economic Area or the United Kingdom, your personal data will be transferred to and processed in the United States. We rely on Standard Contractual Clauses (SCCs) approved by the European Commission as the legal mechanism for such transfers, where applicable through our subprocessor agreements. Our subprocessors and their data locations are listed at thelawgpt.com/trust.

If your organization is subject to specific data residency or regional processing requirements, please contact us at [email protected] to discuss the options we may be able to offer.

11. Changes to this Privacy Policy

We may update our Privacy Policy from time to time. We will notify you of any changes by posting the new Privacy Policy on this page and updating the "Last updated" date. You are advised to review this Privacy Policy periodically for any changes.