Legion Law Logo

LEGION PRIVACY POLICY

Effective: January 1, 2026 · Last updated: October 13, 2026

This Privacy Policy describes how Legion LegalTech, Corp. ("Legion", "we", "us", or "our") collects, uses, and discloses personal information in connection with our AI-powered litigation document drafting platform (the "Platform"). By accessing or using the Platform, you acknowledge that you have read, understood, and agree to be bound by this Privacy Policy.

1. Personal Information We Collect

We collect several types of personal information from and about users of our Platform ("Personal Information"), including:

Account Information: When you create an account with us, we collect your name, email address, password, and any other information you provide as part of the account registration process.

Document Information: When you use the Platform to generate legal documents, we collect the information you input into the Platform, such as case details, legal issues, and other parameters necessary to create the documents. This may include personal information about parties involved in the legal matter.

Usage Data: We automatically collect certain information about how you access and use the Platform, including your IP address, browser type, operating system, referring URLs, and information about your interactions with the Platform.

Cookies and Similar Technologies: We may use cookies, web beacons, and similar tracking technologies to collect information about your use of the Platform and to remember your preferences and settings.

Other Information You Provide: We collect other information that you may provide to us, such as when you participate in our events or surveys or provide us with information to establish your identity (collectively, "Other Information You Provide").

2. How We Use Personal Information

We use the personal information we collect for various purposes, including:

Providing and Improving the Platform: We use personal information to operate, maintain, and provide the features and functionality of the Platform, to generate the legal documents you request, and to improve and optimize the performance of the Platform.

Prohibition on AI Training: We expressly and unambiguously prohibit the use of any User Content, Customer Data, Generated Documents, prompts, outputs, or any information uploaded to or processed by the Platform to train, refine, fine-tune, or otherwise improve any of our AI models, any third-party AI models, or any general-purpose or shared AI models. Our AI models that process your content are static, pre-trained models that do not learn from or adapt based on your inputs.

Communication: We may use your email address or other contact information to send you administrative notices, updates about the Platform, and responses to your inquiries or requests.

Analytics and Research: We may use personal information to conduct research and analytics to better understand how users interact with the Platform and to identify trends and insights that can help us enhance our services.

Legal Compliance: We may use personal information as we believe necessary or appropriate to comply with applicable laws, lawful requests, and legal process, subject to the protections described in Section 3 below.

Aggregated or De-Identified Information: We may aggregate or de-identify Personal Information so that it may no longer be used to identify you and use such information to analyze the effectiveness of our Platform, to improve and add features to our Platform, to conduct research and for other similar purposes. Such aggregated or de-identified information will contain no user-specific or client-specific data. We will maintain and use de-identified information in anonymous or de-identified form and we will not attempt to reidentify the information, unless required by law.

3. Disclosure of Personal Information

We may disclose personal information in the following circumstances:

Service Providers: We may share personal information with third-party service providers who perform services on our behalf, such as hosting, data storage, analytics, and customer support. These service providers are contractually obligated to maintain the confidentiality and security of the information we share with them.

Business Transfers: We may disclose personal information in connection with, or during negotiations of, any merger, sale of company assets, financing, or acquisition of all or a portion of our business to another company. Information received from a Connected Account is not transferred in any such transaction without your explicit consent (see Section 9).

Response to Legal Process: If we receive any subpoena, court order, or other legal demand for User Content or Customer Data, we will: (a) promptly notify the affected user of such demand unless legally prohibited from doing so; (b) provide the user with a copy of the demand; (c) object to and actively contest the demand on all available grounds, including but not limited to attorney-client privilege, work product protection, relevance, overbreadth, and undue burden; (d) refuse to produce any User Content or Customer Data unless and until compelled by a final, non- appealable court order or the user provides written authorization; and (e) cooperate with the user's efforts to quash, modify, or limit the scope of any such demand. We will exhaust all reasonable legal avenues to protect User Content and Customer Data before any compelled disclosure.

4. Your Rights and Choices

Depending on your location and subject to applicable law, you may have certain rights with respect to your personal information, including:

Access and Update: You may access and update certain account information by logging into your account on the Platform. If you wish to access, update, or delete other personal information we hold about you, please contact us using the information provided at the end of this Privacy Policy.

Opt-out of Communications: You may opt-out of receiving promotional communications from us by following the unsubscribe instructions in those messages. Please note that even if you opt- out, we may still send you non-promotional messages related to your account or our ongoing business relationship.

Cookies and Tracking: Most web browsers are set to accept cookies by default. If you prefer, you can usually set your browser to remove or reject cookies. Please note that removing or rejecting cookies could affect the availability and functionality of the Platform.

Do Not Track: We currently do not respond to "do not track" signals sent by web browsers. For more information on "do not track" signals, please visit https://www.allaboutdnt.com/.

5. Data Retention and Deletion

We retain User Content and client-specific Generated Documents only for the duration necessary to provide the Services for a specific matter or project. Upon the earliest of: (a) the user's request for deletion; (b) termination of the user's use of the Platform for a specific matter; or (c) termination of the user's agreement with us, we will permanently delete all such User Content and client-specific Generated Documents from all of our systems, including all backups, within thirty (30) days. We will provide written certification of such deletion upon request. Notwithstanding the foregoing, we may retain anonymized document structures, legal standards, and procedural frameworks for Platform improvement purposes, provided such retained information contains no user-specific or client-specific data.

6. Data Security

We maintain the following security measures to protect your information:

Encryption Standards: We use AES-256 encryption for all Customer Data at rest and TLS 1.2 or higher encryption for all Customer Data in transit. We will maintain these security standards at all times.

Data Breach Notification: In the event of any confirmed security breach affecting User Content or Customer Data, we will notify affected users within twenty-four (24) hours of our discovery of such breach. Such notification will include: (a) the nature of the breach; (b) the types of data affected; (c) the date and time of the breach, if known; (d) steps we have taken to contain and remediate the breach; and (e) recommended actions for users to protect their interests. We will cooperate with users to enable them to meet their own notification obligations to clients and regulatory authorities.

Shared Responsibility: The security of the documents generated using the Platform is a shared responsibility between Legion and our customers. While we implement technical and organizational measures to protect the information processed by the Platform, customers are responsible for securing access to their accounts, maintaining the confidentiality of their login credentials, and ensuring the appropriate use and handling of the generated documents.

If you have reason to believe that your account or any information processed through the Platform has been compromised, please contact us immediately using the information at the end of this Privacy Policy.

7. Data Location

All Customer Data is stored and processed exclusively within the United States. We will not transfer Customer Data outside the United States without the customer's prior written consent.

8. Third-Party AI Models

In providing the Platform and generating legal documents, we use third-party AI models: OpenAI's API, Anthropic's Claude API, Google's Gemini models on Google Cloud Vertex AI, and models available through Amazon Web Services' Amazon Bedrock. By using the Platform and providing information to us, you expressly consent to our use of such third-party AI models and the sharing of your information with the providers of these models as necessary to perform the services.

Zero Data Retention Agreements: We maintain zero data retention agreements with our third- party AI providers, including OpenAI and Anthropic. Under these agreements:

  • OpenAI will not log User Content for human review, store data persistently in the cloud, or save data to disk, with only transient storage in memory for processing purposes
  • Anthropic will delete all prompts and outputs immediately following generation of the relevant output, except where required by law or to combat malicious uses
  • Neither OpenAI nor Anthropic will use User Content to train, improve, or modify their AI models
  • Both providers may run automated safety classifiers over content solely to detect violations of acceptable use policies, but will not retain the underlying User Content

Google and Amazon Web Services: Gemini models on Vertex AI and models on Amazon Bedrock run within our Google Cloud and Amazon Web Services accounts under those providers' cloud service terms. Under those terms, Google and Amazon Web Services do not use your content to train or improve their AI models.

We will provide copies of these zero retention agreements upon written request.

Our use of third-party AI models is subject to the respective terms of use and privacy policies of these providers.

9. Connected Accounts (Google and Microsoft)

You may choose to connect a Google account (Gmail) or a Microsoft account (Outlook mail or OneDrive) to Legion (a "Connected Account"). Connecting is optional. It happens only when you sign in to the provider from Legion's Settings page and approve the permissions shown on the provider's consent screen, and Legion never sees or stores your Google or Microsoft password. This section explains what Legion accesses through a Connected Account and how that information is used, stored, shared, and deleted. For information received from a Connected Account, this section controls over any broader use or disclosure described elsewhere in this Privacy Policy.

What We Access: Legion requests only the permissions its features need:

  • Gmail. Read-only access to your Gmail (the gmail.readonly permission) and your Google account's name and email address (the openid, email, and profile permissions). Legion retrieves only the messages returned by searches you run and the messages you ask it to open or file, including their headers (sender, recipients, subject, and date), body text, and attachments. Legion cannot send, delete, label, or change your email.
  • Outlook. Read access to your mail through Microsoft Graph (the Mail.Read permission), your basic Microsoft profile (User.Read), and permission to keep that access until you disconnect (offline_access). Legion retrieves the same limited set of messages described above and cannot send, delete, or change your email.
  • OneDrive. Read and write access to the files you can access in OneDrive (the Files.ReadWrite.All permission), your basic Microsoft profile (User.Read), and offline_access. Legion lists the files and folders in the locations you browse, search, or select, and reads or copies only the files you ask it to open or bring into a matter, together with their file details (such as name, size, dates, and who created and last changed the file). The permission also allows writing. Legion requests it so that features that save your work back to OneDrive can be added. When those features are available, Legion will write only to a folder you designate and only when you take an action that saves there. Legion never writes to your OneDrive without such an action, and it does not change, move, or delete your other files.

When We Access It: Legion does not sync or monitor a Connected Account in the background. It contacts Google or Microsoft only to carry out a request you make, for example when you ask Centurion, Legion's AI assistant, to search your email, read a message or conversation, or file messages into a matter. Searching and reading retrieve messages live from the provider and do not add anything to your matters. A message is copied into Legion only when you ask for it to be filed into a matter. Legion then saves a PDF copy of the message, the original message file, and each of its attachments in that matter.

How We Use It: Legion uses information from a Connected Account only to provide the features you use: finding, reading, and summarizing messages and files at your request, and filing the ones you choose into your matter. Legion does not:

  • use it for advertising, including retargeting or personalized or interest-based advertising;
  • sell it, or give it to data brokers or information resellers;
  • use it to build profiles of you or of anyone in your messages or files, or to determine credit-worthiness or for lending purposes; or
  • use it to train, fine-tune, or improve any generalized or shared AI or machine-learning model, whether Legion's or a third party's (see Section 2, Prohibition on AI Training).

AI Processing: Centurion runs on Anthropic's Claude models. When Centurion searches or reads your email at your request, the text it retrieves is sent to Anthropic so Centurion can answer you, under the zero data retention agreement described in Section 8. Once Centurion has read email content while answering a request, it stops using web search and stops opening web links for the rest of that answer. This keeps the content of your email from being sent to a search engine and keeps links inside a message from being opened. You can ask for a web search again in your next message. Messages and files you file into a matter are processed like any other document you add to the Platform, including by the third-party AI models described in Section 8.

Sharing: Legion does not share information from a Connected Account with anyone except: (a) service providers that run the Platform for us, such as Amazon Web Services for hosting, storage, and encryption keys and the AI model providers described in Section 8, who are contractually obligated to maintain the confidentiality and security of the information; (b) people you give access to a matter, who can see the copies you file there; and (c) as required by law, subject to the protections described in Section 3. Legion will not transfer information from a Connected Account as part of a merger, acquisition, or sale of assets without first obtaining your explicit consent.

Human Access: Legion personnel do not read information from a Connected Account, including copies you have filed, unless: (a) you give us your affirmative agreement to view specific messages or files, for example by approving an access request in the Platform or to resolve a support request; (b) it is necessary for security purposes, such as investigating abuse or a security incident; (c) it is necessary to comply with applicable law; or (d) the information has been aggregated and anonymized and is used only for Legion's internal operations. A message or file you file into a matter is an Input under Section 5 of our Terms and Conditions (Legion's Access to Your Content): it stays closed to Legion personnel until you approve a request, and the Authorized Reviewers named there may see only what the Platform generates for you, including a passage of a filed message that a draft or an answer quotes, as that Section describes. This limit otherwise applies even where our Terms and Conditions describe broader access for technical support.

Storage and Security: When you connect an account, the provider issues Legion a credential (an OAuth refresh token). Legion encrypts that credential with AES-256-GCM using a single-use key issued by Amazon Web Services Key Management Service (AWS KMS), stores the key itself only in encrypted form, and decrypts the credential only when a feature you are using needs it. Legion does not keep a copy of the messages it searches or reads for you. So that an interrupted request can resume, Centurion's working records hold the text it read for about 30 days and are then deleted automatically. Your conversation with Centurion keeps a note of which messages it read (subject and sender) and Centurion's replies to you, which may summarize or quote them. Copies you file into a matter are protected like all other Customer Data under Section 6.

Disconnecting and Deletion: You can disconnect a Connected Account at any time in Settings. Disconnecting immediately deletes the stored credential, so Legion can no longer reach that account. Legion keeps only the account's email address and display name, so that the records of messages you filed from it stay complete. Legion's permission will still be listed in your Google or Microsoft account until you remove it there, which you can do at any time at https://myaccount.google.com/permissions for Google or at https://account.live.com/consent/Manage for a personal Microsoft account. For a work or school Microsoft 365 account, your organization's administrator can remove it.

Disconnecting does not remove copies you have already filed. With each filed message Legion also keeps the original message file and a retrieval record (the account it came from, its sender, recipients, subject, and date, and when it was retrieved), which authenticate the copy. These stay with the matter even if you delete the PDF copy, and they are deleted under Section 5 along with the rest of the matter's contents. To request deletion, contact us at support@legion.law.

Google API Services User Data Policy: Legion's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

10. Accuracy and Hallucinations

The Platform uses advanced AI models to generate legal documents based on user inputs. While we employ proprietary methods to reduce the risk of inaccuracies or hallucinations (i.e., the generation of content that is not grounded in reality or factual information), it is important to understand that, like other AI-powered services, the Platform may occasionally produce outputs that are not entirely accurate or consistent with real-world information.

We are constantly working to improve and refine the Platform to minimize the occurrence of hallucinations. However, given the complex nature of these models, we cannot guarantee the complete elimination of this risk. Therefore, we strongly recommend that you carefully review, fact-check, and edit any documents generated by the Platform before using them for legal purposes.

If you notice that a document generated by the Platform contains factually inaccurate information about you or your legal matter, please contact us using the information provided at the end of this Privacy Policy. We will make reasonable efforts to investigate and address the issue, but please note that due to the technical complexity of AI models, we may not be able to correct every inaccuracy.

By using the Platform, you acknowledge and accept the potential for inaccuracies or hallucinations in the generated documents.

11. Services Agreement Controls

In the event of any conflict or inconsistency between this Privacy Policy and a separate Master Services Agreement or Terms of Service executed between you and Legion LegalTech, Corp., the terms that provide greater protection for your data shall control. Nothing in this Privacy Policy is intended to diminish, supersede, or override any protections explicitly provided in a Master Services Agreement or Terms of Service between you and Legion LegalTech, Corp.

12. Changes to this Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our privacy practices. If we make material changes, we will notify you by email and by posting a notice on the Platform prior to the effective date of the changes. We encourage you to review this Privacy Policy periodically for the latest information on our privacy practices.

13. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our privacy practices, please contact us at: support@legion.law