Privacy Policy

1. Introduction

Drengskapur LLC ("we," "us," or "our") operates LawForge ("the Service"). This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our Service.

By using LawForge, you consent to the data practices described in this policy. If you do not agree with this policy, please do not use our Service.

2. Information We Collect

2.1 Information You Provide

2.2 Information Collected Automatically

2.3 Usage Data for Service Improvement

2.4 Inferences and Derived Data

We may derive inferences from the data we collect to create profiles reflecting your preferences, characteristics, behavior, or interests. These inferences may include:

• Predicted usage patterns and feature preferences
• Account risk scores for fraud prevention
• Research interest categories based on search behavior

Under the California Consumer Privacy Act (CCPA), California residents may request disclosure of inferences we have drawn about them. See Section 7 for how to exercise your rights.

3. How We Use Your Information

We use the information we collect to:

• Provide the Service: Authenticate you, process API requests, and deliver search results
• Improve the Service: Analyze usage patterns, train AI models, and enhance search quality and features
• Process Payments: Handle subscription billing through Stripe
• Enforce Limits: Apply rate limits based on your subscription tier
• Communicate: Send essential service communications (account verification, billing notices)
• Improve Security: Detect and prevent fraud, abuse, and security threats
• Legal Compliance: Comply with legal obligations and respond to lawful requests

3.1 Legal Bases for Processing (GDPR)

For users in the European Economic Area, we process personal data under the following legal bases:

• Contract Performance: Processing necessary to provide the Service you requested
• Legitimate Interests: Processing for service improvement, security, fraud prevention, and AI model training, where our interests do not override your fundamental rights
• Legal Obligation: Processing required by applicable law
• Consent: Where you have given explicit consent for specific processing

3.2 Sale of Personal Information

We do NOT sell your personal information to third parties as defined under the California Consumer Privacy Act (CCPA). We may share data with service providers who assist us in operating the Service, but this is not considered a "sale" under CCPA as these providers are contractually restricted from using your data for their own purposes.

4. Cookies and Tracking

4.1 Essential Cookies

We use the following essential cookies that are required for the Service to function:

4.2 Analytics (Optional)

We may use Cloudflare Analytics Engine for aggregate usage statistics. This analytics:

• Does NOT use cookies
• Does NOT track individual users
• Only provides aggregate metrics (total requests, geographic regions)
• Is privacy-preserving and GDPR-compliant

5. Third-Party Services

We share information with the following third-party service providers:

6. Data Security

We implement appropriate security measures to protect your information:

• Encryption in Transit: All data transmitted to/from our Service is encrypted using TLS 1.2 or higher
• Encryption at Rest: Account data is stored in encrypted databases (Cloudflare D1)
• OAuth Security: We use OAuth 2.0 with PKCE for authentication - we never store or have access to your password
• Access Controls: Only authorized personnel have access to user data
• Security Headers: We implement strict Content Security Policy, HSTS, and other security headers

While we strive to protect your information, no method of transmission over the Internet is 100% secure. We cannot guarantee absolute security.

6.1 Data Breach Notification

In the event of a data breach that compromises your personal information, we will:

• Notify affected users via email within 72 hours of discovering the breach
• Provide information about the nature of the breach and data affected
• Describe steps we are taking to address the breach
• Recommend protective actions you may take
• Notify relevant regulatory authorities as required by applicable law

7. Your Rights

7.1 All Users

You have the right to:

• Access: Request a copy of the personal information we hold about you
• Correction: Request correction of inaccurate personal information
• Deletion: Request deletion of your account and personal information
• Portability: Request your data in a machine-readable format

7.2 California Residents (CCPA)

7.3 European Users (GDPR)

8. Data Retention

We retain your personal information as follows:

• Account Data: Retained while your account is active, plus 30 days after deletion
• Usage Data: May be retained indefinitely in anonymized or aggregated form for service improvement and analytics
• Query Data: May be retained for model training and service improvement purposes
• Server Logs: Retained for up to 90 days for security and debugging purposes

Personal account data is permanently deleted 30 days after account deletion. Anonymized usage data may be retained for service improvement.

9. Children's Privacy

The Service is not intended for individuals under the age of 18. We do not knowingly collect personal information from children under 18. If you are a parent or guardian and believe your child has provided us with personal information, please contact us at privacy@lawforge.io, and we will delete such information.

10. International Data Transfers

Your information may be processed in the United States and other countries where our service providers operate. By using the Service, you consent to the transfer of your information to countries that may have different data protection laws than your country of residence.

We rely on standard contractual clauses and other appropriate safeguards for international data transfers.

11. Business Transfers

In the event of a merger, acquisition, reorganization, bankruptcy, dissolution, or sale of all or a portion of our assets, your personal information may be transferred as part of that transaction. You acknowledge and agree that such transfers may occur and that the acquiring entity may continue to use your personal information as set forth in this Privacy Policy.

If a change of ownership occurs, we will notify you via email and/or a prominent notice on our website of any change in ownership or uses of your personal information, as well as any choices you may have regarding your personal information.

12. Legal Disclosure

We may disclose your personal information if required to do so by law or in response to valid legal requests, including:

• Court orders, subpoenas, or other legal process
• Requests from law enforcement or government agencies
• To protect our rights, property, or safety, or that of our users or the public
• To investigate suspected fraud, abuse, or violations of our Terms of Service
• In connection with legal proceedings or potential legal claims

We will attempt to notify you of such requests unless prohibited by law or court order, or if notification would be futile or would jeopardize an investigation.

13. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any material changes by posting the new policy on this page and updating the "Last updated" date. We encourage you to review this policy periodically.

For material changes that significantly affect how we use your personal information, we will provide reasonable notice via email to the address associated with your account. Your continued use of the Service after changes take effect constitutes acceptance of the updated policy.

14. Contact Us

For questions about this Privacy Policy or to exercise your privacy rights:

We will respond to all requests within 30 days (or sooner if required by law).