Privacy Policy

1. Introduction

This Privacy Policy explains how Innvoq Labs LLP ("Legalyard", "we", "our", or "us") collects, uses, shares, retains, and protects your personal data when you use Legalyard AI (the "Service"). Legalyard AI is a product of Innvoq Labs LLP, a limited liability partnership registered in India. It applies globally, supplemented by region-specific annexes in Section 23 for the European Union/EEA, the United Kingdom, India, the United States (and California specifically), Brazil, Canada, Australia, Japan, Korea, Singapore, the United Arab Emirates, Switzerland, and other jurisdictions.

We are committed to processing personal data lawfully, fairly, transparently, and in accordance with applicable data-protection law. If anything in this policy is unclear, contact our Data Protection Officer at dpo@email.legalyard.com.

2. Controller & Contact

Data fiduciary / Controller

Innvoq Labs LLP, WeWork 247 Park, Vikhroli, Mumbai, MH, IN-400079.

Data Protection Officer

dpo@email.legalyard.com

Privacy queries

privacy@email.legalyard.com

Grievance Officer (India, IT Act / DPDPA)

privacy@email.legalyard.com

EU/EEA representative

No EU representative has been designated. Reach the DPO directly at dpo@email.legalyard.com.

UK representative

No UK representative has been designated. Reach the DPO directly at dpo@email.legalyard.com.

3. Scope & Definitions

This policy applies to personal data we process about: visitors to legalyard.ai; users of our mobile applications; account holders; people on the launch waitlist; payers via Razorpay, Paddle, Apple, or Google; and people who contact us by email or in-app feedback.

Personal data

Any information relating to an identified or identifiable natural person.

Processing

Any operation performed on personal data, including collection, storage, retrieval, use, disclosure, erasure, and destruction.

Sensitive / special category data

Personal data that requires heightened protection under law — for example, data revealing race or ethnicity, political opinions, religious beliefs, trade-union membership, health, sex life or sexual orientation, biometric data for identification, genetic data, or (under some laws) precise geolocation, financial-account data, or government-issued identifiers.

Content

Prompts, instructions, uploaded files, conversation history, AI Outputs, memories, annotations, and derived artifacts.

Subprocessor

A third party we engage to process personal data on our behalf to deliver the Service.

4. Personal Data We Collect

Account & identity data

• Email address (always — it is your sign-in identity)
• Name (entered during onboarding, or received from your sign-in provider) and an optional profile photo
• Country, recorded from your network connection when you sign up and refreshed when you sign in
• Time zone, language, and locale preferences
• Your answer to the onboarding question about what you mainly use the Service for
• The time at which you affirmed you are 18 or older (we do not collect your date of birth)
• The time at which you acknowledged the AI disclaimer, and the version you acknowledged

Sign-in data

• Sign-in is passwordless. When you sign in with a one-time code, the code and the email it was sent to are stored only as salted hashes and expire shortly after issue.
• When you sign in with Google, Microsoft, or LinkedIn, we receive your provider account identifier, email, names, and profile picture. When you sign in with Apple, we receive your provider account identifier and email only.
• Sessions: each signed-in session records your IP address and browser or app user-agent, from which we derive a device name and type so you can recognise it. You can list and revoke sessions from Settings → Account.
• Sign-in activity: a security log of sign-ins, sign-outs, and revocations.
• If you are a member of an organisation, that organisation's record of when you were invited, added, suspended or removed, and of changes made to who may reach its data. These name you but belong to the organisation's audit trail, and are kept for longer than your sign-in activity — see Section 11.

Content data

• Prompts, instructions, and questions you submit, and the AI Outputs we generate for you. Message text and conversation titles are encrypted at rest with keys we manage.
• Documents, images, audio, video, and other files you upload, together with the text we extract from them (audio and video are transcribed). Stored files and extracted text are encrypted at rest.
• Memories — short facts (up to 500 characters each) that you save, or that the assistant saves for you, so later chats can recall them. You can view, edit, delete, and clear them, and switch recall off, in Settings → Personalisation and Settings → Privacy.
• Feedback you give on answers, and edits or corrections you make to them (see Section 6).
• App / template inputs (for example, the details you enter into a notice or agreement generator).
• Voice dictation runs in your browser using its own speech-recognition feature; we receive the resulting text as a prompt, not the audio.

Usage data

• Product usage events (the feature you used and the action you took), recorded by our own first-party analytics — we use no third-party analytics SDKs. Each event carries the event name, a pseudonymous per-tab session identifier, your user id when you are signed in, your IP address, and your user-agent. Kept 90 days.
• Credits consumed, and a line-by-line ledger of every credit granted, spent, and expired
• Errors encountered, recorded in structured logs on our own infrastructure
• How you arrived (referral source and campaign tags), for the waitlist and public pages

Billing data

• Plan or credit pack purchased, billing cycle, start and end dates, and your subscription and credit history
• Invoice details you provide: invoice name, address, postcode, country, and a tax identifier (GSTIN or VAT ID) if you supply one
• Card, UPI, and bank details never touch Legalyard — they are collected and held by Razorpay, Paddle, Apple, or Google. We receive payment status and a reference to the transaction.

Bot protection, notifications, and waitlist

• Bot protection: sign-in and waitlist forms are protected by Cloudflare Turnstile on the web and by hCaptcha in the mobile app. The provider returns a pass/fail signal to us.
• Push notifications: if you enable them, we store your browser or device push endpoint and user-agent. The keys that secure the push channel are encrypted at rest. You can revoke this in Settings → Account or in your browser or device settings.
• Launch waitlist (before you have an account): your email (stored encrypted, with a salted hash used for lookup), how you heard about us, campaign tags, and a hashed form of your IP address.

Communications

• Feedback and survey responses you submit in-app
• Emails you send to our support, privacy, security, abuse, or legal mailboxes
• Notification preferences

Cookies & similar technologies

See Section 8 and our Cookie Policy.

Information from third parties

• Sign-in providers (Google, Apple, LinkedIn, Microsoft) — the profile fields listed under Sign-in data
• Payment processors — payment status, transaction references, and the country used for tax
• Bot-protection providers (Cloudflare Turnstile, hCaptcha) — a pass/fail signal

Inferred data

• The jurisdiction an answer is written for — see Section 5, 'Processing you should know about'
• Abuse and fraud signals derived from usage patterns — see Section 5

Sensitive / special category data

5. How We Use Personal Data

We process personal data for the following purposes:

Where we rely on legitimate interest, we balance our interest against your fundamental rights and freedoms. You may object at any time (see Section 14).

Processing you should know about

• Automated screening. Every prompt and Output is screened automatically for abuse categories (child sexual abuse material, hate speech, violence, attempts to extract or override the assistant's instructions, and off-topic misuse). Some matches are refused outright; others are flagged. Flagged items may be reviewed by authorised Legalyard staff, and repeated flags can lead to account suspension. Consequential outcomes involve human review.
• Rate and abuse controls. We limit request rates and detect unusual velocity per account and per network address. Some of these controls use a hashed form of your IP address so the raw address is not stored alongside the limit.
• Read-only support access. To resolve a support request, an authorised member of our team may open a read-only view of your account that shows what you see. Every such session is authorised for a specific case, is limited to 30 minutes, cannot send messages, change settings, or spend your credits, and is recorded in our audit log.
• Jurisdiction. To write an answer under the right law we determine a jurisdiction for each question, in this order: what the question itself names; what the conversation already established; then your profile country, or failing that your device time zone. We never infer jurisdiction from your browser language. The jurisdiction used is shown with the answer and you can correct it.

6. AI Training & Model Improvement

Help improve Legalyard (optional). Settings → Privacy has one switch that controls whether we capture the edits and feedback you give on answers. When it is on, those corrections are kept for 90 days and used to improve answer quality — for example, to check whether a later answer to a similar question repeats a mistake you corrected. This does not train or fine-tune a model. When it is off, corrections are not captured. Switching it off does not delete corrections captured while it was on; they expire at the end of their 90 days.

We do not send your Content to foundation-model providers for THEIR model training. Which providers receive your prompts, what each one is recorded as permitted to retain or train on, and whether we have reviewed that vendor's contract, are published provider-by-provider on our Trust page — generated from the sub-processor register, not written by hand. We do not state a no-training or zero-retention term that the register does not record.

7. Legal Bases (EU/EEA, UK, similar regimes)

• Contract (Art. 6(1)(b) GDPR). Most of our processing is necessary to deliver the Service to you.
• Legitimate interest (Art. 6(1)(f)). Security, abuse and fraud prevention, defence of legal claims, aggregate product analytics.
• Consent (Art. 6(1)(a)). Optional cookies, product-news emails, push notifications, capture of your corrections for answer-quality improvement, and the integrations you connect.
• Legal obligation (Art. 6(1)(c)). Tax and accounting retention, lawful disclosure to authorities.
• Vital interest (Art. 6(1)(d)). Rare — only to protect the life or safety of a person.
• Special categories (Art. 9). We rely on Art. 9(2)(a) explicit consent (when you upload such data into the Service) or Art. 9(2)(e) data manifestly made public by you (e.g., judgment documents).

8. Cookies & Similar Technologies

We use a small number of cookies and browser-storage entries to sign you in, remember your language, and record your consent choices. Our own product analytics uses a per-tab session identifier held in session storage, not a cookie. The full inventory — every cookie, what sets it, and how long it lasts — is in our Cookie Policy.

We set no advertising or cross-site tracking cookies. Third-party scripts set their own cookies only on the pages that load them: Cloudflare Turnstile on sign-in and waitlist forms, Google's sign-in script on the sign-in page, and Paddle or Razorpay on the checkout page. Non-essential categories are set only after you choose them in the consent banner. You can change your choices at any time in Settings → Privacy → Consent. Where your browser sends a Global Privacy Control signal, we treat it as a refusal of non-essential categories.

↗ Cookie Policy — published alongside this policy once the product is live.

9. How We Share Personal Data

We share personal data only as described below. We do NOT sell personal data, and we do NOT share personal data for cross-context behavioural advertising as those terms are defined under the CCPA/CPRA.

• Subprocessors. We engage third parties to host, transmit, process, secure, and otherwise help deliver the Service. The current list, with each processor's location and transfer mechanism, is published at /legal/sub-processors and on the Trust page, and is updated whenever we add or remove a subprocessor.
• AI Providers. Your prompt and the Content excerpts needed to answer it are sent to the foundation-model providers named in the sub-processor register; indexing, OCR, vision and audio send raw Content instead. The current providers, their processing regions, and the retention posture we have actually recorded for each are on our Trust page.
• Before your prompt leaves Legalyard. Structured identifiers in your prompts and documents — email addresses, phone numbers, card numbers, bank account and IBAN numbers, Aadhaar, PAN, and Social Security numbers — are replaced with placeholders before the text reaches an AI provider, and restored only in the answer you see. Names, addresses, and organisation names are NOT replaced, because legal reasoning depends on them; they do reach the provider.
• Payments. Razorpay (India) and Paddle (Merchant of Record outside India) receive the details needed to take payment and issue an invoice: the amount, your invoice name, address, country, and tax identifier if you gave one. Apple and Google handle in-app purchases in the mobile apps and share with us the purchase status and a transaction reference. Each of them independently determines purposes for some of the data it receives (for example, regulatory checks and fraud prevention).
• Identity providers. If you sign in with Google, Apple, LinkedIn, or Microsoft, we exchange tokens with that provider solely to authenticate you; the provider receives no Content. This login connection is separate from the connections described below — signing in with LinkedIn does not, by itself, grant Legalyard permission to post anything.
• Integrations you connect. You can connect cloud drives, mail, calendar, e-signature, productivity tools, and LinkedIn or X publishing accounts. Data flows to or from a provider only after you connect it and only when you use the connection. The access tokens we hold for them are encrypted at rest. You can disconnect at any time from Settings → Connectors (cloud and productivity tools) or Settings → Account (publishing accounts); disconnecting deletes the stored token. For publishing, we send the provider your own composed message and the public share link — never the underlying answer content.
• Authority requests. We may disclose personal data to authorities in response to a valid subpoena, court order, regulator order, or other binding legal process, after assessing the legality and proportionality of the request and, where lawful, notifying the affected user. We push back on overbroad or unlawful requests.
• Safety. We may share data with law-enforcement or third parties where we reasonably believe it is necessary to prevent fraud, abuse, terrorism, imminent harm, or child safety violations.
• Business transfers. If we are involved in a merger, acquisition, financing, or sale of assets, personal data may be transferred. We will provide notice and continue to honour this policy or one no less protective.
• With your consent or at your direction. Including shared chats, links you publish, and the integrations you authorise.
• Aggregated / anonymised. We may share aggregate or anonymised statistics that cannot reasonably be used to identify you.

10. International Data Transfers

Legalyard is established in India. The Service runs on cloud infrastructure; the hosting region is fixed by our deployment and is not selectable per user. The region of every processor, including our hosting provider, is listed in the sub-processor register. When we transfer personal data across borders, we apply the following safeguards:

• EU/EEA to outside the EEA: an adequacy decision where one is in force for the destination; otherwise the EU Standard Contractual Clauses (June 2021), with supplementary measures where needed. We do not rely on the EU-US Privacy Shield or the EU-US Data Privacy Framework.
• UK to outside the UK: the UK International Data Transfer Agreement, or the EU SCCs read together with the UK Addendum.
• Switzerland: the Swiss FADP-compliant variant of the SCCs.
• India: transfers as permitted under the Digital Personal Data Protection Act, 2023 and the notifications made under it.
• Other jurisdictions: adequacy decisions where they exist; contractual safeguards modelled on the EU SCCs otherwise.

You can tell us which privacy regime applies to you (your residency declaration) in Settings → Privacy; it determines which rights list and transfer basis we apply to your account. Copies of the SCCs and other transfer instruments are available on request from dpo@email.legalyard.com.

↗ Sub-processor register — published alongside this policy once the product is live.

11. Retention

We keep personal data only as long as needed for the purposes set out in this policy. The windows below are what the Service enforces.

Your own sign-in history and an organisation's governance record are bounded differently. Records of sign-ins, sessions and security events on your account are kept for 12 months. Where you are a member of an organisation (for example a firm workspace), records of membership changes, ownership transfer, and changes to that organisation's access controls are kept as part of its audit trail for up to 7 years, because the organisation and its regulators may need to establish who had access to client information.

Account deletion

When you delete your account from Settings → Privacy, it enters a 30-day grace period during which you can cancel by signing in. We send a reminder email 7 days before the deadline. When the grace period ends, your conversations, documents, memories, sessions, connections, and profile are removed and your account record is anonymised (a tombstone remains so the same email cannot silently reactivate the old account); it is not physically deleted. The records listed above as surviving erasure are kept for the stated reasons.

Erasure request (privacy right)

Separately from account deletion, you can file an erasure request under your privacy rights from Settings → Privacy. We email you a verification link valid for 24 hours; once you confirm, the erasure runs immediately, with no grace period. What survives, and why: the erasure request record itself and your consent records (so we can demonstrate the request was made, verified, and executed), the sign-in security log and any organisation governance records naming you, each for the retention period stated above, and de-identified abuse and payment or ledger records (fraud prevention and accounting) for the period required by applicable law. The result is shown to you as a report of what was removed and what was retained.

12. Security

We apply technical and organisational measures appropriate to the risk. The measures below are the ones in force today:

• Encryption in transit (TLS) for every connection to the Service
• Server-side encryption of stored files (AES-256, with cloud key management where configured)
• Application-level encryption, with keys we manage, of message text, conversation titles, extracted document text, push-notification keys, and integration access tokens
• Session tokens stored only as hashes; the token itself is shown to your device once
• Sign-in codes and the email they were sent to stored only as salted hashes
• Structured identifiers replaced with placeholders before prompts reach AI providers (see Section 9)
• Bot protection on sign-in and waitlist forms; rate limits and abuse-velocity controls
• Dependency and supply-chain checks in our build pipeline
• Vulnerability disclosure programme with a safe-harbour commitment (see the Trust page and legalyard.com/security/disclosure)

What we do not offer today: multi-factor authentication for consumer accounts (sign-in is a one-time email code or a sign-in provider — protect that email account and provider), and third-party security certifications (see the Trust page for the honest status of each).

No security measure is perfect. If you become aware of a security issue, please report it confidentially to security@legalyard.com. See the Trust page for our vulnerability-disclosure programme and current compliance posture.

13. Your Rights

Subject to your jurisdiction and applicable conditions, you have the following rights regarding your personal data. We honour these rights globally as a matter of policy, even where the law does not strictly require it, unless an exemption applies.

Access

Confirm whether we hold your personal data and obtain a copy in a machine-readable format.

Rectification

Correct inaccurate or incomplete data.

Erasure / Deletion

Have your personal data deleted, subject to the retention exceptions listed in Section 11.

Restriction

Restrict our processing under certain conditions.

Portability

Receive your personal data in a structured, commonly used, machine-readable format and have it transmitted to another controller where technically feasible.

Objection

Object to processing based on legitimate interest or direct-marketing purposes.

Automated decision-making

Not be subject to a decision based solely on automated processing — including profiling — that produces legal or similarly significant effects. We do not engage in such purely-automated decisions; Outputs are not decisions, and consequential outcomes of abuse screening involve human review.

Withdraw consent

Where processing is based on consent, withdraw it at any time without affecting prior processing.

Lodge a complaint

Lodge a complaint with your local supervisory authority (see Section 23 for contacts).

Nominate (DPDPA, India)

Nominate a person to exercise your rights in the event of death or incapacity.

Non-discrimination (CCPA/CPRA, USA)

Not be discriminated against for exercising your privacy rights.

14. How to Exercise Your Rights

Self-serve controls

• Export your data (JSON, or a ZIP with a CSV per section) from Settings → Privacy — up to 3 exports per 24 hours; the download link is valid for 7 days.
• File an erasure request or delete your account from Settings → Privacy.
• Edit your name, photo, and preferences in Settings → Profile. Your email is your sign-in identity and cannot be changed in the app — contact support to change it.
• Declare which privacy regime applies to you (residency declaration) in Settings → Privacy.
• List and revoke signed-in sessions, and revoke push notifications, in Settings → Account.
• View, edit, delete, or clear memories, and switch memory recall off, in Settings → Personalisation and Settings → Privacy.
• Delete any conversation from its menu, and start a private chat that stays out of history.
• Turn the capture of your corrections on or off in Settings → Privacy.
• Change cookie and consent choices in Settings → Privacy → Consent.

By email

• Write to privacy@email.legalyard.com. Specify your right, the data or activity it concerns, and your identifying details.
• Authorised agents (California, Colorado, Virginia and similar): we accept agent requests with proof of authority and verification of the consumer's identity.
• Verification: we may ask you to confirm identity before responding, especially for access or deletion requests. We use the minimum data necessary.
• Response window: 30 calendar days, extendable by 60 days for complex requests with notice; shorter or longer windows apply in some jurisdictions and we honour the most user-favourable.
• Free of charge for the first request in a 12-month period; we may charge a reasonable fee for manifestly unfounded or repetitive requests.

15. Children's Privacy

The Service is not directed to anyone under 18, and we do not knowingly collect personal data from anyone under 18. You must affirm you are 18 or older at signup; we record the time of that affirmation and do not collect your date of birth. There is no parental-consent flow, because the Service is not offered to minors. If you become aware that a child under 18 has provided personal data to the Service, please contact privacy@email.legalyard.com and we will delete it.

Where Applicable Law sets a different age of digital consent (for example, lower thresholds for some EU member states, or higher protections under COPPA in the USA), we apply the most protective threshold.

16. Automated Decision-Making & Profiling

We do not engage in automated decision-making that produces legal or similarly significant effects on you. The Service generates information; the decision to act on it is yours. Where we use automated systems — abuse screening of prompts and Outputs, rate and velocity limits, fraud signals — a refused request is explained to you, flagged items can be reviewed by authorised staff, and consequential outcomes such as account suspension involve human review.

17. Data Breach Notification

If a personal-data breach is likely to result in a risk to your rights and freedoms, we will: (a) notify the competent supervisory authority within the timeframe required by Applicable Law (e.g., 72 hours under GDPR; 'as soon as possible' under DPDPA/CERT-In; without unreasonable delay under most US state laws); and (b) notify you directly without undue delay if the risk is high. Notifications will describe the nature of the breach, likely consequences, measures taken, and how to contact our DPO.

18. Sale, Sharing & "Do Not Track"

We do NOT sell personal data, and we do NOT share personal data for cross-context behavioural advertising, as those terms are defined under the CCPA/CPRA. Browsers vary in their handling of "Do Not Track" signals; where the Global Privacy Control (GPC) signal is sent, we treat it as a refusal of non-essential cookie categories and as a valid opt-out request in jurisdictions that require us to do so (including California).

19. Changes to This Policy

We may update this Privacy Policy from time to time. If a change is material, we will provide at least 30 days' advance notice (by in-app banner, email, or both) and identify the change. The current version, effective date, last-updated date, and version number are shown at the top of this page.

20. Contact

Innvoq Labs LLP

WeWork 247 Park, Vikhroli, Mumbai, MH, IN-400079

• Privacy. privacy@email.legalyard.com
• Data Protection Officer. dpo@email.legalyard.com
• Grievance Officer (India). privacy@email.legalyard.com
• Security. security@legalyard.com
• Abuse. abuse@email.legalyard.com
• Support. support@legalyard.com

↗ All contact channels — published alongside this policy once the product is live.

21. Subprocessors

The current list of subprocessors — name, purpose, location, transfer mechanism — is maintained at /legal/sub-processors and on the Trust page. We notify Accounts via email and in-app banner before adding a new subprocessor that materially affects your personal data.

↗ Sub-processor register — published alongside this policy once the product is live.

↗ Trust page — published alongside this policy once the product is live.

22. Data Subject Requests (DSAR) Portal

You can submit a data export or erasure request from Settings → Privacy in-app, or by email to privacy@email.legalyard.com. We log every request, our verification step, and our response in an audit register so we can demonstrate compliance with applicable law.

23. Regional Annexes

These annexes supplement the body of this policy and prevail over inconsistent provisions for users in the relevant jurisdiction.

EU / EEA (GDPR)

• Controller: Innvoq Labs LLP. No EU representative has been designated; contact the DPO at dpo@email.legalyard.com.
• Your rights: access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), portability (Art. 20), objection (Art. 21), withdrawal of consent (Art. 7), no automated individual decisions (Art. 22).
• Supervisory authority: the data-protection authority of your habitual residence, place of work, or where the alleged infringement occurred. Find yours at edpb.europa.eu.
• Transfers outside the EEA: adequacy decisions where in force; otherwise SCCs (June 2021) with supplementary measures. No reliance on Privacy Shield or the Data Privacy Framework.

United Kingdom (UK GDPR + DPA 2018)

• No UK representative has been designated; contact the DPO at dpo@email.legalyard.com.
• Supervisory authority: Information Commissioner's Office (ICO), ico.org.uk.
• Transfers outside the UK: UK IDTA or EU SCCs read with the UK Addendum.

India (DPDPA 2023 & IT Act)

• Data fiduciary: Innvoq Labs LLP.
• Grievance Officer: privacy@email.legalyard.com.
• Your rights: confirmation & access, correction & completion, erasure, grievance redressal, nomination (in event of death / incapacity), withdrawal of consent.
• Cross-border transfers: as permitted by the Central Government's notifications under the DPDPA.
• Statutory remedies: appeal to the Data Protection Board of India.

California, USA (CCPA / CPRA)

• Categories of personal information collected: identifiers; commercial information; internet/network activity; geolocation (country level, from your connection); inferences (jurisdiction for answers, abuse signals); financial (invoice details, never card numbers); content; sensitive personal information (where users upload it).
• Sources: directly from you; from your device and connection; from sign-in providers; from service providers (payments, bot protection).
• Business or commercial purposes: providing and improving the Service; security, fraud and abuse prevention; legal compliance; account, billing, support.
• Categories shared with service providers / contractors: see Section 9 and the sub-processor register.
• Sale / share for cross-context behavioural advertising: NO.
• Use of sensitive personal information: only as necessary to provide the Service you have requested (Cal. Civ. Code §1798.121).
• Your rights: know, access, correct, delete, opt-out of sale/share, limit use of sensitive PI, non-discrimination, take action via authorised agent.
• Exercising rights: Settings → Privacy or privacy@email.legalyard.com.
• Verification: required for access, correction, deletion, and limit-use-of-SPI requests.
• Right to appeal an adverse decision: privacy@email.legalyard.com with subject 'CCPA Appeal'.
• Shine-the-Light (Cal. Civ. Code §1798.83): we do not disclose personal data to third parties for their own direct-marketing purposes.

Other US states (Virginia VCDPA, Colorado CPA, Connecticut CTDPA, Utah UCPA, Texas TDPSA, Oregon OCPA, Montana MCDPA, Iowa, Delaware, New Hampshire, New Jersey, Tennessee, Indiana, Minnesota, and similar)

• Rights honoured: access, correction (where applicable), deletion, portability, opt-out of targeted advertising, opt-out of sale, opt-out of profiling decisions that produce legal/significant effects, appeal.
• Appeals: privacy@email.legalyard.com with subject 'State Privacy Appeal'.
• Universal opt-out signals (e.g., GPC) honoured where legally required.

Brazil (LGPD)

• Controller: Innvoq Labs LLP. DPO (Encarregado): dpo@email.legalyard.com.
• Your rights: confirmation of processing, access, correction, anonymisation, blocking, deletion, portability, information about sharing, information about consequences of refusal, withdrawal of consent.
• Authority: Autoridade Nacional de Proteção de Dados (ANPD).

Canada (PIPEDA / Quebec Law 25)

• Your rights: access, correction, withdrawal of consent, complaint to the Office of the Privacy Commissioner of Canada.
• Quebec residents: additional rights and protections under Law 25, including the right to data portability and the right to information about automated decision-making.

Australia (Privacy Act 1988 & APPs)

• Your rights: access, correction, complaint to the Office of the Australian Information Commissioner (OAIC).
• Notifiable Data Breaches scheme: we will notify affected individuals and the OAIC of eligible breaches.

Japan (APPI)

• Your rights: disclosure, correction, suspension of use, deletion, suspension of provision to third parties.
• Authority: Personal Information Protection Commission (PPC).

Korea (PIPA)

• Your rights: access, correction, deletion, suspension of processing, withdrawal of consent, complaint to the Personal Information Protection Commission.
• Cross-border transfers: notice and consent as required by PIPA.

Singapore (PDPA)

• Your rights: access, correction, withdrawal of consent.
• Authority: Personal Data Protection Commission (PDPC).

UAE (PDPL)

• Your rights: access, correction, erasure, restriction of processing, transfer, object to automated processing, complaint to the UAE Data Office.

Switzerland (FADP)

• Your rights: information, access, rectification, deletion, objection, complaint to the Federal Data Protection and Information Commissioner (FDPIC).

South Africa (POPIA), China (PIPL), and other jurisdictions

• Your statutory rights under your local data-protection law are honoured. Where additional transfer mechanisms (e.g., China's PIPL standard contract, or POPIA's Section 72) are required, we apply them.

§ About this website specifically

Everything above describes Legalyard AI, the product, as it will operate at launch. Separately: this pre-launch website (legalyard.ai, before launch) has no forms, sets no cookies, and runs no analytics of its own — it does not collect personal data. If you email us, we use your address only to reply. Pages load the Inter and Geist Mono typefaces from Google Fonts, which involves your browser requesting font files from Google's servers.