About this register
#Innvoq Labs LLP engages a small number of third parties to host, run and support Legalyard AI. Where such a party processes personal data on our behalf, it is a sub-processor and it is listed on this page.
The table in section 6 is read live from the platform's own register on every visit — it is the same list the Trust page shows, not a copy maintained by hand. Adding or removing a vendor updates this page without a release, so what you see is the register as it stands now.
Part of our Data Processing Agreement
This register is incorporated into our Data Processing Agreement by reference. A customer relying on the DPA may treat the table in section 6 as the current Annex of sub-processors.
What a sub-processor is, and what the categories mean
#A sub-processor is an organisation that processes personal data under our instructions to deliver part of the Service. Vendors we merely buy from (an office supplier, an accountant) are not sub-processors and are not listed.
- Infrastructure
- Hosting, storage, queues and delivery — the vendor holds Content and account data at rest or in transit.
- AI inference
- A model provider that receives prompts and the excerpts of Content needed to answer them.
- AI retrieval
- A provider that ranks or searches passages for grounding; it sees retrieved passages, not whole documents.
- AI document processing
- A provider that receives an uploaded document in full — for example to extract its text — and is therefore treated exactly like an inference provider.
For AI vendors the register also records the retention posture we have actually established — whether the vendor's terms exclude training on our data, whether zero-data-retention terms are in force, and whether a contract has been reviewed to confirm it. A vendor recorded on its default terms is shown as such; the Trust page never upgrades that into a promise.
Where data goes, and on what basis
#Each row names the vendor's legal-entity country and any distinct processing regions, together with the mechanism that lawfully covers a cross-border transfer:
- EU Standard Contractual Clauses. the European Commission's approved clauses, with or without supplementary measures.
- DPDPA consent and cross-border notice. for transfers out of India, under the Digital Personal Data Protection Act, 2023.
- Same jurisdiction. no cross-border transfer takes place for that vendor.
Changes to the register
#- Every vendor carries the date it was added; the register is versioned, so a change is a recorded event rather than a silent edit of a web page.
- We notify customers in advance of material changes, such as a new vendor that will process Content.
- Removing a vendor removes it from this page at once; its historical record remains in the register for audit.
Questions and objections
#Write to privacy@email.legalyard.com to ask about a vendor or to object to a planned addition. Our Data Protection Officer can be reached at dpo@email.legalyard.com.
If the register cannot be loaded, the table below says so; in that case the current list is available on request from the same address.
6
Subprocessors
Every third party that receives your data to deliver the Service, grouped by what it does. Only AI providers and legal databases see your prompts, documents or search terms; the rest receive the specific items listed. We notify customers in advance of material changes. This list is part of our Data Processing Agreement.
| Subprocessor | Purpose | Country | Data accessed | Content retention | Transfer mechanism |
|---|---|---|---|---|---|
| AI model and search providers9 | |||||
| Anthropic, PBC | AI model provider — Claude models, used for drafting and for checking a draft before you see it | United States | Your prompts and the excerpts of your documents needed to answer them, with personal identifiers replaced by placeholders before sending | Provider's standard terms — no training restriction recorded; no zero-retention term recorded | EU SCCs + supplementary measures |
| OpenAI, LLC | AI model provider — GPT models, used to work out what a request is asking for; indexing of the documents you upload so they can be searched; and transcription of audio you ask to have written out | United States · European Union | Your prompts and document excerpts (identifiers replaced by placeholders); the full text of documents you index, for embeddings; and audio files you ask to have transcribed | Provider's standard terms — no training restriction recorded; no zero-retention term recorded | EU SCCs + supplementary measures |
| Google LLC | AI model provider — Gemini models, used for high-volume text work, for reading page and figure images, and for indexing the documents you upload so they can be searched | United States · European Union · India | Your prompts and document excerpts (identifiers replaced by placeholders); the full text of documents you index, for embeddings; the original bytes of documents sent for AI text extraction; page and figure images | Provider's standard terms — no training restriction recorded; no zero-retention term recorded | EU SCCs + supplementary measures |
| Google LLC (Cloud Document AI) | OCR — text + layout extraction from uploaded documents whose text layer is missing or unreliable | United States · European Union · India | The original bytes of documents you upload whose text cannot be read directly, for text and layout extraction | Provider's standard terms — no training restriction recorded; no zero-retention term recorded | EU SCCs + supplementary measures |
| Cohere, Inc. | Relevance ranking — puts the passages found for your question into the order most likely to answer it | Canada · United States | Your question and the candidate passages retrieved for it, with personal identifiers replaced by placeholders, so they can be re-ordered by relevance | Provider's standard terms — no training restriction recorded; no zero-retention term recorded | EU Standard Contractual Clauses |
| Perplexity AI, Inc. | Web search — answers a research question by searching the public web | United States | Your research question as a web-search query, with personal identifiers removed before sending | Provider's standard terms — no training restriction recorded; no zero-retention term recorded | EU Standard Contractual Clauses |
| Tavily Research, Inc. | Web search — searches the public web for a research question; used only where this provider is enabled | United States | Your research question as a web-search query, with personal identifiers removed before sending | Provider's standard terms — no training restriction recorded; no zero-retention term recorded | EU Standard Contractual Clauses |
| Exa Labs, Inc. | Web search — searches the public web for a research question; used only where this provider is enabled | United States | Your research question as a web-search query, with personal identifiers removed before sending | Provider's standard terms — no training restriction recorded; no zero-retention term recorded | EU Standard Contractual Clauses |
| SuSea, Inc. (You.com) | Web search — searches the public web for a research question; used only where this provider is enabled | United States | Your research question as a web-search query, with personal identifiers removed before sending | Provider's standard terms — no training restriction recorded; no zero-retention term recorded | EU Standard Contractual Clauses |
| Public legal databases21 | |||||
| Free Law Project (CourtListener) | US case-law data source — read-only lookups against a public court-record publisher; it receives the words of the search and none of your documents or account records | United States | A case citation, judge name or matter type as search terms; none of your documents or account details | Provider's standard terms — no training restriction recorded; no zero-retention term recorded | No cross-border transfer instrument — same jurisdiction, or a destination chosen by your own device |
| IndianKanoon (Quartz Communications Pvt. Ltd.) | India case-law and statute data source — read-only lookups against a public publisher; it receives the words of the search and none of your documents or account records | India | A case citation, statute reference or judge name as search terms; none of your documents or account details | Provider's standard terms — no training restriction recorded; no zero-retention term recorded | DPDPA 2023 consent + cross-border transfer notice |
| British and Irish Legal Information Institute (BAILII) | UK case-law data source — read-only lookups against a public publisher; it receives the words of the search and none of your documents or account records | United Kingdom | A case citation or case name as search terms; none of your documents or account details | Provider's standard terms — no training restriction recorded; no zero-retention term recorded | EU Standard Contractual Clauses |
| Cornell Legal Information Institute | US statute-lookup data source — read-only public lookup. NO firm-side PII flows | United States | A statute or regulation reference; none of your documents or account details | Provider's standard terms — no training restriction recorded; no zero-retention term recorded | No cross-border transfer instrument — same jurisdiction, or a destination chosen by your own device |
| EUR-Lex (Publications Office of the European Union) | EU legislation + case-law data source — read-only public lookup. NO firm-side PII flows | European Union (Luxembourg) · European Union | An EU legislation or case reference; none of your documents or account details | Provider's standard terms — no training restriction recorded; no zero-retention term recorded | No cross-border transfer instrument — same jurisdiction, or a destination chosen by your own device |
| Canadian Legal Information Institute (CanLII), operated by the Federation of Law Societies of Canada | Canada case-law data source — citation verification through the licensed CanLII API; engaged only on deployments holding a CanLII API key | Canada | A case citation or CanLII case identifier being verified; none of your documents or account details | Provider's standard terms — no training restriction recorded; no zero-retention term recorded | No cross-border transfer instrument — same jurisdiction, or a destination chosen by your own device |
| Australasian Legal Information Institute (AustLII), UNSW Sydney and UTS | Australia case-law data source — read-only public search for citation verification | Australia | A case name or citation as search terms; none of your documents or account details | Provider's standard terms — no training restriction recorded; no zero-retention term recorded | No cross-border transfer instrument — same jurisdiction, or a destination chosen by your own device |
| Library of Congress (congress.gov API) | US federal legislation data source — bill and public-law verification through the Library of Congress API; engaged only on deployments holding an API key | United States | A bill or public-law number being verified; none of your documents or account details | Provider's standard terms — no training restriction recorded; no zero-retention term recorded | No cross-border transfer instrument — same jurisdiction, or a destination chosen by your own device |
| Administrative Office of the United States Courts (PACER) | US federal docket data source — hearing lookups by case number; engaged only on deployments holding a PACER credential | United States | A federal case number and court identifier; none of your documents or account details | Provider's standard terms — no training restriction recorded; no zero-retention term recorded | No cross-border transfer instrument — same jurisdiction, or a destination chosen by your own device |
| The National Archives (legislation.gov.uk) | UK legislation data source — statute section lookups from the official publisher; no credential required | United Kingdom | A statute and section reference; none of your documents or account details | Provider's standard terms — no training restriction recorded; no zero-retention term recorded | No cross-border transfer instrument — same jurisdiction, or a destination chosen by your own device |
| eCourts India (ecourtsindia.com) — commercial partner API for the India eCourts register | India court-record data source — case status by CNR number; engaged only on deployments holding a partner API key | India | A CNR case number; none of your documents or account details | Provider's standard terms — no training restriction recorded; no zero-retention term recorded | DPDPA 2023 consent + cross-border transfer notice |
| United States Government Publishing Office (govinfo.gov) | US Code data source — section lookups against the official publisher; no credential required | United States | A US Code title and section number; none of your documents or account details | Provider's standard terms — no training restriction recorded; no zero-retention term recorded | No cross-border transfer instrument — same jurisdiction, or a destination chosen by your own device |
| India Code (Ministry of Law and Justice, Government of India) | India statute data source — act and section lookups against the official repository; no credential required | India | An act name, section number or statute search term; none of your documents or account details | Provider's standard terms — no training restriction recorded; no zero-retention term recorded | No cross-border transfer instrument — same jurisdiction, or a destination chosen by your own device |
| Justia Inc. | US state statute data source — read-only lookups against the published state codes | United States | A state, code and section reference as lookup terms; none of your documents or account details | Provider's standard terms — no training restriction recorded; no zero-retention term recorded | EU Standard Contractual Clauses |
| Supreme Court of India | India case-law data source — read-only lookups against the Supreme Court of India judgment portal; it receives the words of the search and none of your documents or account records | India | A case citation or case name as search terms; none of your documents or account details | Provider's standard terms — no training restriction recorded; no zero-retention term recorded | No cross-border transfer instrument — same jurisdiction, or a destination chosen by your own device |
| Gazette of India (Government of India) | India regulations data source — read-only lookups against the official Gazette of India, plus automated polling of its published-notice feed; it receives the words of a search and none of your documents or account records | India | A notification or regulation reference as search terms, and the titles of newly-published Gazette entries picked up by automated polling; none of your documents or account details | Provider's standard terms — no training restriction recorded; no zero-retention term recorded | No cross-border transfer instrument — same jurisdiction, or a destination chosen by your own device |
| Reserve Bank of India | India financial-regulation data source — read-only lookups against the Reserve Bank of India’s published circulars and notifications; it receives the words of the search and none of your documents or account records | India | A circular, notification or regulation reference as search terms; none of your documents or account details | Provider's standard terms — no training restriction recorded; no zero-retention term recorded | No cross-border transfer instrument — same jurisdiction, or a destination chosen by your own device |
| Securities and Exchange Board of India | India securities-regulation data source — read-only lookups against SEBI’s published regulations and circulars; it receives the words of the search and none of your documents or account records | India | A circular, regulation or notification reference as search terms; none of your documents or account details | Provider's standard terms — no training restriction recorded; no zero-retention term recorded | No cross-border transfer instrument — same jurisdiction, or a destination chosen by your own device |
| GST Council / Central Board of Indirect Taxes and Customs (CBIC) | India tax-regulation data source — read-only lookups against the GST Council’s and CBIC’s published notifications and circulars; it receives the words of the search and none of your documents or account records | India | A notification, circular or GST reference as search terms; none of your documents or account details | Provider's standard terms — no training restriction recorded; no zero-retention term recorded | No cross-border transfer instrument — same jurisdiction, or a destination chosen by your own device |
| Courts and Tribunals Judiciary (judiciary.uk) | UK daily court-sitting data source — read-only lookups against the official published cause lists, used to check when a case is listed; it receives the court and date being checked and none of your documents or account records | United Kingdom | A court name and date, or a case name being checked against a day’s listing; none of your documents or account details | Provider's standard terms — no training restriction recorded; no zero-retention term recorded | No cross-border transfer instrument — same jurisdiction, or a destination chosen by your own device |
| Court of Justice of the European Union (CURIA) | EU case-law data source — read-only lookups against the Court of Justice of the European Union’s own case-search portal; it receives the words of the search and none of your documents or account records | European Union (Luxembourg) · European Union | A case citation or case name as search terms; none of your documents or account details | Provider's standard terms — no training restriction recorded; no zero-retention term recorded | No cross-border transfer instrument — same jurisdiction, or a destination chosen by your own device |
| Accounts and systems you connect12 | |||||
| Google LLC (Google Drive) | Cloud storage — reading files from a Google Drive account the user connects; engaged only where the integration is configured | United States · European Union · Global | The access you granted when you connected your account, the identifiers of the files and folders being opened, and the words you or the assistant search for. Your files and folders travel from there into Legalyard, not the other way. | Provider's standard terms — no training restriction recorded; no zero-retention term recorded | EU Standard Contractual Clauses |
| Microsoft Corporation (Microsoft 365 — OneDrive and SharePoint) | Cloud storage and document management — reading files from a OneDrive or SharePoint account the user connects, through Microsoft Graph; engaged only where the integration is configured | United States · European Union · Global | The access you granted when you connected your account, the identifiers of the files, folders and document libraries being opened, and the words you or the assistant search for. Your files, folders and document libraries travel from there into Legalyard, not the other way. | Provider's standard terms — no training restriction recorded; no zero-retention term recorded | EU Standard Contractual Clauses |
| Dropbox, Inc. (Dropbox International Unlimited Company for users outside North America) | Cloud storage — reading files from a Dropbox account the user connects; engaged only where the integration is configured | United States · European Union | The access you granted when you connected your account, the identifiers of the files and folders being opened, and the words you or the assistant search for. Your files and folders travel from there into Legalyard, not the other way. | Provider's standard terms — no training restriction recorded; no zero-retention term recorded | EU Standard Contractual Clauses |
| Box, Inc. | Cloud storage — reading files from a Box account the user connects; engaged only where the integration is configured | United States · European Union | The access you granted when you connected your account, the identifiers of the files and folders being opened, and the words you or the assistant search for. Your files and folders travel from there into Legalyard, not the other way. | Provider's standard terms — no training restriction recorded; no zero-retention term recorded | EU Standard Contractual Clauses |
| MEGA Limited | Cloud storage — reading files from a MEGA account the user connects with their MEGA email and password | New Zealand · European Union | The MEGA email address and password you enter, which are sent to MEGA to open the session, plus the identifiers of the files being opened and the words you or the assistant search for. Your files travel from MEGA into Legalyard, not the other way. | Provider's standard terms — no training restriction recorded; no zero-retention term recorded | EU Standard Contractual Clauses |
| iManage LLC | Document management — reading documents from an iManage Work library the user connects; engaged only where the integration is configured | United States · European Union · Australia | The access you granted when you connected your account, the identifiers of the documents and workspaces being opened, and the words you or the assistant search for. Your documents and workspaces travel from there into Legalyard, not the other way. | Provider's standard terms — no training restriction recorded; no zero-retention term recorded | EU Standard Contractual Clauses |
| NetDocuments Software, Inc. | Document management — reading documents from a NetDocuments cabinet the user connects; engaged only where the integration is configured | United States · European Union · Australia | The access you granted when you connected your account, the identifiers of the documents and cabinets being opened, and the words you or the assistant search for. Your documents and cabinets travel from there into Legalyard, not the other way. | Provider's standard terms — no training restriction recorded; no zero-retention term recorded | EU Standard Contractual Clauses |
| Google LLC (Gmail) | Connected mailbox — searching a Gmail account the user connects, through Google’s connector endpoint; engaged only where the integration is configured | United States · European Union · Global | The access you granted when you connected your account, the identifiers of the mailbox messages being opened, and the words you or the assistant search for. Your mailbox messages travel from there into Legalyard, not the other way. | Provider's standard terms — no training restriction recorded; no zero-retention term recorded | EU Standard Contractual Clauses |
| DocuSign, Inc. | Connected e-signature account — reading envelope status from a DocuSign account the user connects; engaged only where the integration is configured | United States · European Union | The access you granted when you connected your account, the identifiers of the signature envelopes being opened, and the words you or the assistant search for. Your signature envelopes travel from there into Legalyard, not the other way. | Provider's standard terms — no training restriction recorded; no zero-retention term recorded | EU Standard Contractual Clauses |
| HubSpot, Inc. | Connected CRM — reading records from a HubSpot account the user connects; engaged only where the integration is configured | United States · European Union | The access you granted when you connected your account, the identifiers of the CRM records being opened, and the words you or the assistant search for. Your CRM records travel from there into Legalyard, not the other way. | Provider's standard terms — no training restriction recorded; no zero-retention term recorded | EU Standard Contractual Clauses |
| Stripe, Inc. | Connected payments account — reading invoices, payments and balance records from a Stripe account the user connects; engaged only where the integration is configured | United States · European Union | The access you granted when you connected your account, the identifiers of the payment and invoicing records being opened, and the words you or the assistant search for. Your payment and invoicing records travel from there into Legalyard, not the other way. | Provider's standard terms — no training restriction recorded; no zero-retention term recorded | EU Standard Contractual Clauses |
| Intuit Inc. (QuickBooks Online) | Accounting sync — pushing invoices, payments and credit notes into a QuickBooks Online company the firm connects; engaged only where the integration is configured | United States | The invoices, payments and credit notes your firm chooses to sync: the client name they are addressed to, the line-item descriptions, and the amounts and dates | Not applicable — No prompts, documents or search queries reach this party; it receives the accounting records your firm chooses to send into its own QuickBooks company. A content-retention posture therefore does not apply. How long it keeps what it does receive is set by its own published terms, which have not been read. | EU Standard Contractual Clauses |
| Electronic signature2 | |||||
| DocuSeal (docuseal.com) | Electronic signature — running the signing ceremony for documents a firm sends for signature; enabled per organisation from the platform console | United States | The document being signed, in full, together with each signer’s name and email address, and the completed signature certificate and audit trail sent back | Provider's standard terms — no training restriction recorded; no zero-retention term recorded | EU Standard Contractual Clauses |
| Adobe Inc. (Adobe Acrobat Sign) | Electronic signature — alternative signing provider, engaged only on deployments configured for it | United States · European Union | The document being signed, in full, together with each signer’s name and email address, and the signed result returned | Provider's standard terms — no training restriction recorded; no zero-retention term recorded | EU Standard Contractual Clauses |
| Hosting and infrastructure7 | |||||
| Amazon Web Services, Inc. | Hosting — stores the documents you upload and runs the Legalyard applications | United States · European Union · India | Everything the platform stores and runs: your documents and account data at rest | Provider's standard terms — no training restriction recorded; no zero-retention term recorded | EU SCCs + supplementary measures |
| MongoDB, Inc. | Database — holds your account, conversation, document and billing records | United States · European Union · India | Your account, conversation, document and billing records — the primary database | Provider's standard terms — no training restriction recorded; no zero-retention term recorded | EU SCCs + supplementary measures |
| Redis Ltd. (Redis Cloud) | Short-term store — holds recently answered questions, your sign-in session state, and work waiting to run in the background | United States · European Union | Short-lived cached answers and embeddings, session state and queued background jobs | Provider's standard terms — no training restriction recorded; no zero-retention term recorded | EU SCCs + supplementary measures |
| Cloudflare, Inc. | CDN / edge / DDoS protection fronting the public web surfaces (edge SSL termination only; no application data persisted at the edge), and Turnstile human-verification on sign-up where it is the configured captcha provider | United States · Global edge network | Web requests in transit (your IP address and the pages you load); on sign-up, the human-verification token and your IP address when Turnstile is in use | Provider's standard terms — no training restriction recorded; no zero-retention term recorded | EU SCCs + supplementary measures |
| Vercel Inc. | Custom-domain provisioning — registering and verifying the domain a firm chooses for its client portal; engaged only on deployments configured for custom domains | United States · Global edge network | The custom domain name your firm asked us to serve your client portal on, so the certificate and DNS records can be issued; no documents, messages or account records | Not applicable — No prompts, documents or search queries reach this party; it receives a domain name to provision and verify, and nothing else. A content-retention posture therefore does not apply. How long it keeps what it does receive is set by its own published terms, which have not been read. | EU Standard Contractual Clauses |
| Functional Software, Inc. (Sentry) | Error monitoring and performance tracing for the backend API and the Legalyard AI web app | United States · European Union | Crash and error diagnostics (exception type, message and stack trace), HTTP route and status code, and performance span timing — never a request body, cookie, auth header, GenAI prompt or completion, or the arguments of a logged message | Not applicable — No prompts, documents or search queries reach this party; it receives crash/error diagnostic metadata and performance span timings, scrubbed of request bodies, cookies, auth headers, query strings, GenAI prompts/completions and the raw arguments of any logged message. A content-retention posture therefore does not apply. How long it keeps what it does receive is set by its own published terms, which have not been read. | EU Standard Contractual Clauses |
| PostHog Inc. | Product analytics (page views, feature usage) for the Legalyard AI web app | United States | Page-view and feature-usage events keyed to your account id — never your email, name, a document, a chat message, session replay, or the text/attributes of anything on the page | Not applicable — No prompts, documents or search queries reach this party; it receives product-analytics events (page views, feature usage) identified only by account id, with session recording, DOM text/attribute autocapture and clipboard capture disabled. A content-retention posture therefore does not apply. How long it keeps what it does receive is set by its own published terms, which have not been read. | EU Standard Contractual Clauses |
| Payments2 | |||||
| Paddle.com Market Limited (Merchant of Record) | Payments — merchant of record for Legalyard AI subscriptions and credit packs bought on the web outside India; payment details are entered on Paddle-hosted checkout and never reach Legalyard | United Kingdom · United States · Ireland · Canada | Email address, invoice or business name, tax identifier, billing country and postcode; card details go to Paddle directly | Not applicable — No prompts, documents or search queries reach this party; it receives the billing identity needed to sell you a subscription and issue a tax invoice. A content-retention posture therefore does not apply. How long it keeps what it does receive is set by its own published terms, which have not been read. | EU Standard Contractual Clauses |
| Razorpay Software Limited (payment aggregation by Razorpay Payments Private Limited) | Payments — checkout for Legalyard AI subscriptions and credit packs bought on the web from India; payment details are entered in Razorpay checkout and never reach Legalyard | India | Email address, invoice name and GSTIN; payment instrument details go to Razorpay directly | Not applicable — No prompts, documents or search queries reach this party; it receives the billing identity needed to take a payment and issue a GST invoice. A content-retention posture therefore does not apply. How long it keeps what it does receive is set by its own published terms, which have not been read. | DPDPA 2023 consent + cross-border transfer notice |
| Identity and sign-in4 | |||||
| Google LLC (Sign in with Google) | Identity — Sign in with Google and Google One Tap on the web and mobile apps | United States | Your Google sign-in happens with Google; Legalyard receives your email address, name and a stable account identifier from Google | Not applicable — No prompts, documents or search queries reach this party; it receives your sign-in and the identity it returns. A content-retention posture therefore does not apply. How long it keeps what it does receive is set by its own published terms, which have not been read. | EU Standard Contractual Clauses |
| Apple Inc. (Sign in with Apple) | Identity — Sign in with Apple on the web and mobile apps | United States | Your Apple sign-in happens with Apple; Legalyard receives your email address (or Apple relay address) and a stable account identifier from Apple | Not applicable — No prompts, documents or search queries reach this party; it receives your sign-in and the identity it returns. A content-retention posture therefore does not apply. How long it keeps what it does receive is set by its own published terms, which have not been read. | EU Standard Contractual Clauses |
| Microsoft Corporation (Microsoft Entra ID) | Identity — Sign in with a Microsoft account on the web and mobile apps | United States · European Union | Your Microsoft sign-in happens with Microsoft; Legalyard receives your email address, name and a stable account identifier from Microsoft | Not applicable — No prompts, documents or search queries reach this party; it receives your sign-in and the identity it returns. A content-retention posture therefore does not apply. How long it keeps what it does receive is set by its own published terms, which have not been read. | EU Standard Contractual Clauses |
| LinkedIn Corporation (LinkedIn Ireland Unlimited Company for members in the EU, EEA, Switzerland and UK) | Identity and social publishing — Sign in with LinkedIn, and posting to LinkedIn when you connect your account and choose to share | United States | For sign-in: your email address and a stable account identifier returned by LinkedIn. For sharing: the text and link of the post you chose to publish, sent under the LinkedIn access you granted | Not applicable — No prompts, documents or search queries reach this party; it receives your sign-in identity and any post you explicitly choose to publish there. A content-retention posture therefore does not apply. How long it keeps what it does receive is set by its own published terms, which have not been read. | EU Standard Contractual Clauses |
| Push notifications3 | |||||
| Apple Inc. (Apple Push Notification service) | Push notifications — delivery to iPhone and iPad apps, and to Safari for web push | United States | For the iOS app: your device push token and the notification title and text. For Safari web push: the browser push endpoint it issued to you and a notification payload that is encrypted to your browser before it leaves Legalyard, so the service cannot read it | Not applicable — No prompts, documents or search queries reach this party; it receives a device token and the notification text it is asked to deliver. A content-retention posture therefore does not apply. How long it keeps what it does receive is set by its own published terms, which have not been read. | EU Standard Contractual Clauses |
| Google LLC (Firebase Cloud Messaging) | Push notifications — delivery to Android apps, and to Chrome and other Chromium browsers for web push | United States | For the Android app: your device registration token and the notification title and text. For Chrome web push: the browser push endpoint it issued to you and a notification payload that is encrypted to your browser before it leaves Legalyard, so the service cannot read it | Not applicable — No prompts, documents or search queries reach this party; it receives a device token and the notification text it is asked to deliver. A content-retention posture therefore does not apply. How long it keeps what it does receive is set by its own published terms, which have not been read. | EU Standard Contractual Clauses |
| Mozilla Corporation (Firefox push service) | Push notifications — delivery to Firefox for web push | United States | For Firefox web push: the browser push endpoint it issued to you and a notification payload that is encrypted to your browser before it leaves Legalyard, so the service cannot read it | Not applicable — No prompts, documents or search queries reach this party; it receives a push endpoint your browser issued and an encrypted payload it cannot read. A content-retention posture therefore does not apply. How long it keeps what it does receive is set by its own published terms, which have not been read. | No cross-border transfer instrument — same jurisdiction, or a destination chosen by your own device |
| Email delivery5 | |||||
| Amazon Web Services, Inc. (Amazon SES) | Email delivery — the primary outbound transport for every email Legalyard sends, engaged whenever this deployment has AWS credentials configured | United States · European Union · India | Your email address and the subject and full body of every email Legalyard sends you, including sign-in codes, password resets and payment receipts | Provider's standard terms — no training restriction recorded; no zero-retention term recorded | EU SCCs + supplementary measures |
| Postmark (postmarkapp.com), operated by ActiveCampaign, LLC | Inbound email — receiving and parsing mail sent to a firm’s Legalyard assistant address, then handing it to the platform; engaged only on deployments configured to receive inbound mail | United States | Every message sent to your firm’s Legalyard assistant address: the sender’s address, the subject, the full body and any attached files | Provider's standard terms — no training restriction recorded; no zero-retention term recorded | EU Standard Contractual Clauses |
| The Rocket Science Group LLC d/b/a Mailchimp (an Intuit company) — Mailchimp Transactional | Email delivery — optional transactional email transport, engaged only on deployments where it is configured in the email route | United States | Your email address and the subject and full body of the email Legalyard sends you | Not applicable — No prompts, documents or search queries reach this party; it receives the emails it is asked to deliver to you. A content-retention posture therefore does not apply. How long it keeps what it does receive is set by its own published terms, which have not been read. | EU Standard Contractual Clauses |
| Google LLC (Gmail / Google Workspace SMTP relay) | Email delivery — the generic SMTP relay, engaged only on deployments whose SMTP configuration points at Google, where it carries every message the primary transport does not | United States · Global — Google-operated data centres | Your email address and the subject and full body of every email Legalyard relays through it, including sign-in verification codes, password-reset links and payment receipts | Not applicable — No prompts, documents or search queries reach this party; it receives the emails it is asked to relay to you, which it holds in the sending mailbox. A content-retention posture therefore does not apply. How long it keeps what it does receive is set by its own published terms, which have not been read. | No cross-border transfer instrument — same jurisdiction, or a destination chosen by your own device |
| Zoho Corporation (Zoho Mail SMTP relay, India region) | Email delivery — the generic SMTP relay, engaged only on deployments whose SMTP configuration points at Zoho's India-region mail servers (zoho.in), where it carries every message the primary transport does not | India · India — Zoho-operated data centres (zoho.in region) | Your email address and the subject and full body of every email Legalyard relays through it, including sign-in verification codes, password-reset links and payment receipts | Not applicable — No prompts, documents or search queries reach this party; it receives the emails it is asked to relay to you, which it holds in the sending mailbox. A content-retention posture therefore does not apply. How long it keeps what it does receive is set by its own published terms, which have not been read. | DPDPA 2023 consent + cross-border transfer notice |
| Human verification1 | |||||
| Intuition Machines, Inc. (hCaptcha) | Human verification on sign-up where hCaptcha is the configured captcha provider | United States | The human-verification token from your device and your IP address | Not applicable — No prompts, documents or search queries reach this party; it receives a verification token and your IP address. A content-retention posture therefore does not apply. How long it keeps what it does receive is set by its own published terms, which have not been read. | EU Standard Contractual Clauses |
| Social publishing1 | |||||
| X Corp. | Social publishing — posting to X when you connect your account and choose to share | United States | The text and link of the post you chose to publish, sent under the X access you granted | Not applicable — No prompts, documents or search queries reach this party; it receives only a post you explicitly choose to publish there. A content-retention posture therefore does not apply. How long it keeps what it does receive is set by its own published terms, which have not been read. | EU Standard Contractual Clauses |
| Other services1 | |||||
| Unsplash Inc. | Stock-image search for the document editor; engaged only on deployments configured for it | Canada · United States | The words you type when searching for an image, and a note that a particular image was used; none of your documents or account details | Provider's standard terms — no training restriction recorded; no zero-retention term recorded | EU Standard Contractual Clauses |