Privacy Notice

When you create a Zealia account, we collect:

• Full name and professional designation (if any);
• Email address;
• Password;
• Professional information that may include jurisdiction of practice, and firm name where provided;
• Country and state or territory.

Payment processing is handled by our third-party payment processors. We do not store full credit card numbers or financial account credentials on our systems. We retain:

• Subscription plan details and billing history;
• Transaction identifiers assigned by the payment processor;
• Billing address for tax and invoicing purposes.

Zealia’s Vault feature allows you to upload documents related to specific legal matters. This is the most sensitive category of data we process. You may upload:

• Contracts, agreements, and transactional documents;
• Court pleadings, judgments, and cause papers;
• Witness statements, expert reports, and affidavits;
• Client correspondence and instructions;
• Any other document you choose to upload to a matter in the Vault.
• Contracts submitted for Contract Review, the resulting review reports, and the contract playbook positions you configure.

Important notice to legal professionals: You are responsible for ensuring that uploading client documents to Zealia is consistent with your professional confidentiality obligations, applicable privilege rules, and any client instructions regarding data handling. We strongly recommend reviewing your professional responsibility obligations and, where appropriate, obtaining client consent before uploading privileged or confidential client materials.

When you use Zealia’s chat, Trial Toolkit, Narratives, or any other interactive feature, we process:

• The text of your queries and prompts;
• Conversation history within a matter session;
• The AI-generated responses provided to you;
• Source citations retrieved from external databases in response to your query.

We automatically collect limited technical data when you use the Service:

• IP address, collected by our servers when you sign in or perform a security-sensitive action, and in irreversible hashed form to detect abuse and enforce rate limits;
• approximate location (country, and city where available) derived from that IP address by our edge network. We do not use precise or device-based location;
• browser and operating-system information contained in your browser’s user-agent string, recorded with security events;
• a coarse, hashed device signature used solely to prevent repeated free-trial sign-ups from the same device;
• feature-usage events recording which Service features are used and when (for example an AI request or a document upload), collected only if you allow analytics cookies. These events never include the content of your matters, documents or AI conversations;
• credit consumption records for each metered action, used for billing and usage limits; and
• error and diagnostic logs generated when something fails, used to fix faults.

We do not track the pages you browse or how long you spend on them, and we do not collect referring URLs or use advertising or cross-site tracking technologies. IP address and city data are automatically erased 90 days after collection; the related record and its country are kept for security and audit purposes.

We use your personal data to:

• Authenticate your identity and maintain your account;
• Process and respond to your legal research queries;
• Store, index, and retrieve your Vault documents for RAG-based context in AI responses;
• Generate AI-powered legal research outputs, drafts, and analyses;
• Retrieve relevant case law and statutory materials from external legal databases on your behalf;
• Maintain your matter and case file structure within the platform.

• Processing subscription payments and renewals;
• Enforcing plan limits;
• Issuing invoices and receipts;
• Communicating about billing issues, renewals, and payment failures.

• Monitoring for security threats, fraud, and unauthorised access;
• Diagnosing technical errors and improving platform performance;
• Conducting aggregated, anonymised analytics on feature usage patterns.

• We do not use the content of your Vault documents or legal queries to train, fine-tune, or improve any AI or machine learning model, whether our own or any third party’s;
• We do not sell your personal data to any third party;
• We do not share client document content with any party other than the AI processing services described in clause 5 of this Notice, and solely for the purpose of generating your requested output.

• Generating AI responses — your queries and retrieved document context are transmitted to a third-party API to generate AI responses. That provider handles the data only on our instructions and under its API terms, which prohibit use of API inputs for model training without consent;
• Embeddings — document text is transmitted to a third-party embeddings API to generate vector representations for semantic search, again only on our instructions and under our agreement with that provider.

• Your account data, Vault documents, document embeddings, and query logs are stored with a third-party cloud database and object storage provider, operating on enterprise-grade managed PostgreSQL and object storage infrastructure;
• Our document conversion microservice is hosted on third-party cloud application hosting platforms; uploaded files pass through this service transiently during the text extraction process and are not retained by the hosting provider beyond the duration of the conversion task;
• The infrastructure providers described above operate on underlying hyperscale cloud computing platforms, which provide the foundational compute, networking, and storage services upon which the Service’s infrastructure stack is built.

To respond to your legal research queries, your query terms are transmitted to a third-party public legal database operated by a non-profit organisation, for the purpose of retrieving relevant case law and legal authorities. Query terms transmitted to this service are not linked to your identity or account and are processed solely for the purpose of returning relevant search results. This service operates a publicly accessible API and its legal content is made available under open access principles.

Payment card transactions, subscription management, and billing are processed by one or more third-party payment providers incorporated in the United States and/or other jurisdictions, as applicable to your subscription and location. These providers handle all payment card data directly and Apoliticka does not receive or store your full payment card details on its own systems. Each payment provider operates under its own privacy policy and is independently responsible for the personal data it collects in connection with payment processing. Where required, your payment provider may also act as Merchant of Record for transactions, assuming responsibility for tax collection and remittance.

We may disclose your personal data to law enforcement, regulators, or courts where required by applicable law, court order, or legal process. Where permitted by law, we will notify you of such a disclosure.