Notice pursuant to Articles 13 and 14 of Regulation (EU) 2016/679

1. General information

This Privacy Policy describes how Legalcap Technologies, Inc. processes personal data in connection with Legalcap., a software-as-a-service platform that uses artificial intelligence systems to support and automate legal work.

Among other features, Legalcap allows users to conduct legal research through a proprietary database, draft pleadings, contracts and legal opinions, analyze and review contracts, create personal knowledge bases that can be queried via chat, organize work into matters, and invite other users to collaborate.

Legalcap. uses agentic features designed to support the lawyer's logical and argumentative reasoning and to progressively adapt outputs to the writing style of the user or the firm, within the limits described in this notice.

This notice covers:

• browsing the website and the public pages of Legalcap;
• requests for demos, informational materials, sales contacts or support;
• the creation and management of accounts;
• the use of the Legalcap platform;
• the uploading, processing, analysis and storage of documents, pleadings, contracts, legal opinions, matters and personal knowledge bases;
• interactions with artificial intelligence-based features;
• informational, educational and marketing communications;
• job applications and collaborations with Legalcap Technologies, Inc.

Access to and use of Legalcap. are also governed by the Terms and Conditions, by the Data Processing Agreement, where applicable, and by any specific notices made available for individual features.

2. Data controller and privacy contact

Legalcap Technologies, Inc. is the controller of personal data processed for its own purposes relating to the website, account management, the contractual relationship, security, billing, marketing, support, job applications and the administration of the Services.

For any request relating to the protection of personal data, you may write to: info@legalcap.ai

3. Privacy roles: controller and processor

Legalcap. may process personal data in different roles, depending on the purpose.

Legalcap Technologies, Inc. acts as an independent controller when it processes personal data for its own purposes, for example to:

• operate the website and browsing;
• create and administer accounts;
• enter into and perform the contract with the user or customer;
• issue invoices and manage payments;
• ensure security, fraud prevention and service continuity;
• send informational, operational or marketing communications;
• handle support requests;
• analyze aggregated statistical data on platform usage;
• comply with legal obligations;
• establish, exercise or defend legal claims.

By contrast, Legalcap Technologies, Inc. generally acts as a processor within the meaning of Article 28 GDPR when it processes, on behalf of the customer, personal data contained in documents, prompts, pleadings, contracts, matters, personal knowledge bases or other content uploaded by the user to the platform.

In such cases:

• the customer or professional user remains the controller of the personal data contained in its documents;
• Legalcap Technologies, Inc. processes such data solely to provide the requested features;
• the processing is governed by the Data Processing Agreement, where applicable;
• Legalcap Technologies, Inc. does not use such data for purposes incompatible with the provision of the service;
• Legalcap Technologies, Inc. does not sell users' documents, prompts, matters or personal knowledge bases.

4. Use of the Services

Legalcap. is intended primarily for professionals, law firms, companies, organizations and legal sector operators.

You may use Legalcap. and validly accept the related Terms and Conditions only if you are of legal age and have the capacity to enter into binding contracts. Unless expressly provided otherwise, Legalcap. is not intended for minors.

5. Legal bases for processing

We process personal data on the following legal bases.

6. Browsing the website

When you browse the website or the public pages of Legalcap, we may automatically collect certain technical data.

This data may include:

• IP address;
• browsing data;
• online identifiers;
• device information;
• browser;
• operating system;
• date and time of access;
• pages visited;
• technical logs;
• information collected through cookies or similar technologies.

We process this data to:

• enable browsing;
• ensure the proper functioning of the website;
• administer our systems;
• protect the website against attacks, unauthorized access, bots, abusive scraping, code injection, DDoS or other risks;
• produce aggregated statistics;
• improve the website and services;
• carry out analytics, marketing or profiling activities only where permitted by applicable law and, when required, subject to consent.

The legal basis is legitimate interest for technical cookies, security and website operation. For non-technical analytics cookies, advertising cookies, profiling or retargeting, the legal basis is consent, where required. For more information, please see the Cookie Policy.

7. Contact forms, demos and resources

If you fill out a form to request a demo, a sales contact, a free trial, informational materials, resources, guides, a prompt library, webinars or similar content, we may process:

• first and last name;
• business email;
• phone number;
• firm, company or organization;
• professional role;
• area of interest;
• content of the request;
• any additional information you enter in the form.

We process this data to:

• respond to your request;
• arrange a demo or a call;
• provide you with informational materials;
• activate any trial periods;
• give you useful information about Legalcap;
• manage pre-contractual negotiations.

The legal basis is the performance of pre-contractual measures requested by the data subject. For subsequent marketing communications not strictly related to your request, we will rely on consent where required or on legitimate interest within the limits permitted by applicable law.

8. Account creation and management of the contractual relationship

When you create an account, activate a free trial, subscribe to a plan or use Legalcap, we process the data necessary to manage the contractual relationship.

This data may include:

• first and last name;
• email;
• password or authentication credentials;
• professional role;
• firm, company or organization;
• address, registered office, tax code (codice fiscale), VAT number, certified email (PEC) and recipient code (codice destinatario), where applicable;
• billing data;
• plan purchased;
• subscription status;
• payment data;
• access history;
• account settings;
• workspaces, matters and permissions;
• invited users;
• data relating to platform usage;
• support requests;
• feedback, comments, suggestions or reports.

We process this data to:

• create and manage the account;
• activate and provide the Services;
• manage free trials, orders, renewals, upgrades and cancellations;
• manage billing and payments;
• provide technical support;
• ensure account security;
• demonstrate proper performance of the contract;
• improve Legalcap through aggregated statistics, feedback and internal analysis.

The legal basis is the performance of the contract or of pre-contractual measures. For improving the service through aggregated statistical data and feedback, the legal basis is our legitimate interest. For tax and accounting obligations, the legal basis is legal obligation.

9. Login through third-party platforms

Legalcap may allow access through federated login systems, for example Google, Microsoft or other authentication providers.

In that case, the provider may share certain data with us, such as:

• first and last name;
• email address;
• profile picture;
• account identifier;
• preferred language;
• technical access data.

We use this data to identify you, create or manage your Legalcap. account and enable you to access the platform.

The legal basis is the performance of the contract and, where required, the consent given to the authentication provider.

Changing or deleting data in your Legalcap. account does not automatically change or delete the data held by the external provider. To exercise your rights with respect to such data, you will also need to contact the relevant provider.

10. Processing of documents, prompts, matters and personal knowledge bases

While using Legalcap, users may enter prompts, upload documents, create matters, draft documents, analyze contracts, create personal knowledge bases and query such content via chat.

Uploaded or generated content may include:

• user prompts and instructions;
• court filings and out-of-court documents;
• contracts;
• legal opinions;
• letters, cease-and-desist letters, briefs, appeals, pleadings, minutes and other legal documents;
• documents of clients;
• documents of opposing parties;
• policies and internal documents;
• legal scholarship, case law, notes, forms and templates lawfully held by the user;
• matters and related organizational information;
• personal knowledge bases created by the user;
• outputs generated by the platform;
• notes, comments, feedback and corrections.

Such data is processed to:

• provide legal research;
• analyze or review documents;
• draft pleadings, contracts and legal opinions;
• extract relevant information;
• compare versions;
• identify clauses, inconsistencies, risks or points requiring review;
• enable consultation via chat;
• organize work into matters;
• enable collaboration among invited users;
• personalize outputs according to the user's preferences and writing style;
• ensure security, technical traceability and proper functioning of the platform.

When such content contains personal data of clients, opposing parties or other third parties, Legalcap Technologies, Inc. generally processes it as a processor on behalf of the customer.

Users are advised to upload only documents and data that are necessary for the professional purpose pursued and, where possible, to anonymize or minimize unnecessary personal data.

11. Third-party data, sensitive data and criminal records data

Legalcap. may process personal data of third parties contained in documents or prompts uploaded by users.

Such individuals may include:

• clients;
• opposing parties;
• witnesses;
• employees;
• contractors;
• directors;
• shareholders;
• suppliers;
• consultants;
• individuals involved in judicial or out-of-court proceedings;
• other third parties mentioned in the documents.

Documents may also contain special categories of personal data within the meaning of Article 9 GDPR, such as data concerning health, religious beliefs, political opinions, trade union membership, racial or ethnic origin, sex life or sexual orientation.

They may also contain data relating to criminal convictions, offenses or security measures within the meaning of Article 10 GDPR.

Legalcap. processes such data only to the extent necessary to provide the features requested by the user and in accordance with the instructions received from the customer, where Legalcap Technologies, Inc. acts as a processor.

In particular:

• the user is responsible for the lawfulness of uploading and processing third-party data;
• the user must verify that it has an adequate legal basis to upload and process such data through Legalcap.;
• Legalcap. applies enhanced security, segregation and access control measures;
• Legalcap. does not sell data uploaded by users;
• Legalcap. does not make one customer's documents or personal knowledge bases available to other customers;
• each user may access only the workspaces, matters, documents and knowledge bases for which it has authorization.

Given the potentially sensitive nature of the data processed, Legalcap. applies a privacy by design and privacy by default approach.

12. Legalcap. database and personal knowledge bases

Legalcap. may make available to the user a proprietary database organized for legal research and drafting support purposes.

The Legalcap database may include legal materials, templates, public sources, institutional sources, selected content and content processed or organized by subject matter.

Legalcap. may also allow the user to create personal knowledge bases, into which the user can upload its own or its firm's documents to be consulted via chat and used as a knowledge base for generating personalized outputs.

Personal knowledge bases:

• are kept separate from those of other customers;
• are not shared with other customers;
• are accessible only to users authorized by the customer;
• are used to generate outputs, research and answers relating to the user's workspace or matter;
• may contribute to personalizing the user's style and professional context, within the configured and permitted limits.

The user must ensure that the documents uploaded to personal knowledge bases are lawfully held and may lawfully be processed through Legalcap.

13. AI features, agentic systems and style personalization

Legalcap. uses artificial intelligence systems and agentic features to support complex legal tasks.

Features may include:

• automated document analysis;
• assisted legal research;
• generation of draft pleadings, contracts and legal opinions;
• contract review;
• extraction of clauses and relevant information;
• comparison of documents;
• organization of material by matter;
• querying documents via chat;
• argument suggestions;
• support in building logical and legal reasoning;
• progressive adaptation to the writing style of the user or the firm.

Style personalization serves to make outputs more consistent with the way the user drafts pleadings, contracts, legal opinions and other legal documents.

To this end, Legalcap. may analyze the user's texts, corrections, preferences, uploaded documents, drafting choices and interactions in order to generate a style profile internal to the workspace or account.

The style profile:

• is used to personalize the user experience;
• is not sold to third parties;
• is not made available to other customers;
• is not used to make decisions producing legal effects on the user or on third parties;
• may be updated, restricted or deleted in accordance with the available features and the rights provided by the GDPR.

Outputs generated by Legalcap. are professional support tools. They do not replace the judgment of the lawyer, the advisor or the qualified user.

The user is always responsible for reviewing, validating and making the final decision on the use of outputs generated by the platform.

14. Training, fine-tuning, benchmarking and product improvement

Legalcap. protects the confidentiality of users' documents, prompts, matters, personal knowledge bases and professional information.

Prompts, documents, matters and personal knowledge bases uploaded by users are excluded from the training of third-party artificial intelligence model providers, within the limits set by the contracts entered into with such providers and by the technical configurations adopted.

Legalcap. does not use users' documents, prompts, matters or personal knowledge bases to train general models shared with other customers, except with express and separate consent or after irreversible anonymization.

Legalcap Technologies, Inc. may use statistical data, feedback, aggregated metrics, anonymized data or content stripped of personal and confidential elements to:

• check the quality of outputs;
• carry out internal benchmarking;
• improve features, security and reliability;
• correct errors;
• develop new features;
• measure performance and accuracy.

When anonymized data is used, it does not allow the user, its clients or other third parties to be identified, directly or indirectly.

15. Technical monitoring, usage metrics and proactive support

Legalcap may monitor, using technical and automated tools, the efficiency of the service and interactions with the platform.

Monitoring may cover:

• features used;
• frequency of use;
• technical errors;
• response times;
• system events;
• usability difficulties;
• process interruptions;
• feedback and ratings provided by the user.

This data is used to:

• ensure the operation of the platform;
• identify and fix technical issues;
• improve the user experience;
• offer support or training on use of the product;
• develop more effective features.

Where possible, such analyses are carried out on aggregated or anonymized data. The content of prompts and documents is not made visible to internal staff except where strictly necessary, for example at the user's request for technical support or for security needs, and in any event in accordance with data minimization and confidentiality principles. The legal basis is our legitimate interest in improving the service, preventing usability difficulties and ensuring security and reliability.

16. Collaboration, workspaces, matters and invited users

Legalcap. allows work to be organized into workspaces, matters and document collections. The user or customer may invite other users to collaborate.

In that case, we may process:

• name, email and role of invited users;
• permissions and access levels;
• membership in workspaces, teams or matters;
• activities carried out on the platform;
• comments, edits, prompts, outputs and interactions;
• technical logs and access history.

The data is processed to:

• enable collaboration;
• manage roles and authorizations;
• ensure security and traceability;
• prevent unauthorized access;
• provide technical support;
• demonstrate contractual compliance.

The customer is responsible for correctly configuring invitations, permissions and access to matters. Invited users may view data, documents and outputs according to the authorizations granted to them.

17. Informational, educational and marketing communications

During the contractual relationship, the trial period or pre-contractual negotiations, we may send you informational and operational communications relating to Legalcap.

Such communications may concern:

• account activation;
• available features;
• product updates;
• release of new features;
• training guidance on use of the platform;
• tips for making better use of Legalcap;
• technical or security issues;
• renewals, payments, billing and administrative matters.

The legal basis is the performance of the contract or of pre-contractual measures, or our legitimate interest in ensuring the proper use and improvement of the service.

We may also send you marketing and promotional communications, event invitations, materials or offers relating to Legalcap. or to other products of Legalcap Technologies, Inc., within the limits permitted by applicable law.

You may object at any time to receiving marketing communications by using the unsubscribe link included in the email or by writing to info@legalcap.ai

18. Customer support, including through AI

We may use customer support tools, including artificial intelligence-based systems, to respond to your requests more quickly.

The system may automatically analyze the content of your request to identify the issue, propose a response or route the request to the appropriate human team.

The data processed may include:

• name;
• email;
• account data;
• language;
• browser;
• operating system;
• time zone;
• content of conversations;
• any attachments sent to support.

The legal basis is the performance of the contract, when support is necessary to assist you, or consent where required for specific automated features.

If you believe that an automated response is inaccurate, incomplete or prejudicial, you may request human review by writing to info@legalcap.ai

19. Video calls, demos and transcripts

During demos, sales calls, onboarding, training or support, we may process personal data shared during the call.

Such data may include:

• first and last name;
• email;
• professional role;
• voice;
• image;
• content shared during the call;
• questions, requests and information relating to the use of Legalcap.

If a video call is recorded or transcribed, participants will be informed before or during the call.

Recordings or transcripts may be used to:

• keep track of negotiations;
• take notes;
• handle sales or technical requests;
• improve support;
• document the user's agreements or requests.

The legal basis is the performance of pre-contractual or contractual measures, or our legitimate interest in properly documenting the customer relationship. The user may ask that the recording or transcription be stopped, unless retention is necessary to comply with legal obligations or to protect legal rights.

20. Job applications and collaborations

If you submit an application to work or collaborate with Legalcap Technologies, Inc. or Legalcap., we process the personal data contained in your resume, portfolio, cover letter, LinkedIn profile and subsequent communications.

This data may include:

• first and last name;
• email;
• phone number;
• professional experience;
• education;
• skills;
• links to professional profiles;
• information contained in the resume or portfolio;
• any data necessary to comply with legal obligations in employment matters.

Please do not include in your resume special categories of personal data within the meaning of Article 9 GDPR, unless strictly necessary, for example for the application of targeted employment legislation for persons with disabilities (collocamento mirato).

We process the data to:

• evaluate the application;
• manage the selection process;
• contact you;
• make any offers;
• comply with legal obligations.

The legal basis is the performance of pre-contractual measures, our legitimate interest in selecting qualified personnel and, where applicable, legal obligation.

21. Disclosure of data to third parties

We may disclose personal data to third parties only when necessary to provide Legalcap., comply with legal obligations, protect our rights or ensure the security of the Services.

Recipients may include:

• hosting, cloud and infrastructure providers;
• database and storage providers;
• AI model providers and AI processing infrastructure providers;
• authentication providers;
• payment providers;
• banks and credit institutions;
• CRM, email and marketing tools;
• analytics tools;
• customer support tools;
• legal advisors;
• tax advisors, auditors and accountants;
• recruitment service providers;
• group companies or operating partners of Legalcap Technologies, Inc., where applicable;
• public authorities, supervisory authorities, judicial authorities or law enforcement, when required by law;
• users invited to the workspace or matter, according to the authorizations set by the customer.

Providers that process personal data on our behalf are bound by GDPR-compliant data processing agreements.

To deliver certain AI features, Legalcap may rely on third-party providers of artificial intelligence models or infrastructure. Such providers are selected and contracted so as to limit the use of data to the purposes necessary to provide the service and, where applicable, to exclude the use of users' prompts and documents for training their models.

You may request more information about the categories of providers by writing to info@legalcap.ai

22. International data transfers

Some providers or sub-providers used by Legalcap. may be located outside the European Economic Area.

In such cases, international data transfers take place in compliance with Articles 44 et seq. GDPR and on the basis of appropriate safeguards, including:

• adequacy decisions of the European Commission;
• standard contractual clauses adopted by the European Commission;
• supplementary technical and organizational measures, where necessary;
• other instruments provided for by the GDPR.

Where possible, Legalcap. favors infrastructure and data storage within the European Economic Area. Data will not be transferred to third parties for purposes incompatible with those set out in this Privacy Policy.

23. Data retention

We retain personal data only for as long as necessary for the purposes for which it was collected, unless longer retention periods are required by law.

At the end of the retention periods, data will be deleted, anonymized or kept in restricted form where necessary to comply with legal obligations or protect legal rights.

24. Updating personal data

We ask you to keep your personal data up to date.

You represent and warrant that the data provided to Legalcap. is correct, up to date, truthful and relevant.

You may update your account data through the features available on the platform or by contacting us at info@legalcap.ai.

25. Data security

Legalcap adopts appropriate technical and organizational measures pursuant to Article 32 GDPR to protect personal data against loss, misuse, unauthorized access, disclosure, alteration or destruction.

Given the legal, professional and potentially sensitive nature of the data processed, Legalcap. applies enhanced security measures, including:

• encryption of data in transit;
• encryption of data at rest, where applicable;
• role- and authorization-based access controls;
• logical segregation of workspaces, matters and personal knowledge bases;
• secure authentication;
• monitoring of access and security events;
• technical logging;
• internal incident management procedures;
• restriction of internal access on a need-to-know basis;
• backup and business continuity measures;
• assessment of providers that process personal data;
• confidentiality agreements with authorized staff and contractors;
• measures to reduce unnecessary exposure of sensitive, criminal records or confidential data.

Users can contribute to security by choosing strong passwords, protecting their credentials, limiting invitations to authorized individuals only and correctly configuring access permissions for matters, workspaces and personal knowledge bases.

Although we adopt appropriate and enhanced measures, no information system can guarantee absolute security.

26. Automated processing and human oversight

Legalcap uses artificial intelligence systems to generate outputs, suggestions, analyses and drafts.

Such outputs do not automatically produce legal effects on data subjects and do not constitute automated decisions within the meaning of Article 22 GDPR.

Outputs are support tools and must always be reviewed by a qualified human operator before being used in a professional, judicial, out-of-court or contractual context.

Legalcap may provide sources, references, lines of argument or verification elements when available, in order to facilitate review by the user.

Any personnel selection activities are not carried out through solely automated decisions.

27. User rights

You may exercise the rights provided by the GDPR by writing to info@legalcap.ai.

We may ask you to verify your identity before acting on your request.

You have the right to:

• obtain confirmation as to whether or not your personal data is being processed;
• access your personal data and information relating to the processing;
• request rectification of inaccurate data;
• request completion of incomplete data;
• request erasure of data in the cases provided for by Article 17 GDPR;
• request restriction of processing in the cases provided for by Article 18 GDPR;
• object to processing based on legitimate interest on grounds relating to your particular situation;
• receive the personal data concerning you in a structured, commonly used and machine-readable format, in the cases and within the limits provided for by Article 20 GDPR;
• transmit such data to another controller, where technically feasible;
• withdraw your consent at any time, without affecting the lawfulness of processing carried out before withdrawal;
• not be subject to decisions based solely on automated processing that produce legal effects concerning you or similarly significantly affect you.

We will respond to requests within the time limits set by the GDPR, generally within 30 days of receipt of the request, subject to extensions permitted by applicable law.

When Legalcap Technologies, Inc. processes data on behalf of the customer as a processor, requests relating to third-party data contained in uploaded documents should generally be addressed to the customer acting as controller. In such cases, we will cooperate with the customer as provided in the Data Processing Agreement.

28. Complaints

If you have questions about the processing of your personal data or wish to exercise your rights, you may contact us at:

info@legalcap.ai

You also have the right to lodge a complaint with the competent supervisory authority.

29. Additional information for California residents

This section applies only to users who are California residents, where the California Consumer Privacy Act, as amended, applies.

Under California privacy law, we may collect the following categories of personal information:

• identifiers, such as name, email, IP address and online identifiers;
• account and profile data;
• commercial information, such as plan purchased and payment history;
• professional information, such as role, firm or organization;
• internet or other network activity information;
• approximate geolocation data;
• content provided by the user, including documents, prompts, matters and communications;
• inferences relating to usage preferences or writing style;
• sensitive personal information, only if contained in documents uploaded by the user or necessary to provide the requested service.

We do not use or disclose sensitive personal information for purposes other than those permitted by applicable law, including to:

• provide the requested Services;
• ensure security and integrity;
• prevent fraud or unlawful conduct;
• comply with legal obligations;
• provide support;
• provide services through providers bound by contractual obligations.

California residents may have the right to:

• know the categories of data collected;
• access personal data;
• request deletion;
• request correction;
• opt out of the sale or sharing of data, where applicable;
• not be discriminated against for exercising their rights.

Legalcap does not sell personal data in the traditional sense. However, certain advertising or analytics technologies may be considered “sharing” or a “sale” under California law, where applicable. To exercise your rights, you may write to: info@legalcap.ai