Privacy Policy

Effective date: September 6, 2026

This Privacy Policy explains how IDT Solutions LLC, a Florida limited liability company of 4996 SW 134th Ave, Miramar, FL 33027, trading as YourLegalAITools (“we,” “us,” or “our”), collects, uses, discloses, retains, and safeguards information in connection with the website at yourlegalaitools.com and the related evidence-extraction and matter-analysis services (collectively, the “Service”). By creating an account or using the Service, you acknowledge the practices described here.

1. Information we collect

Account information

When you register, our identity provider (Amazon Cognito) stores your name, email address, and authentication credentials. We do not store your password in plaintext.

Firm and account structure

If you create or join a firm, we store the firm’s name, its members, each member’s role and permissions, the matters you create, and who is assigned to each matter.

Uploaded content (“Customer Data”)

Customer Data means everything you upload and everything we generate from it. Different tools retain it for different periods, and each tool states its retention before you use it (see “Data retention”):

• Evidence extraction: the backup files you upload and the reports we generate from them. These may contain message text, timestamps, phone numbers, contact names, and attachment metadata. They are automatically and permanently deleted from active storage 24 hours after creation.
• Matter documents: documents you add to a matter, the text extracted from them, the passage index built from that text, and any analysis produced from it. These are retained for the life of the matter and are deleted when you delete the document or the matter — they are not deleted on a timer.

Decryption keys

If you provide a WhatsApp decryption key, it is held only transiently in memory and a short-lived secret to perform the extraction. It is never written to our database and never logged, and it is destroyed as soon as the job completes or the 24-hour window closes.

Payment information

Payments are processed by Stripe. We do not receive or store your full card number. We retain payment metadata (amount, status, timestamp, what was unlocked, and any promotional code applied) for accounting and audit purposes.

Operational records

We retain a non-content audit record of each job — integrity hashes, message counts, source file name and size, provenance header, and timestamps — even after the underlying files are purged.

Technical data

Standard server and security logs (such as request metadata and error diagnostics) and authentication tokens stored in your browser to keep you signed in.

2. How we use information

• To provide, operate, secure, and improve the Service;
• To perform the extraction or analysis you request and generate your reports;
• To determine which members of your firm may access a given matter;
• To process payments and apply discount codes;
• To maintain an auditable, tamper-evident record of extractions;
• To communicate with you about your account, transactions, and support requests;
• To detect, prevent, and respond to fraud, abuse, and security incidents;
• To comply with legal obligations and enforce our Terms.

We do not sell your personal information or Customer Data, and we do not use Customer Data to train machine-learning models.

3. Data retention & deletion

• Evidence-extraction uploads and generated reports: permanently deleted from storage 24 hours after creation, via an automated lifecycle rule plus a scheduled cleanup process. You may also delete them manually at any time.
• Matter documents, their indexed passages, and matter analyses: retained for the life of the matter. There is no automatic time-based purge — retention is under your control.
• When you delete: deleting a document removes the file, every earlier version of it, and the passages indexed from it. Deleting a matter removes every document, version, indexed passage and generated report. Content is removed from the Service immediately and purged from storage within 24 hours. Encrypted database backups may retain document metadata and generated analysis for up to 35 days, after which they roll off; they are used only to recover from a failure.
• What we keep after you delete: the billing record — what was charged, the rate applied, and the name and dates of the matter it related to, marked as deleted by you. We keep it so a charge on your invoice can always be explained, and because we are required to retain financial records. It contains no document text and no analysis.
• Decryption keys: destroyed on job completion or at the 24-hour boundary, whichever is first.
• Audit records and payment metadata: retained for as long as needed for accounting, legal, and audit purposes.
• Account information: retained until you delete your account.

4. How information is shared

We share information only with service providers (“sub-processors”) that help us run the Service, and only as needed:

• Amazon Web Services — cloud hosting, storage, database, authentication, and compute;
• Amazon Bedrock (an AWS service) — the AI models used for matter analysis. Content sent to Bedrock is processed within our AWS account, is not shared with any third-party model vendor, and is not used to train the models;
• Stripe — payment processing.

The complete, current list — including what each one can touch and where it operates — is published at /subprocessors, with at least 30 days’ notice before any addition.

We may also disclose information if required by law, subpoena, or other legal process, or to protect the rights, safety, and security of users, the public, or YourLegalAITools. If we are involved in a merger, acquisition, or asset sale, information may be transferred subject to this Policy.

5. Security

We use industry-standard safeguards, including encryption in transit and at rest, private storage with short-lived access links, least-privilege access controls, and per-firm and per-matter isolation — each matter’s indexed passages are held in a separate index, so a search can only reach the matter it was run against. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

6. Your choices & rights

You can access and update your profile, change your password, enable multi-factor authentication, download your extraction reports during the 24-hour window, delete files and matter documents immediately, and delete your account from the account dashboard. Depending on your jurisdiction, you may have rights to access, correct, delete, or restrict processing of personal data; to exercise them, contact us at the address below.

7. Cookies & local storage

We use browser local storage to hold authentication tokens that keep you signed in. We do not use third-party advertising or cross-site tracking cookies.

8. International users

The Service is operated in the United States. If you access it from elsewhere, you consent to the transfer and processing of information in the United States.

9. Children

The Service is intended for legal and business professionals and is not directed to anyone under 18. We do not knowingly collect information from children.

10. Changes to this Policy

We may update this Policy from time to time. Material changes will be posted here with a revised effective date. Continued use after changes constitutes acceptance.

11. Data protection terms

If you are a firm uploading personal data, our Data Processing Addendum applies and forms part of your agreement with us. It sets out our obligations as your processor, including a 72-hour breach-notification commitment.

12. Contact

IDT Solutions LLC, 4996 SW 134th Ave, Miramar, FL 33027, United States.

Questions, data-subject requests, and security enquiries: ap@idtsol.com or +1 954-604-4098. You can also use our contact form.