Privacy Policy

1.Roles and Responsibility

When UseABI Acts as a Controller. This Policy applies when UseABI determines the purposes and means of processing personal data, such as when we collect account information from users, process Site visitor data, or communicate with prospective clients.

When UseABI Acts as a Processor. Our Services are offered to law firms and other legal entities for professional use (our “Subscribers”). When Subscribers upload documents, provide deal context, or receive analysis output through our platform (“Client Content”), UseABI processes that content as a data processor on behalf of the Subscriber. Our processing of Client Content is governed by the applicable Subscriber Agreement and Data Processing Agreement (“DPA”), not this Policy. Inquiries related to personal data contained within Client Content should be directed to the relevant Subscriber.

Privileged Materials. Client Content may be subject to attorney-client privilege, work product doctrine, and other legal protections. UseABI acknowledges these protections and maintains confidentiality consistent with them. Our processing of Client Content does not constitute a waiver of any privilege.

2.Information We Collect

2.1Information Provided to Us

Account Information. Access to our platform is available through Subscriber-managed accounts. When you or your employer creates or provisions an account, we collect your name, email address, firm affiliation, and role.

Communication Information. When you contact us for support, provide feedback, submit inquiries, or request a demo, we collect your name, email address, and the content of your communications.

2.2Information Collected Automatically

When you visit our Site or use our Services, we automatically collect certain technical information:

Log and Device Data. IP address, browser type and version, operating system, device type, referring URLs, pages visited, date and time of access, and time spent on pages.

Usage Data. Features used, actions taken, frequency and duration of use, and time zone.

Operational and Performance Data. We collect operational data related to the performance of our Services, including processing metrics, error reports, system performance information, and diagnostic data. This data is used to operate, maintain, debug, and improve the reliability and quality of our Services.

2.3Cookies and Similar Technologies

Our Site uses cookies and similar technologies for the following purposes:

Essential Cookies. Required for the Site and Services to function, including authentication and session management. These cannot be disabled.

Analytics. We use analytics services to understand how visitors interact with our Site, including pages visited, traffic sources, and aggregate usage patterns. Depending on the service in use, this may involve cookies or similar technologies, or may be performed on a cookieless basis. We do not enable advertising, remarketing, or interest-based advertising features within our analytics tools, and we do not use analytics data to build profiles of individual visitors.

Current practice. Our Site uses analytics that operate without cookies and do not track visitors across websites. Aside from essential cookies described above, we do not set cookies on the Site. If we adopt analytics or other technologies that set non-essential cookies, we will update this Policy and provide a cookie consent mechanism where required by applicable law.

You can manage cookie preferences through your browser settings. Disabling non-essential cookies may affect certain features of the Site. We honor Global Privacy Control and other opt-out preference signals recognized under applicable law. For questions about the cookies we use, contact legal@useabi.ai.

2.4Information from Other Sources

We may receive information about you from Subscribers (such as your name and email to provision your account), from our service providers, and from publicly available sources. We may combine this information with information we collect directly.

3.How We Use Your Information

We use the personal information we collect for the following purposes:

• Providing, operating, maintaining, and improving our Services, including user account management and authentication;
• Operating, maintaining, debugging, and improving the reliability, quality, and performance of our platform, including through internal analysis of operational and performance data;
• Communicating with you, including responding to inquiries, providing customer support, and sending service-related notices;
• Detecting, preventing, and addressing security incidents, fraud, and technical issues;
• Enforcing our legal terms, including our Subscriber Agreements and Data Processing Agreements;
• Complying with applicable laws, regulations, and legal processes;
• Sending marketing and promotional communications about our Services, where permitted by applicable law (you may opt out at any time); and
• Protecting the rights, property, and safety of UseABI, our Subscribers, and others.

4.AI Processing

Our Services use artificial intelligence and large language model technologies to analyze M&A documents and generate structured analysis output for our Subscribers. Output is AI-generated using UseABI’s proprietary M&A analysis framework, applied to Client Content provided by our Subscribers.

No Training on Client Content. We do not provide Client Content to third-party AI service providers for the purpose of training or improving their general-purpose AI models. Our sub-processors that provide AI processing services are contractually bound by the same commitment.

Third-Party AI Providers. We use third-party AI service providers to process Client Content and generate analysis output. Where available, we utilize zero-data-retention or equivalent API configurations offered by these providers. The specific AI providers we use are listed in the applicable DPA.

Professional Tool, Not Legal Advice. AI-generated output is a professional tool designed to assist attorneys. It is not a substitute for legal judgment, does not constitute legal advice, and is subject to attorney review before use or reliance.

Automated Decision-Making. Our automated processing is applied to Client Content, not to personal information collected about individual users under this Policy. AI-generated output does not make legal decisions or produce decisions that have legal or similarly significant effects on individuals. For questions about how automated processing applies to Client Content, please contact your Subscriber.

5.Legal Bases for Processing

Where the General Data Protection Regulation (“GDPR”) or similar laws apply, we rely on the following legal bases:

Where we rely on legitimate interests, we have conducted a balancing assessment and determined that our interests do not override the rights and freedoms of the individuals concerned. You may object to processing based on legitimate interests by contacting us at legal@useabi.ai.

6.How We Share Your Information

We do not sell or share your personal information for cross-context behavioral advertising. We disclose personal information only in the following circumstances:

Service Providers. We engage third-party service providers to help operate and deliver our Services. These providers may include cloud infrastructure and hosting providers, AI and machine learning processing providers, authentication and identity management providers, document processing and parsing providers, and email and communication providers. Each service provider processes personal information on our behalf, under our instructions, and subject to contractual obligations that restrict use of the data to the purposes we specify. Our current list of service providers and sub-processors is available to Subscribers upon request and is maintained in the applicable DPA.

Within Your Organization. Certain information (such as your name, role, and activity within the platform) may be visible to other authorized users within your Subscriber organization, including firm administrators.

Business Transfers. If UseABI is involved in a merger, acquisition, reorganization, bankruptcy, or sale of assets, your personal information may be among the assets transferred to or acquired by a third party. If such a transaction results in a material change in the use of your personal information, you will be notified in accordance with applicable law.

Legal Requirements. We may disclose personal information if required by law, regulation, legal process, or governmental request, or where we believe disclosure is necessary to protect the rights, property, or safety of UseABI, our users, or the public. If we receive a subpoena or legal request for Client Content, we will promptly notify the affected Subscriber to the extent permitted by law.

With Your Consent. We may share your personal information for any other purpose with your express consent.

7.International Data Transfers

UseABI is based in the United States. All data processing and storage occurs within the United States. If you access the Services from outside the United States, your personal information will be transferred to and processed in the United States.

Where required by applicable data protection law (including the GDPR), we implement appropriate safeguards for international transfers of personal data, which may include Standard Contractual Clauses approved by the European Commission, adequacy decisions by the relevant data protection authority, the EU-U.S. Data Privacy Framework where applicable, or your explicit consent where no other safeguard applies. For more information about the transfer safeguards we use, please contact us at legal@useabi.ai.

7.1EU-U.S. Data Privacy Framework

UseABI, Inc. complies with the EU-U.S. Data Privacy Framework (EU-U.S. DPF) as set forth by the U.S. Department of Commerce. UseABI, Inc. has certified to the U.S. Department of Commerce that it adheres to the EU-U.S. Data Privacy Framework Principles (EU-U.S. DPF Principles) with regard to the processing of personal data received from the European Union in reliance on the EU-U.S. DPF. If there is any conflict between the terms in this Privacy Policy and the EU-U.S. DPF Principles, the Principles shall govern. To learn more about the Data Privacy Framework (DPF) Program, and to view our certification, please visit https://www.dataprivacyframework.gov/.

7.2Inquiries and Complaints

In compliance with the EU-U.S. DPF, UseABI, Inc. commits to resolve DPF Principles-related complaints about our collection and use of your personal information. EU individuals with inquiries or complaints regarding our handling of personal data received in reliance on the EU-U.S. DPF should first contact UseABI, Inc. at legal@useabi.ai.

7.3Independent Dispute Resolution

In compliance with the EU-U.S. DPF, UseABI, Inc. commits to refer unresolved complaints concerning our handling of personal data received in reliance on the EU-U.S. DPF to JAMS, an alternative dispute resolution provider based in the United States. If you do not receive timely acknowledgment of your DPF Principles-related complaint from us, or if we have not addressed your DPF Principles-related complaint to your satisfaction, please visit https://www.jamsadr.com/dpf-dispute-resolution for more information or to file a complaint. The services of JAMS are provided at no cost to you.

7.4Federal Trade Commission Enforcement

UseABI, Inc. is subject to the investigatory and enforcement powers of the U.S. Federal Trade Commission (FTC) with respect to our compliance with the EU-U.S. DPF.

7.5Binding Arbitration

Under certain conditions specified by the EU-U.S. DPF Principles, EU individuals may invoke binding arbitration to address complaints concerning UseABI, Inc.’s handling of personal data received in reliance on the EU-U.S. DPF that have not been resolved through the other recourse mechanisms described above. The right to invoke binding arbitration and the applicable procedures are set out in Annex I of the EU-U.S. DPF Principles, available at https://www.dataprivacyframework.gov/.

7.6Onward Transfer Liability

In compliance with the EU-U.S. DPF, UseABI, Inc. remains responsible and liable under the DPF Principles if third-party agents that we engage to process personal data received in reliance on the EU-U.S. DPF on our behalf do so in a manner inconsistent with the DPF Principles, unless we prove that we are not responsible for the event giving rise to the damage.

8.Data Retention

We retain personal information only for as long as necessary to fulfill the purposes described in this Policy, or as required by applicable law:

• Account data is retained for the duration of the Subscriber relationship plus a short administrative period, after which it is deleted.
• Client Content is retained for the duration of the Subscriber relationship and deleted within 90 days of contract termination, or sooner upon Subscriber request. Deletion of Client Content includes all associated analysis output, operational data, and related records.
• Operational and performance data (including system logs, processing metrics, and diagnostic data) is retained for a period necessary to support service operations, debugging, and quality assurance, and is deleted or anonymized in accordance with our internal retention schedules.
• Audit and access logs are retained for a period appropriate to our security and compliance obligations.
• Communication records are retained for a reasonable period to support customer service and legal obligations.

Subscribers may request deletion of their Client Content at any time during the contract term. Deletion confirmation is provided in writing. Specific retention periods and deletion procedures are detailed in the applicable DPA.

When we no longer need personal information, we delete or anonymize it in accordance with our retention policies and applicable law. Where deletion is not immediately possible (for example, data stored in backup archives), we isolate the data from further processing until deletion is completed.

9.Data Security

We implement industry-standard technical and organizational security measures designed to protect personal information against unauthorized access, alteration, disclosure, or destruction, appropriate to the sensitivity of the information we handle. These measures include encryption, access controls, network isolation, and continuous monitoring.

No method of transmission or storage is completely secure. While we strive to protect your information, we cannot guarantee absolute security. For additional information about our security practices, Subscribers may request our Security Overview document or refer to the technical and organizational measures set forth in the DPA.

10.Your Privacy Rights

Depending on your location, you may have certain rights regarding your personal information under applicable data protection laws.

10.1Rights Under the GDPR (EEA/UK Residents)

If you are located in the European Economic Area or the United Kingdom, you have the right to:

Right to Access. You may request a copy of the personal data we hold about you.

Right to Rectification. You may request correction of inaccurate or incomplete personal data.

Right to Erasure. You may request deletion of your personal data, subject to certain legal exceptions.

Right to Restriction. You may request that we restrict processing of your personal data in certain circumstances.

Right to Data Portability. You may receive your personal data in a structured, commonly used, machine-readable format.

Right to Object. You may object to processing based on legitimate interests or for direct marketing.

Right to Withdraw Consent. You may withdraw consent at any time where processing is based on consent.

Right to Lodge a Complaint. You may file a complaint with your local data protection supervisory authority.

10.2Rights Under the CCPA (California Residents)

If you are a California resident, you have the following rights under the California Consumer Privacy Act, as amended (“CCPA”):

Right to Know. You may request disclosure of the categories and specific pieces of personal information we have collected, the sources, the purposes, and the categories of third parties with whom we have shared your information.

Right to Delete. You may request deletion of personal information we have collected from you, subject to certain exceptions.

Right to Correct. You may request correction of inaccurate personal information.

Right to Opt Out. UseABI does not sell or share personal information for cross-context behavioral advertising. No opt-out is necessary.

Right to Limit Use of Sensitive Personal Information. We do not collect or use sensitive personal information as defined by the CCPA for purposes beyond those permitted by law.

Right to Non-Discrimination. We will not discriminate against you for exercising any of your privacy rights.

10.3CCPA Categories of Personal Information

In the preceding 12 months, we have collected the following categories of personal information:

We have not sold or shared personal information in the preceding 12 months. UseABI does not sell personal information in exchange for monetary consideration. We use third-party analytics services on our Site, but we do not enable advertising, remarketing, or interest-based advertising features within those tools, and we do not provide personal information to advertising networks, social media platforms, or data brokers for targeted advertising purposes. To our knowledge, UseABI does not sell or share the personal information of minors under 18 years of age.

10.4Exercising Your Rights

To submit a request, please contact us at legal@useabi.ai. We will respond within the timeframes required by applicable law (generally 30 days under the GDPR and 45 days under the CCPA). We may need to verify your identity before processing your request.

If your personal data is contained within Client Content processed on behalf of a Subscriber, please direct your request to the relevant Subscriber. If we receive such a request directly, we will forward it to the appropriate Subscriber.

11.Other U.S. State Privacy Laws

Residents of other U.S. states with applicable privacy laws (including Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, and others) may have similar rights to access, delete, correct, and opt out of certain processing of their personal information. To exercise these rights, please contact us at legal@useabi.ai. We will process your request in accordance with applicable state law.

12.Children’s Privacy

Our Services are designed for professional use by legal professionals. We do not knowingly collect personal information from individuals under the age of 16. If we become aware that we have collected such information, we will take steps to delete it promptly. If you believe we have inadvertently collected information from a child, please contact us at legal@useabi.ai.

13.Third-Party Links

Our Site or Services may contain links to third-party websites or services. This Policy does not apply to those third-party sites. We encourage you to review the privacy policies of any third-party sites you visit. We are not responsible for the privacy practices of third parties.

14.Changes to This Policy

We may update this Policy from time to time. When we make changes, we will revise the “Last Updated” date at the top of this page. If changes are material, we will provide additional notice as appropriate, such as a notification within the Services or an email to Subscriber administrators. We encourage you to review this Policy periodically. Your continued use of the Services after any changes constitutes your acknowledgment of the updated Policy.

15.Contact Us

If you have questions about this Policy, our data practices, or your privacy rights, please contact us:

For requests related to personal data within Client Content, please contact the law firm or organization that subscribes to our Services.