Privacy Policy

Who we are

Astra for Law is an independent legal technology product operated by JDM Legal Tech. JDM Legal Tech is not a law firm and does not provide legal advice. This policy covers the Astra for Law website and its authenticated workspace.

What leaves your workspace, and when

This is the part that matters most for legal work, so it is stated first. When you send a request, the text of that request and the context you selected for it — which may include passages from documents you uploaded and from your firm-knowledge library — are transmitted to our third-party model provider for processing, and the generated response is returned and stored in your workspace.

Nothing is transmitted to the model provider unless you make a request. Documents you upload but do not select as context for a request are stored in the workspace and are not sent for inference. Uploaded files are processed on our own infrastructure to extract text and divide it into passages. A PDF whose text cannot be read that way — a scan, for instance — is sent to Microsoft Azure AI Document Intelligence for text recognition. Neither step involves the model provider.

OpenAI states that content submitted through its API is not used to train its models by default. That is the provider's representation about its own service, not a guarantee by JDM Legal Tech, and you should read the provider's current terms yourself before submitting sensitive material.

Information we collect

• Account information: name, email address and authentication identifiers, including identifiers from Google or Apple if you sign in with either.
• Workspace content you create or submit: requests and responses, matters and their instructions, uploaded documents and the text extracted from them, firm-knowledge files, document-review runs and their results, workflow runs, templates, playbooks, and work product with its version history.
• Model usage records: per-request token counts, the model used, latency, and an estimated cost, kept as a usage ledger and used to enforce daily limits.
• Product and security data: session information, device and browser details, usage events and error logs.
• Communications you send to us, including support requests.

How we use information

• Operate the authenticated workspace and store your matters, documents and work product.
• Transmit the requests and selected context you submit to the model provider, and return and store the response.
• Enforce daily request and token limits, record usage and cost, and control the operating expense of the service.
• Secure the service, detect and prevent abuse, diagnose errors and improve reliability.
• Respond to your messages and comply with legal obligations.

We do not use your content to train models

JDM Legal Tech does not use your workspace content to train, fine-tune or evaluate any model, and does not sell your content or use it for advertising. We do not read your matters or documents except where strictly necessary to investigate a security incident, diagnose a fault you have reported, or comply with a legal requirement.

Service providers

We rely on a small number of processors, and each can be named:

• OpenAI — model inference. Receives the requests and selected context you submit, and returns the generated response.
• Supabase — authentication, database and private file storage. Holds your account, matters, documents, work product and usage records.
• Vercel — application hosting and delivery. Handles requests to the site and the application.
• Microsoft Azure — text recognition. Receives a PDF file only when its text cannot be read natively, and returns the recognized text.
• Google — identity only, if you choose to sign in with a Google account.
• Apple — identity only, if you choose to sign in with an Apple account.

Legal workspace content and your obligations

You control what you submit. Do not upload privileged or confidential client information: as stated in the Terms of Use and on the security page, retention controls, verified deletion, audit history and independent security assessment are not yet implemented, and the product is a testing environment.

Do not upload information you are not authorized to process. Astra for Law is not a system of record, is not a legal research database, and does not relieve you of your professional confidentiality and supervision obligations.

Retention, export and deletion

Account and workspace information is retained while your account is active and as reasonably necessary to operate the service, meet security and legal obligations, resolve disputes and enforce agreements.

Defined retention windows, automated export and verified deletion are not yet implemented. Work product can be exported from the workspace as a Word document at any time. You may request access, correction or deletion of your information by contacting us, and we will act on the request manually. Some records may persist temporarily in backups or where retention is legally required.

Security

Access requires authentication. Records are owned by the account that created them, enforced by row-level security in the database and by ownership derived from the server-side session rather than from values supplied by the browser. Uploaded files are stored privately and reached through short-lived signed URLs with integrity checks, and traffic is encrypted in transit.

What is not in place is listed on the security page, including audit history, enterprise identity and independent security assessment. No online service can guarantee absolute security.

International transfers

Our providers operate infrastructure in the United States and may process information in other countries. Where information is transferred across borders, it is transferred to operate the service as described in this policy and remains subject to the commitments set out here.

Your choices and rights

Depending on where you live, you may have rights to access, correct, delete, restrict or obtain a copy of personal information, or to object to certain processing. Requests are handled manually at this stage; we may need to verify your identity before acting on one. You can contact us at the address below, and you may stop using the service and request deletion of your account at any time.

Children and changes

The service is intended for legal professionals and is not directed to anyone under 18. We may update this policy as the product develops — in particular as retention, deletion and audit controls are implemented. Material changes will be reflected by a revised effective date and, where appropriate, additional notice.

Contact

For privacy questions or requests, contact JDM Legal Tech at jdm.juridico@gmail.com.