Privacy & security
Policy version 2026-08-01. Target platform rules for personal data and documents. The live app is still largely in demo mode — see the principles below as the design we are building toward, not a claim that every control is already enforced in production.
Target principles
- Lawful basis recorded for each processing purpose (contract, consent, etc.).
- Document IDs are opaque UUIDs — not sequential or guessable.
- Documents are ACL-protected; enumeration returns 404, not 403.
- Files live in a private bucket; downloads use short-lived signed URLs.
- Audit logs record access without storing document bodies or raw IP.
- Data subject rights: access, portability, erasure, rectification, restriction.
- Retention defaults: 2555 days post-close for contract files; 365 days for audit events.
Authentication
Production auth is intended to be Supabase Auth (email magic link / OAuth) with row-level security. Local demo mode uses mock accounts until NEXT_PUBLIC_SUPABASE_* is set.
Marketplace note
legalese.me facilitates contracts and counsel matching. AI triage assists classification only — it is not legal advice. Paid review is scoped by engagement with a human lawyer. Full Privacy Policy and Terms will be published before a public launch.
Manage your privacy requests (signed in).