Privacy Policy

1. Introduction

This Privacy Policy describes how Zarlu, Inc. (“Zarlu,” “we,” “us,” or “our”) collects, uses, discloses, and protects your information when you use LawyerAudio (“Service”). We are committed to transparency, especially given that our users are attorneys handling sensitive client information.

By using the Service, you agree to the practices described in this policy. If you do not agree, do not use the Service.

2. Information We Collect

2.1 Account Information

When you register, we collect:

• Name
• Email address
• Firm name (optional)
• Primary practice area (optional)
• Billing information (processed by our payment provider; we do not store full payment card numbers)

2.2 Documents and Content You Upload

When you use the Service, we process:

• PDF documents you upload for script generation
• Draft scripts generated from your documents
• Edits you make to scripts
• Attorney-approved final scripts
• Audio files generated from approved scripts

2.3 Usage Data

We automatically collect:

• Log data (IP address, browser type, operating system, referring URL)
• Service usage patterns (features used, actions taken, timestamps)
• Device information
• Audit trail data (generation, editing, approval, sharing, and listening events)

2.4 Cookies and Tracking Technologies

Our marketing site uses:

• Plausible Analytics — privacy-focused, cookieless web analytics that do not track individual users
• Google Ads conversion tracking — to measure the effectiveness of our advertising (subject to Google’s privacy policies)

The Service application uses:

• PostHog — product analytics to understand how features are used, identify issues, and improve the Service. PostHog collects usage events (such as pages visited, features used, and interactions), device and browser information, and IP address (which may be anonymized). PostHog does not have access to the content of your documents, scripts, or audio files. See PostHog’s privacy policy for details on their data handling practices.
• Essential cookies required for authentication and session management

We do not use third-party advertising cookies within the application.

3. How We Use Your Information

We use your information to:

• Provide the Service — process your documents, generate scripts, produce audio, and enable sharing
• Maintain your account — manage authentication, billing, and subscription status
• Improve the Service — analyze usage patterns (in aggregate) to improve features and performance
• Communicate with you — send service-related notices, respond to support requests, and provide product updates
• Ensure security — detect and prevent fraud, abuse, and unauthorized access
• Comply with law — respond to legal process and enforce our Terms of Service

We do not use your documents or content for:

• Training AI models
• Advertising or marketing purposes
• Sale to third parties
• Any purpose other than providing the Service to you

4. How We Share Your Information

4.1 Third-Party AI Providers

To generate draft scripts and audio, we transmit your documents and approved scripts to third-party AI providers:

These providers:

• Are contractually prohibited from using your data for model training
• Do not retain your data after processing
• Process data under their enterprise/API terms (not consumer terms)

4.2 Infrastructure Providers

4.3 Payment Processing

We use third-party payment processors to handle billing. They receive only the information necessary to process your payments. We do not store full payment card numbers.

4.4 Legal Requirements

We may disclose information if required by law, regulation, legal process, or governmental request, or to protect the rights, safety, or property of Zarlu, our users, or the public.

4.5 Business Transfers

In the event of a merger, acquisition, or sale of assets, your information may be transferred. We will notify you before your information becomes subject to a different privacy policy.

4.6 With Your Consent

We may share information with your explicit consent for purposes not described in this policy.

5. Data Storage and Security

5.1 Where We Store Data

Your data is stored on Amazon Web Services in the United States (Northern Virginia / us-east-1).

5.2 Security Measures

We implement commercially reasonable security measures including:

• Encryption in transit using TLS 1.3
• Encryption at rest for all documents, scripts, and audio files
• Role-based access controls within your firm’s account
• Audit logging of all content generation, editing, approval, and sharing events
• Secure sharing via expiring, revocable links
• Access controls requiring authentication for all Service operations

For more detail, see our Security page.

5.3 No Absolute Guarantee

While we use commercially reasonable safeguards, no method of electronic transmission or storage is 100% secure. We cannot guarantee absolute security.

6. Data Retention

6.1 Your Content

We retain your documents, scripts, and audio files for as long as your account is active or as needed to provide the Service. You may delete content at any time through the Service.

6.2 Account Information

We retain account information for as long as your account is active. After account termination, we retain basic records as necessary for legal, accounting, and compliance purposes.

6.3 Usage and Log Data

Aggregate usage data may be retained indefinitely for analytics purposes. Individual log data is retained for a reasonable period for security and debugging purposes.

6.4 After Termination

Upon account termination, you may request export of your content during a reasonable export window. After the export period, we delete your content from active systems. Backup deletion follows our standard backup rotation schedule.

7. Your Rights and Choices

7.1 Access and Portability

You may access, export, or download your content at any time through the Service.

7.2 Correction

You may update your account information at any time through the Service settings.

7.3 Deletion

You may delete individual content items at any time. You may also request complete account deletion by contacting us at [email protected].

7.4 Communication Preferences

You may opt out of non-essential communications. Service-related notices (such as billing confirmations and security alerts) cannot be opted out of while your account is active.

7.5 Do Not Track

We respect browser Do Not Track signals. Our privacy-focused analytics (Plausible) do not track individual users regardless of this setting.

8. California Privacy Rights (CCPA/CPRA)

If you are a California resident, you have the following rights under the California Consumer Privacy Act and the California Privacy Rights Act:

8.1 Right to Know

You may request that we disclose the categories and specific pieces of personal information we have collected about you, the categories of sources, the business purposes for collection, and the categories of third parties with whom we share it.

8.2 Right to Delete

You may request deletion of your personal information, subject to certain exceptions (such as legal compliance requirements).

8.3 Right to Correct

You may request correction of inaccurate personal information.

8.4 Right to Opt Out of Sale or Sharing

We do not sell your personal information. We do not share your personal information for cross-context behavioral advertising.

8.5 Right to Non-Discrimination

We will not discriminate against you for exercising your privacy rights.

8.6 Exercising Your Rights

To exercise these rights, contact us at [email protected]. We will verify your identity before processing your request. You may also designate an authorized agent to make a request on your behalf.

8.7 Categories of Information

For the purposes of the CCPA/CPRA, we collect the following categories of personal information:

• Identifiers — name, email address, IP address
• Commercial information — subscription plan, billing history
• Internet or electronic network activity — usage data, log data
• Professional information — firm name, practice area
• Inferences — none; we do not create consumer profiles

9. Other State Privacy Laws

We comply with applicable state privacy laws, including those in Virginia (VCDPA), Colorado (CPA), Connecticut (CTDPA), and other states with consumer privacy legislation. If you are a resident of one of these states, you may have similar rights to those described in Section 8. Contact us at [email protected] to exercise your rights.

10. Children’s Privacy

The Service is not directed to individuals under 18. We do not knowingly collect personal information from children. If you believe we have collected information from a child, contact us at [email protected] and we will promptly delete it.

11. International Users

The Service is hosted and operated in the United States. If you access the Service from outside the United States, your information will be transferred to and processed in the United States. By using the Service, you consent to this transfer.

12. Third-Party Links

The Service may contain links to third-party websites or services. We are not responsible for their privacy practices. We encourage you to review the privacy policies of any third-party services you access.

13. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by email or through the Service at least 30 days before they take effect. Your continued use of the Service after the effective date constitutes acceptance of the updated policy.

The “Last updated” date at the top of this page indicates when this policy was most recently revised.

14. Data Protection Contact

For privacy-related inquiries, data subject requests, or complaints:

Zarlu, Inc. Email: [email protected] Support: [email protected]

We aim to respond to all privacy inquiries within 30 days.