Legal

Privacy Policy

Effective date: April 19, 2026 Last updated: April 19, 2026

This Privacy Policy and our Terms of Service are provided in plain language for clarity. They are legally binding documents. If you do not agree, please do not use LawEngine.

A plain-English note before the legal part

Here is the short version of this policy:

  • We collect what we need to run the Service. Your email and name so you can sign in, your IP address in hashed form so we can detect abuse, and the queries and citations you send us — because that is the Service.
  • We do not sell your data. We do not share it with advertisers. We do not track you across the internet.
  • We use a small set of vendors: Clerk for sign-in, Supabase for the account database, Vercel for hosting and web analytics, and Plausible for privacy-friendly product analytics.
  • If you want your data out, or want to know what we have, email stephen@lawengine.ai. A human reads it.

If you want the full version, keep reading.

1. Who we are

This Privacy Policy explains how I'm No Lawyer LLC, an Illinois limited liability company ("Company," "we," "us," or "our"), collects, uses, shares, and protects information in connection with LawEngine (the "Service"), accessible at lawengine.ai.

Questions about this policy or your data can be directed to stephen@lawengine.ai.

2. What we collect

2.1 Information you provide

When you create an account through our authentication provider, Clerk, we collect:

  • Email address
  • First name
  • Last name

If you contact us by email, we collect whatever you choose to include in your message.

2.2 Information we collect automatically

When you use the Service, we collect technical information, including:

  • IP address, stored in hashed form, used for rate-limiting and abuse detection.
  • User agent (browser and device information).
  • Referer URL (the page that sent you to us, when your browser sends it).
  • Timestamps of requests to the Service.
  • Session and authentication tokens issued by Clerk for the duration of your session.

2.3 Information about your use of the Service

Because LawEngine is a research tool, the core of what we collect is what you ask the Service to do. That includes:

  • Verification queries — the citations, quotes, or text you submit for verification.
  • Verification results — what the Service returned in response.
  • Usage metadata — the timing, frequency, and pattern of your queries.

We treat query content as sensitive. See Section 4 for how we use it and Section 6 for how long we keep it.

2.4 Information we do not collect

  • We do not use third-party advertising trackers.
  • We do not use cross-site tracking cookies.
  • We do not collect precise geolocation.
  • We do not collect payment-card data directly; if we add paid plans in the future, payments will run through a PCI-compliant processor (likely Stripe), and our policy will be updated to describe it.

3. Cookies and similar technologies

We keep cookies and similar technologies to the minimum needed to run the Service. Specifically:

  • Authentication session cookies set by Clerk, used to keep you signed in.
  • Strictly necessary hosting and security technologies used by our infrastructure providers.
  • Privacy-friendly usage measurement through Vercel Web Analytics and Plausible.

We do not set advertising cookies. We do not use cookies or analytics tools to build a profile of you across other websites. Plausible is configured for product analytics, not ad-tech tracking.

4. Why we collect it

We use the information described above to:

  • Provide the Service. We need your account information to authenticate you and your query content to return a verification result.
  • Prevent and investigate abuse. Hashed IP addresses, timestamps, and usage metadata help us detect scraping, bulk-extraction attempts, and other misuse.
  • Debug and improve the Service. Aggregated and de-identified query patterns help us find gaps in corpora, fix verification bugs, evaluate accuracy, and build new features.
  • Communicate with you. We may send transactional emails about your account, notices of material changes to these policies, and — if you opt in — product updates.
  • Meet legal obligations. Where the law requires us to retain or disclose information, we do so.

5. Who we share with

We do not sell your data. We share information only in the limited circumstances below.

5.1 Infrastructure providers

We rely on a small set of vendors to run the Service. They process information on our behalf, under their own privacy terms:

We also use Plausible for privacy-friendly product analytics. Where providers process personal information on our behalf, they do so under their own terms and privacy commitments.

Each provider is bound by its own agreement with us and by its public privacy commitments. Data processed by them is hosted in the United States or handled through U.S.-based service operations.

5.2 Legal process

We may disclose information if we are required to by law, subpoena, court order, or other valid legal process — or where disclosure is necessary to protect our rights, our users, or the public. Where we are legally permitted to do so, we will tell you about legal demands that affect your account.

5.3 Corporate transactions

If I'm No Lawyer LLC is acquired, merged, reorganized, or sells substantially all of its assets, information may be transferred to the successor entity. We will give you notice and an opportunity to object or delete your account where the law requires it.

5.4 With your consent

We may share information in ways not listed here with your specific, informed consent.

6. How long we keep it

  • Account data (email, name, authentication state) — kept as long as your account is active. When you delete your account, we delete account data within thirty (30) days, except where we are required to retain it by law or for the establishment, exercise, or defense of legal claims.
  • Verification queries and results — retained indefinitely in aggregated and de-identified form for product improvement, accuracy evaluation, and corpus-coverage analysis. Identifiable query-to-user links are deleted along with your account.
  • Security and abuse logs (hashed IPs, timestamps, user agents) — retained for up to twenty-four (24) months, then deleted or aggregated.
  • Support emails — kept for our records; deleted on request where the law permits.

7. Your rights

You have rights over the information we hold about you. Depending on where you live, those rights may include:

  • Access. Ask us for a copy of the information we have about you.
  • Correction. Ask us to fix information that is inaccurate.
  • Deletion. Ask us to delete your account and associated personal data.
  • Portability. Ask us for your data in a machine-readable format.
  • Objection or restriction. Ask us to stop or limit certain processing.

To exercise any of these rights, email stephen@lawengine.ai with the account email address you want to act on. We will respond within thirty (30) days, or sooner if the law requires.

If we cannot fulfill a request — for example, if we must retain information for legal reasons — we will explain why.

8. Security

We use commercially standard measures to protect your information, including TLS encryption in transit, restricted database access, hashed IP storage, and vendor security commitments from Clerk, Supabase, and Vercel.

No system is impervious. If we become aware of a security incident that affects your personal information, we will notify you consistent with applicable law.

9. Children

LawEngine is not directed at children under 18 and is not intended for use by minors. We do not knowingly collect personal information from anyone under 18. If you believe we have collected information from a minor, email stephen@lawengine.ai and we will delete it.

10. International users

The Service is operated from the United States, and our infrastructure vendors host data in the United States. If you use the Service from outside the United States, you understand that your information will be transferred to, stored in, and processed in the United States.

Privacy laws in the United States may differ from those in your home country. By using the Service, you consent to the transfer and processing described above. We are actively monitoring GDPR, UK GDPR, and U.S. state privacy law (including CCPA/CPRA) as the Service grows, and we will expand this policy with jurisdiction-specific provisions when and where they are required.

11. California privacy notice

If you are a California resident, the California Consumer Privacy Act (as amended by the California Privacy Rights Act) may give you additional rights, including the right to know what personal information we collect, the right to delete it, and the right to opt out of sale or sharing. We do not sell personal information and do not share it for cross-context behavioral advertising. To exercise any CCPA/CPRA right, email stephen@lawengine.ai.

12. Changes to this policy

We may update this Privacy Policy from time to time. When we do, we will update the "Last updated" date at the top of this page. For material changes, we will provide at least thirty (30) days' advance notice by email to the address associated with your account and, where practical, through the Service itself.

Your continued use of the Service after the effective date of an update means you accept the updated policy. If you do not agree to an update, stop using the Service before the effective date.

13. Contact

Questions about this policy, data requests, or anything privacy-related:

I'm No Lawyer LLC Attn: LawEngine Privacy Chicago, Illinois stephen@lawengine.ai

We read what you send us.

Also see Terms of Service.