Legal
Privacy Policy
Last updated: October 25, 2026
1. Who we are
This Privacy Policy is issued by ModulawAI Inc., a corporation incorporated in the State of Delaware, USA, with its principal place of business at 7 Peter Utulu Close, Anu Crescent, Badore, Ajah, Lagos, Nigeria, and registered agent Legalinc Corporate Services Inc., 131 Continental Dr, Suite 305, Newark, DE 19713, USA (“ModulawAI Inc.”, “we”, “our”, or “us”), and its Nigerian subsidiary, ModulawAI Nigeria Limited (RC-8401723), registered in the Federal Republic of Nigeria (together, “ModulawAI”, “we”, “our”, or “us”).
ModulawAI Inc. is the data controller for the personal data described in this Policy: your account, billing, how you use the Platform, our website, our marketing, and support. ModulawAI Nigeria Limited processes data on behalf of and under the instructions of ModulawAI Inc. pursuant to an intra-group data processing agreement.
Where a law firm or other business customer puts client and matter content into the Platform (documents, matters, chats, emails, calls and client records), that customer is the controller of that content and we process it on the customer’s instructions under our Data Processing Agreement. If you are a client of a firm that uses ModulawAI, please contact that firm about your data; we will help them answer you.
2. Scope
This Policy applies to all personal data processed when you use our website, legal research tools, AI-powered chatbot, and case management services (the “Platform”). It applies to website visitors, registered users, and enterprise clients.
3. Information we collect
Automatically collected
- Device information (IP address, browser type, operating system)
- Usage data (pages visited, time on site, click interactions)
- Session replay and heatmap data (via Microsoft Clarity, subject to your consent)
- Analytics data (via Google Analytics, subject to your consent)
- Marketing attribution data (via Facebook Pixel and TikTok Pixel, subject to your consent)
Information you provide
- Email address and password when creating an account
- Uploaded documents (e.g. PDFs of court judgments and case files)
- Messages and queries sent through the chatbot or case manager
- Payment information, handled securely via Paystack and Stripe; we do not store card details
- Calendar data, if you connect your Google Calendar for workspace integration
- Workspace and case management data entered by you or your team
4. ModulawAI for Word (Microsoft Word add-in)
ModulawAI for Word is the Microsoft Word add-in we publish on AppSource. It runs inside Microsoft Word and shares most processing with the main Platform. This section describes data handling specific to the add-in.
Document content we process
- Selected text passed to /draft, /improve, /review, /explain, and /summarize commands
- The full body of the open document when you click “Include doc”, truncated to the first 50,000 characters
- Conversation history (your prompts and AI replies) persisted to your account so you can resume later
- Attached sources you add via the Sources panel (case documents, playbooks, local files)
Hosting
The ModulawAI for Word add-in itself is hosted on Amazon Web Services (AWS). Its requests are served by our backend on Amazon Web Services in the United States.
AI processors
Document content is forwarded to ModulawAI’s backend, then to one or more of the following AI providers: AWS Bedrock (including Anthropic Claude, Amazon Nova and open-weight models such as Qwen, Llama and Kimi) and Fireworks AI (open-weight models). Text embeddings are created with text-embedding-3-large through OpenRouter, which routes to Microsoft Azure’s zero-data-retention endpoint. Under their terms for our account, these providers do not use your content to train their models, and AWS Bedrock and Fireworks AI do not keep your prompts or outputs.
What stays on your device
- Authentication token (stored in browser localStorage; cleared on sign-out)
- UI preferences such as jurisdiction, automation toggles, and style guide rules, which are also synced to your ModulawAI account
Citation verification
When you click “Verify” on a citation, the case title and citation are sent to TinyFish (a browser-automation provider) which navigates authoritative case-law sites on your behalf. The body of your document is not sent to TinyFish.
Retention
Conversation history and attached sources are retained until you delete them, or as your account or your firm’s instructions require. Copies in database backups expire on our database provider’s backup cycle.
5. Lawful basis for processing
We process your personal data on the following lawful bases under the Nigeria Data Protection Act 2023 (NDPA), the EU General Data Protection Regulation (GDPR), the UK GDPR and Data Protection Act 2018, and applicable US privacy law:
| Processing activity | Lawful basis |
|---|---|
| Account creation and authentication | Performance of a contract |
| Providing AI research and case management services | Performance of a contract |
| Processing subscription payments | Performance of a contract; legal obligation |
| Analytics (Google Analytics, Microsoft Clarity) | Consent (opt-in) |
| Marketing and advertising (Facebook Pixel, TikTok Pixel) | Consent (opt-in) |
| Platform security, fraud prevention, and abuse detection | Legitimate interests (see section 6) |
| Service improvement using anonymized interaction data | Legitimate interests (see section 6) |
| Compliance with legal and regulatory obligations | Legal obligation |
6. Legitimate interests balancing
Where we rely on legitimate interests, we have conducted a balancing test. Our legitimate interests are:
- Security and fraud prevention: We process access logs, IP addresses, and usage patterns to detect and prevent unauthorized access and abuse of the Platform. We consider this proportionate because it protects all users and is necessary to operate a secure service.
- Service improvement using anonymized data: We analyze aggregated, non-identifiable interaction patterns (not uploaded legal documents) to improve the Platform’s functionality and AI response quality. Uploaded client documents and case files are excluded from this processing entirely.
You have the right to object to processing based on legitimate interests. See section 16 for how to exercise this right.
7. Confidentiality of uploaded legal documents
We recognize that uploaded legal documents, case notes, client correspondence, and related materials may be subject to legal professional privilege and attorney-client confidentiality.
- Uploaded legal documents are processed solely to provide you with the services you have requested (e.g. document analysis, case management).
- We do not use them to train AI models, share them with third parties for commercial purposes, or let ModulawAI personnel access them except for necessary technical support with your consent.
- All uploaded documents are encrypted at rest and in transit.
8. AI training: our position
ModulawAI does not use your uploaded documents, case files, chatbot conversations, or any content you submit to the Platform to train, fine-tune, or improve our own or third-party AI models (including those offered through AWS Bedrock, Fireworks AI, OpenRouter or Microsoft Azure). We may use fully anonymized, aggregated behavioral data (e.g. response quality ratings you provide) solely to improve our own service outputs, and only where we have a lawful basis to do so.
9. Analytics tools
Subject to your cookie consent, we use the following analytics tools:
- Google Analytics (GA4): Aggregated page views, session data, demographic and interest data. Google Privacy Policy.
- Microsoft Clarity: Session replays, heatmaps, scroll and click tracking. Sensitive fields (passwords, legal document content) are automatically masked. Microsoft Privacy Statement.
You may withdraw consent at any time via Cookie Settings in the footer.
10. AI processing
Our chatbot, voice agent, research tools, and ModulawAI for Word add-in route each request to the AI provider best suited to the task. The providers we currently use are AWS Bedrock (hosting Anthropic Claude, Amazon Nova, and open-weight models such as Qwen, Llama, Kimi and gpt-oss) and Fireworks AI (open-weight models). Text embeddings for search are created with text-embedding-3-large through OpenRouter, routed to Microsoft Azure’s zero-data-retention endpoint. Scanned documents are read by Amazon Textract (OCR).
Our AWS Bedrock account is set to zero data retention, with model invocation logging switched off, and Fireworks AI keeps no prompts or outputs by default for the models we use. Under their terms for our account, our AI model providers do not use your content to train their models. Amazon Textract is covered by our AWS Organizations AI services opt-out, so AWS does not store or use the documents it reads to improve its services. The voice and search vendors named below process data under their own standard terms, and we send them only what their function needs.
Query content is processed in real time to generate responses. We do not include personally identifiable information in model prompts beyond what is strictly necessary to answer your query. For voice features, audio is relayed by our own LiveKit server on Amazon Web Services in South Africa, transcribed by Deepgram (with its model-improvement opt-out set on every request), and synthesised by ElevenLabs (with Cartesia as fallback).
We use LangSmith to monitor AI runs for debugging and quality. In production, prompts and outputs are hidden: LangSmith receives only metadata such as ids, timings and errors, and keeps those traces for 14 days.
11. Data storage and security
- The Platform is hosted on Amazon Web Services (AWS) in the United States (us-east-2, Ohio). User account data and Platform content are stored in MongoDB databases that we run ourselves on AWS in the United States (us-east-2), encrypted at rest and reachable only from our private network.
- Uploaded legal documents are stored in Amazon S3 with AES-256 encryption at rest.
- AI embeddings used for search are stored in our own MongoDB database, alongside the content they come from.
- Application logs mask email addresses and phone numbers and do not record request bodies or prompt text. They are kept for 90 days.
- All data is transmitted over TLS 1.2 or higher.
- Access to production data is restricted to authorized personnel only, with access logs reviewed regularly.
- ModulawAI staff do not access your uploaded legal documents except for technical support where you have provided explicit consent.
12. Data retention
We retain personal data only as long as necessary. Key retention periods:
| Data type | Retention period |
|---|---|
| Active user accounts | For as long as the account is open. After closure, as you or your firm instruct, subject to legal retention obligations |
| Chat history | Until you delete it, or as your account or your firm’s instructions require |
| Uploaded documents and case files | Until you or your firm delete them. Deleted items stay in the recycle bin for 30 days and are then permanently deleted |
| Payment records | 7 years (legal and tax obligation) |
| Security and application logs | 90 days |
| AI run monitoring (LangSmith metadata) | 14 days |
You may request deletion of your data at any time, subject to legal retention obligations. See our Data Protection Policy for the full retention schedule.
13. Cross-border data transfers
We process personal data in the United States, where the Platform is hosted. Our team at ModulawAI Nigeria Limited administers and supports the Platform from Nigeria and may access data when needed to do so. Live call audio and video are relayed through our own server on Amazon Web Services in South Africa. Some service providers process data in other countries, as listed on our Subprocessors page. We do not process your data in the European Economic Area or the United Kingdom.
When personal data from the EU/EEA or the UK is transferred to the United States, Nigeria or another country without an adequacy decision, we use the European Commission’s Standard Contractual Clauses (Implementing Decision (EU) 2021/914), Module 2 (controller to processor) and Module 3 (processor to processor) as set out in our Data Processing Agreement, together with the UK International Data Transfer Addendum. ModulawAI Inc. (US) and ModulawAI Nigeria Limited operate under an intra-group data transfer agreement for transfers between them. You can ask for a copy of these safeguards at dpo@modulaw.ai.
Where data is transferred out of Nigeria, the transfer is made in line with the cross-border transfer rules of the Nigeria Data Protection Act 2023 and the requirements of the Nigeria Data Protection Commission (NDPC).
14. Third-party services and sharing
We share data with the following categories of third parties only as described. The authoritative, continuously-maintained list (with regions, purposes, and a changelog) lives at modulaw.ai/subprocessors.
| Provider | Purpose | Basis |
|---|---|---|
| AWS | Primary cloud hosting in the United States (EC2, S3 file storage, ElastiCache, CloudWatch logs); the MongoDB databases we run ourselves on EC2, including search embeddings; Bedrock AI inference; Textract (OCR); hosting for the ModulawAI for Word add-in; our self-hosted LiveKit voice relay in South Africa | Contract; data processor agreement |
| ModulawAI Nigeria Limited | Administration, engineering and support from Nigeria | Intra-group data processing agreement |
| AI providers (AWS Bedrock, Fireworks AI, OpenRouter) | Chat completions and embeddings. Under their terms for our account, these providers do not use your content to train their models. | Contract; data processor agreement |
| Voice and telephony providers (LiveKit, self-hosted on AWS; Deepgram; ElevenLabs; Cartesia; Africa’s Talking) | Real-time voice relay, speech-to-text, text-to-speech, SMS and phone calls for AI voice agent and call features | Contract; data processor agreement |
| Paystack | Payment processing (NGN) | Contract; data processor agreement |
| Stripe | Payment processing (non-NGN) | Contract; data processor agreement |
| ZeptoMail (Zoho) | Transactional email delivery (OTP codes, receipts, booking confirmations) | Contract; data processor agreement |
| WhatsApp Business / Meta | OTP and booking notifications where the user opts in | Consent; contract |
| Google reCAPTCHA and Firebase Cloud Messaging | Bot protection on public forms; push notifications | Legitimate interest; contract |
| Research and case-law providers (CourtListener, CanLII, EUR-Lex, TinyFish, Tavily) | Citation verification and web/case-law search augmentation. Only the query and the relevant citation are sent; document bodies are not. | Contract or public API; legitimate interest |
| LangSmith (LangChain) | Monitoring of AI runs. Production traces hold metadata only (prompts and outputs hidden) and are kept 14 days | Legitimate interest |
| Google Analytics | Website analytics (pseudonymous, consent only) | Consent |
| Microsoft Clarity | Behavioral analytics and session replay (masked) | Consent |
| Facebook Pixel (Meta), TikTok Pixel, X / Twitter Ads, Apollo | Marketing attribution and advertising | Consent |
| Google Workspace (Gmail, Calendar, Drive), Microsoft 365 (Outlook, OneDrive, Teams Calendar), Zoho (CRM, Mail, Bookings) | User-authorised integrations that act on the user’s own account | Consent (user-initiated) |
We never sell your personal data to any third party.
15. Cookies
We use cookies and similar tracking technologies. Optional cookies (analytics and marketing) are off by default and require your explicit consent. For a full list of cookies we use, including names, purposes, and durations, see our Cookie Policy. You can manage your preferences at any time via the Cookie Settings link in the footer.
16. Your rights
Depending on your jurisdiction, you have the following rights:
- Access: Request a copy of the personal data we hold about you.
- Rectification: Request correction of inaccurate or incomplete data.
- Erasure: Request deletion of your data (subject to legal retention obligations).
- Restriction: Request that we restrict processing of your data.
- Portability: Request your data in a structured, machine-readable format.
- Objection: Object to processing based on legitimate interests.
- Withdraw consent: Withdraw consent for analytics or marketing cookies at any time.
You also have the right to lodge a complaint with a data protection authority: in Nigeria, the Nigeria Data Protection Commission (NDPC) at ndpc.gov.ng; in the UK, the Information Commissioner’s Office (ICO) at ico.org.uk; in the EU/EEA, the supervisory authority in the country where you live or work, or where you think the problem happened.
To exercise any of these rights, contact dpo@modulaw.ai. We will respond within one month. If your request is about content your firm controls, we will pass it to your firm and help them answer.
17. Children’s privacy
Our services are not intended for individuals under the age of 18. We do not knowingly collect personal data from minors.
18. Changes to this policy
We may update this Privacy Policy from time to time. Material changes will be communicated via email or a prominent notice on our website. The “Last updated” date at the top of this page reflects the most recent revision.
Contact
For privacy enquiries and data rights requests:
Email: dpo@modulaw.ai
ModulawAI Inc. (Data Controller)
7 Peter Utulu Close, Anu Crescent, Badore, Ajah, Lagos, Nigeria (Principal Office)
Registered Agent: Legalinc Corporate Services Inc., 131 Continental Dr, Suite 305, Newark, DE 19713, USA
ModulawAI Nigeria Limited (Nigerian subsidiary, RC-8401723)