Legal
Privacy Policy
Last updated: May 15, 2026
1. Who we are
This Privacy Policy is issued by ModulawAI Inc., a corporation incorporated in the State of Delaware, USA, with its principal place of business at 7 Peter Utulu Close, Anu Crescent, Badore, Ajah, Lagos, Nigeria, and registered agent Legalinc Corporate Services Inc., 131 Continental Dr, Suite 305, Newark, DE 19713, USA (“ModulawAI Inc.”, “we”, “our”, or “us”), and its Nigerian subsidiary, ModulawAI Nigeria Limited (RC-8401723), registered in the Federal Republic of Nigeria (together, “ModulawAI”, “we”, “our”, or “us”).
ModulawAI Inc. is the parent data controller for all data processed through the Platform. ModulawAI Nigeria Limited processes data on behalf of and under the instructions of ModulawAI Inc. pursuant to an intra-group data processing agreement.
2. Scope
This Policy applies to all personal data processed when you use our website, legal research tools, AI-powered chatbot, and case management services (the “Platform”). It applies to website visitors, registered users, and enterprise clients.
3. Information we collect
Automatically collected
- Device information (IP address, browser type, operating system)
- Usage data (pages visited, time on site, click interactions)
- Session replay and heatmap data (via Microsoft Clarity, subject to your consent)
- Analytics data (via Google Analytics, subject to your consent)
- Marketing attribution data (via Facebook Pixel and TikTok Pixel, subject to your consent)
Information you provide
- Email address and password when creating an account
- Uploaded documents (e.g. PDFs of court judgments and case files)
- Messages and queries sent through the chatbot or case manager
- Payment information, handled securely via Paystack and Stripe; we do not store card details
- Calendar data, if you connect your Google Calendar for workspace integration
- Workspace and case management data entered by you or your team
4. ModulawAI for Word (Microsoft Word add-in)
ModulawAI for Word is the Microsoft Word add-in we publish on AppSource. It runs inside Microsoft Word and shares most processing with the main Platform. This section describes data handling specific to the add-in.
Document content we process
- Selected text passed to /draft, /improve, /review, /explain, and /summarize commands
- The full body of the open document when you click “Include doc”, truncated to the first 50,000 characters
- Conversation history (your prompts and AI replies) persisted to your account so you can resume later
- Attached sources you add via the Sources panel (case documents, playbooks, local files)
Hosting
The ModulawAI for Word add-in itself is hosted on AWS Amplify. Its requests are served by our backend on Microsoft Azure.
AI processors
Document content is forwarded to ModulawAI’s backend, then to one or more of the following AI providers under data-processing agreements with no-training assurances: Anthropic, AWS Bedrock (Claude, Nova, Llama, Kimi), Azure OpenAI, and Fireworks AI. We do not permit any of these providers to use your content for model training.
What stays on your device
- Authentication token (stored in browser localStorage; cleared on sign-out)
- UI preferences such as jurisdiction, automation toggles, and style guide rules, which are also synced to your ModulawAI account
Citation verification
When you click “Verify” on a citation, the case title and citation are sent to TinyFish (a browser-automation provider) which navigates authoritative case-law sites on your behalf. The body of your document is not sent to TinyFish.
Retention
Conversation history and attached sources are retained until you delete them or delete your account. Deletion removes them from primary storage within 30 days and from backups within 90 days.
5. Lawful basis for processing
We process your personal data on the following lawful bases under the NDPR, GDPR, and applicable US privacy law:
| Processing activity | Lawful basis |
|---|---|
| Account creation and authentication | Performance of a contract |
| Providing AI research and case management services | Performance of a contract |
| Processing subscription payments | Performance of a contract; legal obligation |
| Analytics (Google Analytics, Microsoft Clarity) | Consent (opt-in) |
| Marketing and advertising (Facebook Pixel, TikTok Pixel) | Consent (opt-in) |
| Platform security, fraud prevention, and abuse detection | Legitimate interests (see section 6) |
| Service improvement using anonymized interaction data | Legitimate interests (see section 6) |
| Compliance with legal and regulatory obligations | Legal obligation |
6. Legitimate interests balancing
Where we rely on legitimate interests, we have conducted a balancing test. Our legitimate interests are:
- Security and fraud prevention: We process access logs, IP addresses, and usage patterns to detect and prevent unauthorized access and abuse of the Platform. We consider this proportionate because it protects all users and is necessary to operate a secure service.
- Service improvement using anonymized data: We analyze aggregated, non-identifiable interaction patterns (not uploaded legal documents) to improve the Platform’s functionality and AI response quality. Uploaded client documents and case files are excluded from this processing entirely.
You have the right to object to processing based on legitimate interests. See section 16 for how to exercise this right.
7. Confidentiality of uploaded legal documents
We recognize that uploaded legal documents, case notes, client correspondence, and related materials may be subject to legal professional privilege and attorney-client confidentiality.
- Uploaded legal documents are processed solely to provide you with the services you have requested (e.g. document analysis, case management).
- They are not used to train AI models, shared with third parties for commercial purposes, or accessed by ModulawAI personnel except for necessary technical support with your consent.
- All uploaded documents are encrypted at rest and in transit.
8. AI training — our position
ModulawAI does not use your uploaded documents, case files, chatbot conversations, or any content you submit to the Platform to train, fine-tune, or improve third-party AI models (including those provided by OpenAI or Microsoft Azure). We may use fully anonymized, aggregated behavioral data (e.g. response quality ratings you provide) solely to improve our own service outputs, and only where we have a lawful basis to do so.
9. Analytics tools
Subject to your cookie consent, we use the following analytics tools:
- Google Analytics (GA4): Aggregated page views, session data, demographic and interest data. Google Privacy Policy.
- Microsoft Clarity: Session replays, heatmaps, scroll and click tracking. Sensitive fields (passwords, legal document content) are automatically masked. Microsoft Privacy Statement.
You may withdraw consent at any time via Cookie Settings in the footer.
10. AI processing
Our chatbot, voice agent, research tools, and ModulawAI for Word add-in route each request to the AI provider best suited to the task. The providers we currently use are Azure OpenAI Service, AWS Bedrock (hosting Anthropic Claude, Amazon Nova, Meta Llama, and Moonshot Kimi), Fireworks AI (open-weight reasoning models), and Anthropic directly for some Word add-in features. Each provider operates under a no-training assurance for API inputs.
Query content is processed in real time to generate responses. We do not include personally identifiable information in model prompts beyond what is strictly necessary to answer your query. For voice features, audio is transported by LiveKit, transcribed by Deepgram, and synthesised by ElevenLabs (with Cartesia as fallback).
Optional LangSmith tracing — when enabled in our configuration — captures prompt/response pairs for debugging and quality monitoring under the same no-training terms.
11. Data storage and security
- User account data is stored in MongoDB, hosted on Microsoft Azure.
- Uploaded legal documents are stored in Azure Blob Storage with AES-256 encryption at rest.
- AI embeddings and vector data are stored in Pinecone.
- All data is transmitted over TLS 1.2 or higher.
- Access to production data is restricted to authorized personnel only, with access logs reviewed regularly.
- ModulawAI staff do not access your uploaded legal documents except for technical support where you have provided explicit consent.
12. Data retention
We retain personal data only as long as necessary. Key retention periods:
| Data type | Retention period |
|---|---|
| Active user accounts | Duration of account plus 12 months after last activity |
| Chat history | 90 days unless deleted by user |
| Uploaded documents not linked to an active case | 180 days |
| Uploaded documents linked to an active case | Duration of case plus 90 days after closure |
| Payment records | 7 years (legal and tax obligation) |
| Security and access logs | 90 days |
You may request deletion of your data at any time, subject to legal retention obligations. See our Data Protection Policy for the full retention schedule.
13. Cross-border data transfers
ModulawAI Inc. (US) and ModulawAI Nigeria Limited operate under an intra-group data transfer agreement that incorporates Standard Contractual Clauses (SCCs) where required by GDPR and equivalent transfer mechanisms under NDPR. Your data may be processed in the United States, the European Economic Area, or Nigeria depending on the services you use.
Where data is transferred from Nigeria to the United States, the transfer is made on the basis of the intra-group agreement and such additional safeguards as required by the Nigeria Data Protection Commission (NDPC).
14. Third-party services and sharing
We share data with the following categories of third parties only as described. The authoritative, continuously-maintained list (with regions, purposes, and a changelog) lives at modulaw.ai/subprocessors.
| Provider | Purpose | Basis |
|---|---|---|
| Microsoft Azure | Primary cloud hosting (App Service, Static Web Apps, Blob Storage), Azure OpenAI inference, Document Intelligence (OCR) | Contract; data processor agreement |
| AWS | Bedrock AI inference; Amplify hosting for the ModulawAI for Word add-in | Contract; data processor agreement |
| MongoDB Atlas, Neo4j, Redis | Application database, graph database, session caching | Contract; data processor agreement |
| Pinecone | Vector database for AI embeddings (anonymized) | Contract; data processor agreement |
| AI providers (Azure OpenAI, AWS Bedrock, Fireworks AI, Anthropic) | Chat completions and embeddings. Each provider operates under a no-training assurance for API inputs. | Contract; data processor agreement |
| Voice providers (LiveKit, Deepgram, ElevenLabs, Cartesia) | Real-time voice transport, speech-to-text, text-to-speech for AI voice agent and call features | Contract; data processor agreement |
| Paystack | Payment processing (NGN) | Contract; data processor agreement |
| Stripe | Payment processing (non-NGN) | Contract; data processor agreement |
| ZeptoMail (Zoho) | Transactional email delivery (OTP codes, receipts, booking confirmations) | Contract; data processor agreement |
| WhatsApp Business / Meta | OTP and booking notifications where the user opts in | Consent; contract |
| Google reCAPTCHA | Bot protection on public forms | Legitimate interest |
| Research and case-law providers (CourtListener, CanLII, EUR-Lex, TinyFish, Tavily, Bing, Google Custom Search) | Citation verification and web/case-law search augmentation. Only the query and the relevant citation are sent; document bodies are not. | Contract or public API; legitimate interest |
| LangSmith (LangChain) | Optional LLM-call tracing; only active when tracing is enabled by configuration | Legitimate interest |
| Google Analytics | Website analytics (anonymized) | Consent |
| Microsoft Clarity | Behavioral analytics and session replay (masked) | Consent |
| Facebook Pixel (Meta), TikTok Pixel, X / Twitter Ads, Apollo | Marketing attribution and advertising | Consent |
| Google Workspace (Gmail, Calendar, Drive), Microsoft 365 (Outlook, OneDrive, Teams Calendar), Zoho (CRM, Mail, Bookings) | User-authorised integrations that act on the user’s own account | Consent (user-initiated) |
We never sell your personal data to any third party.
15. Cookies
We use cookies and similar tracking technologies. Optional cookies (analytics and marketing) are off by default and require your explicit consent. For a full list of cookies we use, including names, purposes, and durations, see our Cookie Policy. You can manage your preferences at any time via the Cookie Settings link in the footer.
16. Your rights
Depending on your jurisdiction, you have the following rights:
- Access: Request a copy of the personal data we hold about you.
- Rectification: Request correction of inaccurate or incomplete data.
- Erasure: Request deletion of your data (subject to legal retention obligations).
- Restriction: Request that we restrict processing of your data.
- Portability: Request your data in a structured, machine-readable format.
- Objection: Object to processing based on legitimate interests.
- Withdraw consent: Withdraw consent for analytics or marketing cookies at any time.
Nigerian users also have the right to lodge a complaint with the Nigeria Data Protection Commission (NDPC) at ndpc.gov.ng. EEA/UK users may complain to their local supervisory authority.
To exercise any of these rights, contact dpo@modulaw.ai. We will respond within 30 days.
17. Children’s privacy
Our services are not intended for individuals under the age of 18. We do not knowingly collect personal data from minors.
18. Changes to this policy
We may update this Privacy Policy from time to time. Material changes will be communicated via email or a prominent notice on our website. The “Last updated” date at the top of this page reflects the most recent revision.
Contact
For privacy enquiries and data rights requests:
Email: dpo@modulaw.ai
ModulawAI Inc. (Data Controller)
7 Peter Utulu Close, Anu Crescent, Badore, Ajah, Lagos, Nigeria (Principal Office)
Registered Agent: Legalinc Corporate Services Inc., 131 Continental Dr, Suite 305, Newark, DE 19713, USA
ModulawAI Nigeria Limited (Nigerian subsidiary, RC-8401723)