Privacy Policy

Effective September 26, 2026 · Terms of Service

1. Who we are

GPTLegal (gptlegal.org, the “Service”) is operated by Smartledger Blockchain Solutions Inc (“Smartledger,” “we,” “us”). This policy explains what personal information we collect through the Service, how we use and share it, how long we keep it, and the choices you have. For privacy questions or requests, email support@gptlegal.org.

2. What we collect

Information you give us

• Account details: your email address and password. We store only a salted, one-way hash of your password (scrypt), never the password itself.
• Documents and inputs: the text you paste or upload, files you upload, questions you ask, the jurisdiction you enter, and answers you give when creating a document. These often contain personal information about you and others (names, addresses, amounts, dates).
• Support messages: anything you send us by email.

What we keep from your documents

• We don’t store the original text or files. Uploaded files are held in memory only while we extract their text and are never written to disk. The text you paste or upload is processed to produce your result and is not saved.
• We save results to your history: document analyses and generated documents, so you can view and export them later. These results can include information taken from your inputs, such as names, addresses, amounts, and dates. Draft response letters and case-law research results are shown to you but not saved.

Information created as you use the Service

• Plan and billing records: your plan, and Stripe’s customer and subscription identifiers for your account. Payment card details are collected and held by Stripe, not us.
• Usage records: how many document actions you use each month (to apply plan limits), and a record of each AI request (which feature, which AI model, the number of tokens processed, the computed cost, and when). These records don’t contain your document text.
• Technical information: your IP address is processed when you connect and is held briefly in memory for rate limiting and security. Our servers keep limited error logs to diagnose problems; we don’t log your document content.

3. How we use it

• To provide the Service: analyze and draft documents, run research, save your history, and export files.
• To run your account and subscription, including billing through Stripe.
• To keep the Service secure and reliable: authentication, preventing abuse, rate limiting, and enforcing plan and fair-use limits.
• To respond to support requests and send essential messages about your account, billing, or changes to our terms.
• To comply with law and enforce our Terms of Service.

We don’t use your documents or results to train AI models, we don’t show ads, and we don’t sell your personal information or share it for cross-context behavioral advertising.

If you are in the European Economic Area or the United Kingdom, we rely on these legal bases: performing our contract with you (providing the Service and billing), our legitimate interests (security, abuse prevention, and improving reliability), and complying with legal obligations.

4. Who we share it with

We don’t sell personal information. We share it only with the following services, each for the role described, and as the law requires:

• OpenAI (AI processing). The text of your documents, questions, and document-creation answers, and scanned pages or photos for text recognition, are sent to OpenAI’s API to generate your results. Under OpenAI’s API data policy, this data is not used to train OpenAI’s models by default, and OpenAI may keep it in abuse-monitoring logs for up to 30 days unless the law requires longer.
• Stripe (payments). Stripe receives your email address and processes your payment details and subscription. Stripe also acts as an independent company for some purposes, such as fraud prevention and meeting its legal obligations, under its own privacy policy.
• CourtListener / Free Law Project (case-law research, a public database operated independently of us). When you use the research feature, short keyword search queries describing the legal issues in your document (for example, “security deposit wrongful retention”) and the courts to search are sent to CourtListener. Our system is designed so these queries contain legal topics, not your document text or personal details.
• DigitalOcean (hosting). Our servers and database are hosted by DigitalOcean in the United States.
• Email delivery provider (account emails). When we send you an account email, such as a password-reset link, our email delivery provider receives your email address and the message in order to deliver it.
• Google Fonts (typography). Our pages load fonts from Google, which receives your IP address and browser information when the fonts are fetched, and handles it under Google’s own privacy policy.

We may also disclose information if required by law or valid legal process, to protect the rights, safety, or property of our users, Smartledger, or others, or as part of a merger, acquisition, or sale of assets (in which case we’ll require the recipient to honor this policy).

5. Cookies and local storage

We use one cookie: a strictly necessary session cookie (gl_session) that keeps you signed in. It is HTTP-only, sent only over HTTPS, and expires after 30 days or when you sign out. Your browser also stores your light/dark theme choice in local storage. We don’t use analytics, advertising, or tracking cookies.

6. How long we keep it

• Account details and saved history: until you delete them. You can delete individual saved items at any time, and deleting your account deletes your account details, saved history, and usage counts. Stripe keeps its own customer and billing records (see below).
• AI request records: kept for accounting and cost control for up to 7 years. When you delete your account, these records are detached from you and no longer linked to any account.
• Backups: we keep a limited number of rolling database backups for disaster recovery (currently the 14 most recent). Deleted data can remain in a backup until that backup is rotated out, typically within weeks, and we don’t restore deleted data from backups except to recover from an incident.
• Sessions: expire after 30 days.
• Billing records held by Stripe are kept as Stripe and the law (for example, tax rules) require.

7. Your choices and rights

• Access and export: view your saved history anytime and download items as PDF, Word, or Markdown.
• Delete: delete saved items, or delete your account (which cancels any subscription) from your account page.
• Security: change your password from your account page; doing so signs out your other sessions.
• Other requests: to request a copy of your information, a correction (such as changing your email), or deletion, email support@gptlegal.org. We may need to verify your identity first.

Depending on where you live (for example, California or another US state with a privacy law, or the EEA or UK), you may have rights to access, correct, delete, or port your personal information, to object to or restrict certain processing, and to appeal our decision on a request. We honor these requests as required by law and won’t discriminate against you for exercising them. You may also complain to your local data-protection authority.

8. Security

We protect your information with measures including hashed passwords, HTTP-only session cookies, encrypted HTTPS connections, strict browser security policies, rate limiting, access controls that keep each account’s history private to that account, and least-privilege credentials for our payment integration. No system is perfectly secure, so we can’t guarantee absolute security. If a breach affects your personal information, we’ll notify you as the law requires.

9. Sensitive information

Legal documents can contain sensitive details, including information about health, finances, or legal matters. We use such information only to provide the results you ask for, not to infer characteristics about you. Please leave out information that isn’t needed for your question, such as Social Security numbers, bank account numbers, or medical details, and only submit other people’s information when you’re entitled to share it.

10. Children

The Service is for adults 18 and over. We don’t knowingly collect personal information from children under 13. If you believe a child has given us personal information, contact us and we’ll delete it.

11. International users

We are based in the United States and process and store information in the United States. If you use the Service from elsewhere, your information will be transferred to and processed in the United States, where data-protection laws may differ from those where you live.

12. Changes to this policy

We may update this policy from time to time. We’ll post the new version with a new effective date, and for material changes we’ll notify you before they take effect, by email or by a notice in your account or on the Service.

13. Contact

Smartledger Blockchain Solutions Inc · support@gptlegal.org