Privacy Notice

1. Scope and operator

AI Studio Legal (the “Services”) is operated by Altipoint LLC, a Nevada limited liability company (“we”, “us”, “our”). This Notice describes how we handle information collected through aistudiolegal.com, lab.aistudiolegal.com, and any related page or feature that links to it.

This Notice does not apply to: (a) websites, products or services operated by third parties, including any model provider, payment processor or hosting provider; (b) consulting or professional engagements governed by a separate engagement letter or services agreement, which control as to information handled under them; or (c) information you give us outside the Services.

No concession of applicability. We publish this Notice as a matter of transparency and good practice. Publishing it is not an admission or agreement that any particular federal or state privacy statute applies to us, and it does not waive any exemption, threshold, or defence otherwise available to us.

2. Read this first

2.1 No legal advice; no attorney–client relationship. The Services provide educational articles, structured self-assessments, and software tools. They do not provide legal advice. Using the Services does not create an attorney–client relationship between you and us, or between you and any person associated with, employed by, or holding an interest in Altipoint LLC. No information you submit is treated as a confidential attorney–client communication, and no duty of confidentiality, loyalty, or competence under any rule of professional conduct arises from your use of the Services. Consult a lawyer licensed in your jurisdiction before acting on anything you obtain here.

2.2 Do not submit sensitive or protected material. Do not submit anything through the Services that you are not free to disclose to us and to our service providers. This includes, without limitation: attorney–client privileged material or work product; client confidences; another person’s or organisation’s trade secrets or confidential information; protected health information; payment card, financial account or government identification numbers; biometric or genetic data; information about anyone under 18; and classified, export-controlled or government-related information.

By submitting material you represent that you have the right and authority to do so, that you have removed or redacted anything listed above, and that submission breaches no duty you owe to a client, employer, or third party. Material submitted contrary to this section is submitted at your sole risk. We assume no obligation of confidentiality, no professional duty, and no liability with respect to it, and we may delete it.

This is not a theoretical restriction: the product has no free-text answer field and no upload for you to use — see §3. It is not built or secured to hold privileged material.

2.3 Machine-generated output is unverified. Where the Services generate output using a language model (§5), that output may be inaccurate, incomplete, outdated, internally inconsistent, or fabricated, including citations to authorities that do not exist. We do not review it before you receive it and make no representation as to its accuracy, completeness, currency, or fitness for any purpose. You are responsible for independently verifying any output before relying on it.

2.4 Adults only. The Services are intended solely for individuals 18 years of age or older, acting in a professional or business capacity. We do not knowingly collect personal information from anyone under 18. If we learn that we have, we will delete it. If you believe a minor has given us information, contact us at §16.

3. What we collect

Everything below comes from you or is generated by the Services. We do not buy personal information, and we do not collect it from data brokers or public records.

• Email address — submitted to sign in or create an account, stored by our authentication provider with an account identifier and sign-in lifecycle records. There is no password; access is by emailed link.
• Display name — optional; you choose whether to give one.
• Assessment and Business Lab answers — closed-choice answers only, selected from options we define, covering organisation setting, team-size band, role category, work profile, recent AI tool use, and scored responses on AI task framing, tool selection, source handling and verification.
• Results and scores — derived scores, coverage, and completion timestamps, tied to the version of the assessment you took.
• Access state — whether your account is admitted, and any subscriber entitlement.
• Sign-in and session data — a short-lived confirmation cookie during sign-in and session cookies once signed in; see §8.
• Rate-limit counters — your account identifier and a request count within a one-hour window, to prevent abuse.
• Technical request data — our hosting and database providers record requests, including IP address, timestamp, route and status. Standard server logging, not analytics.
• Communications — support messages you send us and our replies.

3.1 What we do not collect. This reflects how the product is built, not only what we promise. No client or matter information — there is no free-text answer field and no upload anywhere on the participant path. No product analytics, tracking SDK, session replay, or advertising pixel. No special-category data — no health, biometric, genetic, precise-location, racial, religious, political, or sexual-orientation data. No payment card details.

If you place sensitive information into an answer contrary to §2.2, we process it only as incidental to delivering the feature you used, and we do not use it to infer characteristics about you.

3.2 Payments. Nothing is charged today. No subscription is sold and no price is published, so no payment information exists. When subscriptions open, payments will be handled by a third-party payment processor and we will not receive or store your full card details. We will update this Notice before the first charge.

4. How we use it

4.1 Purposes. To sign you in and keep your account working; produce, display and retain your results; decide what content your account may open; respond when you contact us; keep the Services secure, prevent abuse and diagnose faults; enforce our Terms and protect our rights, property and safety and those of our users and the public; comply with applicable law, legal process and regulatory requests; and establish, exercise or defend legal claims, including preserving information under a legal hold.

We do not sell your personal information, share it for cross-context behavioural advertising, build an advertising profile, send marketing email, or use your answers to train any model of ours.

4.2 De-identified and aggregated data. We may create de-identified and aggregated data from the information we collect, and may use, retain and disclose that data for any lawful purpose, including improving, benchmarking, publishing statistics about, and marketing the Services. We maintain such data in de-identified form, do not attempt to re-identify it except as permitted by law, and require recipients to do the same. De-identified and aggregated data is not personal information and is not returned, corrected, or deleted in response to a request under §10.

4.3 Automated processing. Your results are produced by fixed scoring rules running in our database — the same answers always produce the same result. We do not use automated processing to make decisions producing legal or similarly significant effects concerning you, including decisions about credit, lending, housing, education, employment, insurance or healthcare. A result is a self-reflection output; as our Terms say, it does not certify or assess your professional competence. We do not review, export, aggregate for calibration, or share individual results, and no employer, firm, or other third party receives them.

5. AI processing and model providers

This section is about one feature, and the boundary matters.

5.1 What does not use a model provider. Your assessment and Business Lab answers are scored by fixed rules inside our own database. They are not sent to any AI or model provider, ever. This is an architectural boundary, not a policy promise.

5.2 What does. The Legal Lab includes a feature that sends the content you type into that featureto a third-party model provider to generate a response. That content leaves our infrastructure and is processed on the provider’s systems under the provider’s own terms. Depending on configuration, that provider may be OpenRouter acting as a broker — which may route to Google AI Studio or Novita as the upstream — or NVIDIA’s hosted inference API. The set may change, and we will update this Notice when it does.

5.3 Training. We do not use your content to train any model of ours. Where the provider we are using supports it, we configure our integration to request that the provider not retain your content or use it to train its models. That option is not available with every provider we may use, we do not control whether any third party honours it, and we do not warrant that content you submit to this feature will not be retained or used to improve a third party’s models. Do not enter anything into this feature that you are not free to disclose to a third party — and, per §2.2, never client confidential information.

5.4 Human review. Authorised personnel may access content on a limited, need-to-know basis to investigate suspected abuse or a security incident, diagnose an error you report, or evaluate output quality. We do not conduct routine or systematic human review.

6. When we disclose

• Service providers. Vendors that host, secure, support, bill for, or send email about the Services — currently Vercel (hosting), Supabase (authentication and database), Resend (sign-in email), Cloudflare R2 (storage for article images we publish; it holds no information about you, as there is no user upload path), Apple iCloud (receives mail to our contact address), and a payment processor once subscriptions open. Each processes on our behalf for purposes we specify.
• Model providers. As described in §5.
• Professional advisors and insurers, under duties of confidentiality.
• Legal process and protection of rights. Where we believe in good faith that disclosure is necessary to comply with law, subpoena, warrant, court order or governmental request; to enforce our Terms; to investigate suspected fraud, abuse or a security incident; or to protect the rights, property or safety of Altipoint LLC, our users, or the public. Where legally permitted we may, but are not obliged to, notify you first.
• Corporate transactions. In a merger, acquisition, financing, reorganisation, sale of assets or bankruptcy, information may be reviewed by and transferred to the counterparty or successor as a business asset.
• At your direction.

7. No sale, no sharing, no targeted advertising

We do not sell personal information, we do not share it for cross-context behavioural advertising or targeted advertising, and we do not use sensitive personal information to infer characteristics about you. We run no advertising technology and no third-party analytics, so there is nothing to opt out of.

If that ever changes we will say so here, provide a working opt-out, and implement the browser preference signals the law then requires of us before claiming to honour them.

8. Cookies

Browsing sets no cookies. An anonymous request to the site returns no cookie header at all. You can read every public article without accepting anything, which is why there is no consent banner.

Signing in sets two kinds of cookie, both strictly necessary. A pending-confirmation cookie carries your sign-in attempt between clicking the emailed link and completing sign-in; it is encoded, not encrypted, marked HttpOnly, Secure and SameSite=Lax, scoped to the sign-in path, and expires after ten minutes. Session cookies set by our authentication provider keep you signed in until you sign out or the session expires.

We use noadvertising, analytics, or third-party tracking cookies. Blocking strictly necessary cookies will prevent you from signing in. We do not respond to browser “Do Not Track” signals, which lack a common standard.

9. Retention

9.1 We keep your information for as long as your account is open, and delete it as described in §10.2 when you delete your account.

9.2 If you never create an account, we hold nothing that identifies you beyond the server logs at §9.3.

9.3 Server logs. Our hosting and database providers record requests as part of running the Services and retain them under their own schedules. One point worth stating plainly: the sign-in confirmation link carries a token reference in its address. We send a no-referrer header on that route, but we have not verified whether our host redacts those references in its request logs.

9.4 Legal hold. We retain information subject to a legal hold, or reasonably necessary to establish, exercise or defend a legal claim, until the hold is released or the claim and any limitation period is resolved — notwithstanding any request under §10. De-identified and aggregated data is retained indefinitely.

9.5 Backup copies may persist after deletion from active systems until they are cycled out. 9.6 Email. Sign-in messages delivered to your inbox are in your control, not ours. Messages you send us remain in our mailbox.

10. Your choices and requests

Voluntary extension. We honour the requests below for all United States residents as a matter of practice, without conceding that any particular statute applies to us and without waiving any exemption or defence. Where a statute does apply, that statute governs and this section is read to conform to it.

10.1 Always available. Update your display name in your profile at any time. Delete your account yourself, at any time, from your profile page — you need no reason and need not ask us. We send no marketing email, so there is nothing to unsubscribe from; you will receive only sign-in links you requested and replies to you.

10.2 What deletion reaches — and what it does not. Deleting your account removes your authentication record and the related profile, access state, assessment attempts and results, and rate-limit counters, and clears your session in the browser you are using. If you have a paid subscription it is cancelled and billing stops.

We would rather say this than let you assume otherwise. Deletion does notreach: a sign-in link already issued to you, which stays valid until it expires — your access fails immediately because the account is gone, but the link itself is not revoked at deletion; sessions in other browsers or on other devices, which are not cleared remotely; messages already delivered to your inbox; messages you have sent us, which remain in our mailbox; server logs and backup copies, per §9; content already sent to a model provider under §5, which is subject to that provider’s own retention and which we may be unable to retrieve or delete; and payment records a processor must keep for tax, fraud or legal reasons, of which none exist today.

10.3 On request. You may ask us to confirm whether we hold personal information about you and give you access to it; provide a copy in a portable format; correct it; or delete it. We will not discriminate against you for asking. Email contact@aistudiolegal.comwith the subject line “Privacy Request”, the request type, and the email address on your account.

10.4 Verification and limits. We will take reasonable steps to verify your identity before acting, which normally means responding from your account email. We may decline a request where we cannot verify you to a reasonable degree of certainty, where an exception under applicable law applies, or where the request is manifestly unfounded, excessive or repetitive — and in the last case may instead charge a reasonable fee. We will respond within forty-five days, and may extend once by a further forty-five days where reasonably necessary, with notice to you. Access and portability requests are limited to twice in any twelve-month period. An authorised agent may act for you with written authorisation signed by you; we may require you to verify your identity with us directly and to confirm the agent’s authority.

10.5 Appeals.If we decline a request, you may appeal by replying to our response with “Appeal” in the subject line and a statement of why you believe the decision was wrong. We will respond in writing within forty-five days with our decision and reasons. If your appeal is denied you may contact the attorney general or privacy regulator in your state.

10.6 California residents. We do not sell or share personal information, so there is nothing to opt out of. The rights at §10.3 are available to you as described. Under Cal. Civ. Code §1789.3 you may also contact the Complaint Assistance Unit of the Division of Consumer Services of the California Department of Consumer Affairs, 1625 North Market Blvd., Suite N 112, Sacramento, CA 95834, or (800) 952-5210.

10.7 Nevada residents. Altipoint LLC is a Nevada limited liability company. Under NRS 603A.300–360 a Nevada consumer may submit a verified request that an operator not make any sale of covered information it has collected. We do not sell covered information and have no plans to, so no such sale is occurring — but you may submit a request to contact@aistudiolegal.comwith the subject line “Nevada Opt-Out”, and we will respond within the statutory period.

11. Security

Traffic is encrypted in transit, and the site is served with HTTP Strict Transport Security, a content security policy, clickjacking protection, and a referrer policy. Sign-in is by emailed link, so there is no password to steal from us — and, as a direct consequence, anyone who can read your email can reach your account. Securing your email is the most important thing you can do here. Access to production data is limited to the owner. The pending-confirmation cookie is encoded rather than encrypted; it is HttpOnly, Secure, and expires in ten minutes.

No method of transmission or storage is completely secure. We do not warrant, and cannot guarantee, that information will never be accessed, disclosed, altered or destroyed without authorisation, and you use the Services at your own risk.

If a breach affects your personal information we will notify you and any regulator as the law requires.

12. Where processing happens

Altipoint LLC is located in the United States and the Services are hosted and operated there, except as described in §5. The Services are offered to and intended for users located in the United States. They are not directed to individuals in the European Economic Area, the United Kingdom, or Switzerland, and we make no representation that the Services or this Notice satisfy the EU or UK General Data Protection Regulation or any other non-US privacy law.

If you access the Services from outside the United States you do so on your own initiative, and you consent to the transfer of your information to, and its processing in, the United States and any jurisdiction in which our model providers operate, which may not provide the same protection as the laws of your country.

13. Third-party sites

The Services link to and depend on websites, tools and content operated by third parties. We do not control them and are not responsible for their privacy or security practices. Their handling of your information is governed by their own notices, which you should review.

14. Changes to this Notice

We may modify this Notice. When we do, we will revise the “Last updated” date and, for changes we consider material, give at least thirty days’ advance notice by email to the address on your account or by a prominent notice in the Services. Changes take effect on the date stated in the revised Notice, and your continued use on or after that date constitutes acceptance. Where applicable law requires your consent before we apply a materially different use to information already collected, we will obtain it. Prior versions are available on request.

15. Governing terms and disputes

This Notice is incorporated into and forms part of our Terms of Service, which govern your use of the Services and include provisions on disclaimers of warranty, limitation of liability, indemnification, binding individual arbitration, waiver of class actions and jury trial, governing law, and venue. Those provisions apply to any dispute arising out of or relating to this Notice or our handling of information. If this Notice and the Terms of Service conflict, the Terms of Service control, except where applicable law requires that this Notice control. If any provision of this Notice is held unenforceable, the remainder continues in effect.

16. Contact

Questions, requests and complaints about this Notice: Altipoint LLC, a Nevada limited liability company, Attn: Privacy — contact@aistudiolegal.com

We will acknowledge substantive enquiries within a reasonable period and respond to formal requests on the timeline in §10.