Privacy Policy

This Privacy Policy explains how Descrybe, LLC (“Descrybe,” “we,” “us,” or “our”) collects, uses, discloses, and retains information when you visit our website, use the Descrybe Platform or Descrybe Legal Engine, connect a supported AI assistant to Descrybe, subscribe to a service, or contact us for support. In this policy, we refer to these offerings together as the “Services.”

1. Information we collect

Depending on how you use the Services, we may collect the following categories of information:

• Account and license information: your name, email address, authentication identifiers, account status, subscription or license information, and the organization or access program associated with your account, if applicable.
• Payment and transaction information: subscription, checkout, billing-status, and transaction records. Payment-card details are submitted to and processed by Stripe rather than stored by Descrybe as complete card numbers.
• Product content: legal questions, search terms, citations, prompts, uploaded or pasted text, research history, generated results, user feedback, and other information you choose to submit to a Descrybe feature.
• Connector requests: when you invoke Descrybe Legal Engine from a supported AI assistant, we receive the specific tool request that the assistant sends, the account and authorization context needed to confirm access, and limited operational information used to route, secure, and troubleshoot the request. A request may include text selected by you or the assistant, such as a legal question, citation, quoted passage, or requested jurisdiction.
• Support and communications: your email address and the content of messages, support reports, screenshots, diagnostics, and other materials you send us. Support reports may include your IP address, browser or device information, page URL, and submission time.
• Website and usage information: IP address, browser and device information, referring site or domain, pages viewed, product or checkout events, approximate location derived from technical information, timestamps, and cookie or similar identifiers.
• Information from third parties: if you sign in with Google or Microsoft, we receive the name, email address, and account identifier that the provider shares through our authentication service, Clerk. When you connect a supported AI assistant, we receive the authorization information needed to link that assistant to your Descrybe account. Stripe tells us whether a payment succeeded. If your organization purchases a seat for you, it gives us your name and email address so we can invite you.

2. Descrybe Legal Engine and AI assistants

Connecting Descrybe Legal Engine does not by itself give Descrybe access to your entire assistant conversation, documents, email, tenant, workspace, or files. The assistant provider determines what context to include in a particular tool request and applies its own terms, privacy commitments, and administrator settings. Descrybe processes the request it receives and returns legal information and sources to the assistant.

Our current public Legal Engine tools do not provide a file-upload function, although an assistant may include relevant text from your current task in a tool request. Legal Engine application logs and analytics record operational information such as tool name, status, timing, request or session identifiers, provider, and authorization status; they do not record complete tool-argument values.

Your AI assistant writes the response you see. Legal Engine supplies the law behind it and does not use a language model to write answers; its results come from legal data that Descrybe has already processed. Semantic search and passage retrieval send query text to an OpenAI embedding model to find relevant authority, and the Analyze Legal Question tool, when an assistant calls it, sends the question to an OpenAI language model to break it into focused searches. Section 3 describes how OpenAI handles that data.

3. Uploaded documents and AI processing

Descrybe currently accepts document uploads in its brief-review workflows. We read an uploaded document to extract text for analysis and do not deliberately save the original upload as a persistent customer file after extraction. Extracted text and derived review information may remain temporarily in processing systems and may be included in saved review history or operational records.

Descrybe uses third-party AI providers to process certain requests. Our current primary large-language-model provider is OpenAI's API. Depending on the feature, Descrybe may send OpenAI a prompt, selected document text, legal-research context, or other information needed to produce the requested result. OpenAI states that data sent to its API is not used to train its models by default unless the customer opts in; Descrybe has not opted in. OpenAI may retain API data for abuse monitoring or application state as described in its API data-controls documentation.

Descrybe does not use customer prompts, uploaded documents, or research history to train Descrybe-owned models.

4. How we use information

We use information to:

• provide legal research, document-review, connector, account, and subscription functionality;
• authenticate users, confirm entitlements, process payments, and administer licenses;
• save and display product history where the relevant feature provides history;
• secure, monitor, troubleshoot, maintain, and improve the Services;
• respond to support requests and other communications;
• measure website and campaign performance and communicate about Descrybe; and
• comply with law, enforce our agreements, and protect the rights, safety, and integrity of Descrybe, our users, and others.

5. When we disclose information

We disclose information only as reasonably needed to operate the Services, conduct our business, or comply with law. The providers we use may include:

• DigitalOcean for cloud infrastructure, databases, and storage;
• Clerk for authentication and user management;
• Stripe for checkout, subscriptions, billing, and payment processing;
• OpenAI's API for AI processing;
• Resend for email delivery and support reports;
• Mailchimp for newsletter subscriptions and delivery;
• your organization, if it manages your seat: its designated administrators can see your name, email address, and seat and invitation status, but not your research history; and
• analytics and advertising providers, which may include Google, Meta, LinkedIn, Reddit, TikTok, and OpenAI's advertising-measurement service when the relevant tags or campaigns are enabled.

Not every provider receives every category of information. We may also disclose information when required by law; to investigate fraud, abuse, or security issues; to protect legal rights or safety; or in connection with a financing, merger, acquisition, reorganization, or sale of all or part of our business, subject to appropriate safeguards.

Descrybe reviews legal demands for customer information for validity, authority, and scope and seeks to limit disclosure to information legally required. Where legally permitted and reasonably practicable, Descrybe will seek to notify the affected customer before disclosure so the customer may pursue available legal protections. Descrybe may be prohibited from providing notice or may need to delay notice.

Descrybe does not sell customer prompts, uploaded documents, research history, or account information for money. Our website analytics and advertising tools may transmit site activity and associated identifiers to their providers. Some privacy laws use terms such as “sell” or “share” more broadly than an exchange for money.

6. Cookies, analytics, and advertising

We and our analytics or advertising providers may use cookies, pixels, local storage, session storage, and similar technologies to remember session information, understand how visitors use the website, attribute registrations or purchases, and measure advertising. Our website analytics code is designed to omit email addresses, complete checkout-session identifiers, and Stripe or Clerk identifiers from the marketing-event parameters that Descrybe sends.

You can use browser settings and the controls offered by the relevant providers to limit cookies or similar technologies. Blocking them may affect attribution or some website functions.

Our website honors the Global Privacy Control (GPC) signal. When your browser sends it, our website does not load advertising pixels or send advertising-conversion events, and Google Analytics runs with advertising features turned off. You can also opt out of targeted advertising by emailing [email protected].

7. Retention and deletion

We retain information for as long as reasonably necessary to provide and secure the Services, maintain business and financial records, comply with legal obligations, resolve disputes, and enforce agreements. Retention varies by the type of information and the feature involved. Information may remain for a limited period in backups, security records, temporary processing systems, and service-provider systems after it is deleted from an active product view.

• Account, subscription, and transaction records are retained while an account or subscription is active and afterward as reasonably needed for billing, tax, fraud-prevention, dispute, legal, and recordkeeping purposes.
• Saved product history remains available according to the feature involved. Platform users can delete individual history entries; deletion from active views may not immediately remove information from backups, security records, or service-provider systems.
• Brief-review material is handled as described in Section 3. The original upload is not deliberately saved as a persistent customer file after text extraction, while extracted text and derived review information may remain in processing, saved history, or operational records.
• Legal Engine operational records are retained as reasonably needed to authenticate and route requests, enforce entitlements and usage limits, secure and troubleshoot the service, investigate abuse, and maintain required business records.
• Third-party processing records follow the applicable provider's controls and retention practices. OpenAI may retain API abuse-monitoring data for up to 30 days as described in its API data-controls documentation.

You may request deletion of your account or other personal information by contacting us at [email protected]. We may need to verify your identity, and we may retain information where required or permitted by law, including billing, fraud-prevention, security, and transaction records.

8. Your choices and privacy requests

You may update certain account information through the Services, cancel a subscription through the available billing controls, unsubscribe from marketing email by using the link in the message, or contact us to request access to, correction of, or deletion of personal information. We will evaluate and respond to verified requests as required by applicable law.

Depending on where you live, you may have rights under state privacy laws to know what personal information we hold about you, obtain a copy, correct it, delete it, and opt out of targeted advertising or of the “sale” or “sharing” of personal information as those laws define those terms. To exercise these rights, email [email protected]. An authorized agent may submit a request for you with proof of authorization. If we deny your request, you may appeal by replying to our decision. We will not discriminate against you for exercising these rights.

When you use Descrybe through ChatGPT, Claude, Microsoft 365 Copilot, or another third-party assistant, your relationship with that provider is also governed by its privacy policy, terms, account controls, and administrator settings.

9. Security and data location

Descrybe uses administrative, technical, and organizational measures intended to protect information. No system is completely secure. Descrybe's primary customer-data infrastructure is hosted in DigitalOcean's New York City region; service providers may process information in other locations. For more detail, see our Security page.

Descrybe maintains procedures to identify, contain, investigate, remediate, and document suspected security incidents. If Descrybe determines that an incident requires notice, Descrybe will provide notice as required by applicable law or an applicable written agreement.

Our Trust page collects Descrybe's public security, privacy, legal, coverage, and product-evaluation information.

10. Children

The Services are not directed to children under 13. Descrybe does not knowingly solicit or collect personal information from children under 13, and children under 13 may not use the Services.

11. Changes to this policy

We may update this Privacy Policy as our Services and practices change. We will post the revised policy with an updated date and provide additional notice when required by law.

12. Contact us

Questions or privacy requests may be sent to [email protected] or mailed to Descrybe, LLC, 321 Walnut St #312, Newton, MA 02460.