How Law Mind handles your information
Implementation and public provider information reviewed September 16, 2026
Law Mind stores your work on its application server and uses outside services for AI answers, website delivery, billing and communications. This page explains those paths alongside our Privacy Policy.
Questions, documents and AI answers
Research and drafting use the Anthropic API. A request can include your question, relevant conversation history, retrieved legal passages and document or matter material selected for the task. Having a local legal library does not make the AI processing local.
We do not use your research content to train models. Anthropic's commercial terms address customer content, and its commercial training policy says it does not train on that content by default. Permission or feedback supplied directly to a provider can have different consequences.
Anthropic describes standard API input/output retention of up to 30 days, with exceptions for certain features, agreed arrangements, safety enforcement and legal requirements. Law Mind does not claim an account-specific zero-retention arrangement or that every provider processes data only in the United States. See Anthropic's retention policy and feature-specific retention.
Services involved in delivering Law Mind
These descriptions identify the information used for each purpose. An outside service may retain its own account, security or legally required records under its applicable terms.
- Website delivery — Cloudflare
Cloudflare routes and protects traffic between your browser and Law Mind. That traffic includes request content and connection information, such as IP addresses. Hosting the application on our own server does not remove this delivery path. Cloudflare data processing terms.
- Account email — Microsoft 365, managed through GoDaddy
Account verification, password recovery and firm invitations use Microsoft Graph to send email from [email protected]. The service processes recipient addresses, subjects and message bodies. Sent messages are saved in the sender mailbox. The application has send/profile authorization; it does not request permission to read your mailbox. Mailbox retention and legal holds have their own settings.
The optional Word add-in loads Microsoft's Office scripts and can send the selection or document text you choose to Law Mind for the requested task. Your Word or Microsoft 365 account has its own storage and permissions. Microsoft data protection terms.
- Billing — Square
Billing can send your display name, email, account reference and subscription information to Square. Payment information is processed through Square. Research questions and uploaded document text are not part of the inspected billing payloads. Square can have its own processing and recordkeeping obligations. Square data processing terms.
- Account and subscription email lists — Kit
Signup and subscription events can send an email address, an optional first name and a trial, paying-customer or lapsed tag to Kit. This path does not send research questions or documents. Contact support for a request involving our email list. Kit data processing terms.
- Citation and public-source lookup — CourtListener and source publishers
The citation lookup sends reporter, volume and page identifiers to CourtListener. Requests for public sources identify the document being retrieved. A source link you open also connects your browser to that publisher. The publisher's own privacy terms apply to those requests. CourtListener policies.
- Fonts and page resources — Google Fonts and jsDelivr
Pages can request fonts from Google Fonts; some reference pages load a script from jsDelivr. These services receive the usual connection and resource-request information. Listing a service here does not mean research documents are submitted to it for AI processing.
- Optional clinic browser notifications
If you enable clinic notifications for a browser, its push service can be operated by Google, Apple, Mozilla or Microsoft. Law Mind sends an encrypted generic update and an opaque reference, rather than matter names or document text. Opening the update requires current access in Law Mind. Deadline reminders in the practice tools are private in-app reminders and calendar exports.
- Support alerts — Telegram and our internal issue system
Automated feedback alerts contain a report number and an instruction to sign in, rather than the feedback text or account name. Login-failure alerts contain aggregate counts. Full feedback stays in the protected application. Telegram retains delivered alerts under its own privacy policy.
- Optional community skill sources — GitHub
Using the community skill manager can request the repository, version and source files you select from GitHub. This is a source-download path; it does not send your research conversation to GitHub.
Sharing, access and encryption
Private saved research belongs to its account. Matter sharing follows the current firm and matter permissions. Access can change when membership changes. An authorized member can retain shared firm records after another person's account is deleted.
Saved research uses server-side encryption and authenticated access checks. Service operators hold the server keys and administer the systems. This is not a claim that every file, metadata field or operational log is encrypted at rest. Authenticator MFA is available for individual enrollment; it is not enforced for every account.
What is retained and what deletion does
- Saved work and uploads: retained to provide the workspace. Account removal deletes private content and private uploads; file-cleanup failures remain recorded for retry.
- Shared firm work: retained for surviving authorized firm members under the shared-record rule. Deleting an individual's account does not erase the firm's records.
- Product activity counts: a rolling 90-day window, cleaned on activity and by the hourly retention task. These counts exclude prompts, answers, document identities and IP addresses; account deletion removes the account's counts.
- Failed-login records: older than 30 days are pruned when another login failure is recorded. This is not an independent daily purge of every security log.
- Other operational, audit and billing records: have separate purposes. There is no single automatic 30-day or 90-day deletion promise for all of them.
- Provider-held records: deleting a Law Mind account does not automatically erase Square records, Kit subscriptions or copies in an email mailbox. Requests involving those records need separate handling, subject to the provider's obligations. Active billing must be canceled before account removal.
Contact [email protected] for access, correction, export, deletion or a provider-specific request. If your firm requires a particular processing location, retention agreement or contractual safeguard, confirm that requirement with us before relying on it. Public provider policies and tested application controls do not establish a separately negotiated agreement.