Privacy Policy (United States)
Last Updated: October 2026
This Privacy Policy applies to accounts and visitors in the United States. For India, see the India Privacy Policy.
1. Who We Are
AnrakLegal in the United States is operated by Anrak Pte. Ltd. ("AnrakLegal," "we," "our," or "us"). This Policy explains how we collect, use, disclose, and protect personal information when you visit our website or use our legal research, drafting, document review, and matter management platform (the "Services").
Questions about this Policy can be sent to privacy@anrak.legal.
2. Our Role
- Client and matter content. When a law firm, legal department, or other business customer uploads documents, matter files, or client information, we process that content on the customer's behalf as its service provider (processor). The customer decides what is uploaded and how it is used, and individuals whose information appears in that content should direct requests to the customer.
- Account, website, and marketing data. For account details, billing records, website analytics, and marketing communications, we decide how the information is used, and this Policy governs it.
3. Notice at Collection: Information We Collect
In the past 12 months we have collected the following categories of personal information. We collect it directly from you, automatically from your device when you use our website and Services, and from third parties such as sign-in providers, payment processors, and your organization.
| Category | Examples | Sources | Business purposes | Retention |
|---|---|---|---|---|
| Identifiers | Name, email address, account ID, IP address, device identifiers | You; your device; your organization if it provisions your account | Creating and securing your account, providing the Services, support, security | While your account is open, then typically 90 days after closure |
| Customer records and commercial information | Plan, order forms, invoices, transaction history, billing contact details | You; your organization; our payment processors | Billing, account administration, tax and accounting compliance | As long as required by tax, accounting and other legal obligations |
| Internet or other network activity | Features used, session timestamps, navigation, error and performance logs | Your device and browser, cookies and similar technologies | Operating and improving the Services, security, analytics, measuring our advertising | Usage and security logs up to 12 months, then deleted or anonymized |
| Approximate geolocation | Country, region or city inferred from your IP address | Your IP address | Showing the right jurisdiction experience, security and fraud prevention | With the related usage and security logs |
| Professional or employment information | Organization or law firm, role, bar admission details you choose to provide | You; your organization | Configuring your workspace, account administration, sales follow-up you request | While your account is open |
| Audio information | Recordings and transcripts, only when you use transcription or Court Mode features | You | Providing the transcription feature you requested | Until you delete them or close your account |
| Sensitive personal information | Account login credentials; any sensitive information contained in content you choose to upload | You | Authentication, security, and providing the Services you request | Credentials while your account is open; uploaded content until you delete it (backups up to 30 days) |
Recipients. We disclose each category above to the service providers that help us deliver the Services (hosting, database and storage, AI model providers, speech-to-text, PII redaction, email delivery, payment processing, analytics, and connected apps you choose to link). How we protect information with them is described on our Security page. We may also disclose information when required by law, to protect rights and safety, or in connection with a merger or acquisition.
Uploaded content. Documents, prompts, drafts, and notes you upload or create may incidentally contain any type of information, including sensitive information about you or others. We process that content only to provide the Services you request.
4. How We Use Personal Information
- Providing legal research, document analysis, drafting, transcription, and matter management features
- Creating, authenticating, and securing accounts
- Billing, invoicing, and account administration
- Sending service notices, security alerts, and responses to your requests
- Analyzing aggregated usage to fix problems and improve the Services
- Detecting and preventing fraud, abuse, and unauthorized access
- Measuring the effectiveness of our advertising on our marketing website
- Complying with legal obligations and enforcing our Terms of Service
5. AI Processing and Confidentiality
- We do not use your content to train or fine-tune third-party AI models.
- By default, personally identifiable information is redacted from case documents before they are processed by third-party AI models. If redaction has not completed, processing of that content is withheld rather than sent unredacted.
- Conversation history is kept to provide context within your sessions, and you can delete it at any time.
- We may use aggregated, de-identified usage patterns (not your content) to improve the Services.
See our Security page for how data is protected.
6. Sale and Sharing of Personal Information
We do not sell personal information for money. Our marketing website uses Google advertising and analytics tags (Google Ads conversion tracking and Google Analytics). Under California law, allowing these tags to collect information about your visit may be considered "sharing" personal information for cross-context behavioral advertising, and under some other state laws it may be considered a "sale" or "targeted advertising." The categories involved are identifiers (such as cookie IDs and IP address) and internet or network activity on our website.
You can opt out using the Your Privacy Choices section below. We also honor Global Privacy Control (GPC) browser signals as a valid opt-out request for the browser that sends them. We treat GPC as the opt-out signal and do not respond to other "Do Not Track" signals.
We do not knowingly sell or share the personal information of consumers under 16 years of age.
7. Your Privacy Choices (Do Not Sell or Share)
Opting out turns off advertising personalization from our Google tags in this browser. The choice is stored in a cookie, so repeat it on each browser or device you use, and again if you clear your cookies. Signed-in users can also email privacy@anrak.legal to opt out for their account.
This browser is not opted out.
The choice is stored in a cookie in this browser. Clearing cookies resets it.
8. Sensitive Personal Information
We use sensitive personal information, such as account login credentials, only for purposes permitted by law: to provide the Services you request, to keep accounts and the Services secure, and to prevent fraud. We do not use or disclose it to infer characteristics about you. Because of this, we do not offer a separate "Limit the Use of My Sensitive Personal Information" option.
9. Your State Privacy Rights
Depending on where you live, including California and other states with comprehensive privacy laws (such as Virginia, Colorado, Connecticut, Utah, Texas, and Oregon), you may have the right to:
- Know and access the personal information we have collected about you, including the categories, sources, purposes, and recipients
- Delete personal information we collected from you, subject to legal exceptions
- Correct inaccurate personal information
- Portability: receive your information in a portable, machine-readable format
- Opt out of the sale or sharing of personal information and of targeted advertising
- Non-discrimination: we will not deny service, charge different prices, or provide a different quality of service because you exercised a privacy right
- Appeal a decision we make about your request
How to submit a request
- Signed-in users: use the Data & Privacy page in your account
- Anyone: email privacy@anrak.legal
Verification. To protect your information, we verify requests by matching details you provide against information we already hold, usually by confirming control of the email address on your account. We will not ask for more information than we need to verify you.
Authorized agents. You may use an authorized agent to submit a request. We may ask the agent for signed permission from you and may ask you to verify your identity directly, unless the agent holds a valid power of attorney.
Timing. We respond to verified requests within 45 days. Where the law permits, we may extend this period once and will tell you why.
Appeals. If we deny your request, you may appeal by emailing privacy@anrak.legal with the subject "Appeal." If we deny your appeal, you may contact your state Attorney General.
Customer content. If your information appears in content a customer uploaded (for example, a law firm's matter file), we will refer your request to that customer and assist it as its service provider.
10. Where Your Information Is Stored and Processed
- Account information, matters, documents and conversations are currently stored in our primary database and file storage in India. We are moving storage for accounts in the United States to a US region and will update this Policy when that move is complete.
- For accounts in the United States, AI model requests are routed to model infrastructure in US regions where that routing is available.
- Some service providers, such as speech-to-text, PII redaction, and connected apps you choose to link, may process information in other countries.
When information is transferred across borders, we rely on contractual commitments with our service providers to protect it.
11. Security
We maintain reasonable administrative, technical, and physical safeguards designed to protect personal information, including:
- TLS/HTTPS encryption for data in transit
- Encryption of data at rest
- Logical isolation of each account's content and role-based access controls
- Monitoring for unauthorized access
No system is completely secure. If a security breach affects your personal information, we will notify you and any required authorities as required by applicable state law.
12. Retention
We keep personal information for as long as your account is open and as needed for the purposes in this Policy. Documents and matters stay until you delete them or close your account; deleted documents may remain in backups for up to 30 days. Billing and transaction records are kept as long as tax, accounting, and other laws require. The retention period for each category is listed in Section 3.
13. Children
The Services are intended for users 18 and older and are not directed to children under 13. We do not knowingly collect personal information from children under 13. If you believe a child has given us personal information, contact us and we will delete it.
14. Marketing Communications
- You can unsubscribe from marketing emails at any time using the link in the email.
- We call or text you about our products only with your express consent, which is never a condition of purchase. Reply STOP to any text message to opt out of texts.
- Service and security messages about your account continue while your account is open.
15. Changes to This Policy
We may update this Policy from time to time. We will post the updated version here with a new "Last Updated" date and, for material changes, notify account holders by email or in the Services before the changes take effect.
16. Contact Us
Anrak Pte. Ltd.
Email: privacy@anrak.legal
Or use our contact page.