Legal
Privacy Policy
How we collect, store, and use your personal information under the Privacy Act 2020. Last updated 16 August 2026.
Draft — not yet reviewed. This document is a working draft and has not been settled by a New Zealand qualified lawyer. Do not rely on it as a binding statement of our obligations to you until this notice is removed.
1. Who we are
LegalAI is a document assembly and procedural guidance service for people bringing or responding to employment matters in Aotearoa New Zealand. We are the “agency” responsible for the personal information described in this policy, as that term is used in the Privacy Act 2020.
2. What we collect
We collect only what we need to prepare your documents.
- Account information — your name, email address, and authentication factors. Authentication is handled by our identity provider; we never store your password.
- Case material you upload — employment agreements, correspondence, payslips, emails, and any other file you choose to add to a case. This routinely contains sensitive information about you and about other people.
- Case facts you enter — the answers you give in the guided questions, including dates, events, and the people involved.
- Technical logs — request metadata, timestamps, and actions taken on a case, kept as an immutable audit trail.
We do not buy personal information from third parties, and we do not use tracking or advertising cookies. See our Cookie Policy.
3. Why we collect it
Personal information is collected for the lawful purpose of preparing and managing your case documents, calculating procedural deadlines, maintaining an audit record, and operating and securing the service. We do not use your case material to train machine learning models.
4. Third parties who process your information
Running the service requires a small number of sub-processors. Each is bound by contract to use your information only to provide their part of the service.
- Identity and authentication — verifies who you are and issues your session.
- Object storage — stores uploaded files, partitioned so that one tenant’s data is not reachable from another’s.
- Language model providers — process the text of your documents and case facts to produce drafts and to locate relevant statutes and judgments.
Some of these providers process information outside New Zealand. Where that happens we rely on contractual protections intended to meet the comparable safeguards standard in Information Privacy Principle 12.
5. How we store and protect it
- Data is encrypted in transit and at rest.
- Every record is scoped to a tenant, and database row-level security prevents access across tenant boundaries.
- Access is role-based, and every read or write against a case is written to an append-only audit log.
- Files are stored under a path derived from your tenant and case identifiers, and are served only through short-lived signed URLs.
No system is perfectly secure. If we suffer a privacy breach that has caused or is likely to cause serious harm, we will notify you and the Office of the Privacy Commissioner as required by Part 6 of the Privacy Act 2020.
6. How long we keep it
Case material is kept for as long as your case is active and for a retention period afterwards so that you can retrieve your documents. You can delete a case at any time. Audit logs are retained for longer than case material because their purpose is to record what happened; they contain identifiers and actions, not the contents of your files.
7. Your rights
Under Information Privacy Principles 6 and 7 you may ask us to confirm whether we hold personal information about you, to give you access to it, and to correct it if it is wrong. You can export your case material from within the application at any time. To make a request in writing, use the support page.
We will respond as soon as reasonably practicable and within 20 working days. If we refuse a request we will tell you why, and you may complain to the Office of the Privacy Commissioner at privacy.org.nz.
8. Information about other people
Case files usually contain personal information about people who are not you — managers, colleagues, witnesses. You are responsible for uploading only material you are entitled to hold and use for your case. We process it on your behalf for that purpose alone.
9. Changes to this policy
We will post any change on this page and update the date above. If a change materially reduces your protections we will tell you before it takes effect.
10. Contact
Privacy requests and complaints can be made through the support page, which routes to our privacy officer.