Privacy Policy

Effective date: May 1, 2026

Summary: Vaquill AI is a legal-AI software tool built for US-licensed lawyers and small law firms. We do not sell your personal information. We do not train AI models on your content. Customer Data is hosted on cloud infrastructure in the United States (see Section 6 for the breakdown), encrypted at rest and in transit, and every third-party LLM sub-processor operates under a zero-data-retention agreement.

1. Introduction & Scope

Vaquill AI, operated by Aralsura Solutions LLP, an India-registered limited liability partnership (“Aralsura,” “Vaquill AI,” “we,” “our,” or “us”), provides a legal-AI software tool for US-licensed lawyers and law firms of up to fifteen lawyers. This Privacy Policy explains what information we collect, how we use it, how we share it, and the rights you have over it when you use our website, applications, and APIs (together, the “Service”).

This policy applies to visitors, trial users, paying customers, firm administrators, and individual lawyers who use the Service. If you are an employee of a law firm that has purchased Vaquill AI, your firm’s subscription agreement also governs how your firm’s data is handled.

2. Information We Collect

2.1 Account Information

  • Name, work email address, and password (hashed)
  • Firm name and size
  • State bar jurisdiction(s) and bar number, if you choose to provide them
  • Practice area(s)
  • Firm administrator role and seat assignments

2.2 Content You Upload or Create (“Customer Data”)

  • Documents, briefs, contracts, and other files you upload
  • Matter metadata, client references, and notes
  • Prompts, questions, and instructions you submit to the AI
  • AI-generated outputs you choose to save

Customer Data is stored under your firm’s tenant and is only accessible to users your firm has authorized. See Section 4 for our no-training commitment.

2.3 Usage Analytics

  • Pages visited, features used, and queries run (aggregated; not tied to the content of your prompts)
  • Error logs and performance telemetry
  • Session duration and approximate frequency of use

2.4 Device & Technical Information

  • IP address and approximate location (city/region)
  • Browser type and version
  • Operating system and device type
  • Referring URL and timestamps

2.5 Payment Information

Billing is processed by Dodo Payments (USD billing), a PCI-DSS-compliant payment processor. Vaquill AI never receives or stores full card numbers or bank credentials. From the payment processor we receive only the transaction status, the last four digits of the card, expiration date, billing address, and invoice metadata needed for tax and accounting purposes.

2.6 Cookies & Similar Technologies

We use a small number of strictly necessary cookies (for authentication and session management) and privacy-respecting analytics cookies. You can manage cookie preferences through your browser settings. We honor the Global Privacy Control (see Section 9).

3. How We Use Information

We use the information described above only for the following purposes:

  • Product operation: to authenticate users, deliver AI outputs, store your matters, and keep the Service running.
  • Customer support: to respond to questions, diagnose bugs, and restore access when needed.
  • Billing: to process subscription payments, issue invoices, and prevent fraud.
  • Security: to detect abuse, enforce acceptable use, and maintain system integrity.
  • Product improvement: to analyze aggregated, de-identified usage patterns so we can ship better features.
  • Legal compliance: to meet tax, accounting, and regulatory obligations in the US.

We do not use Customer Data to train AI models. See Section 4.

4. We Do Not Train AI Models on Your Data

Your uploaded documents, prompts, outputs, and matter data are never used to train Vaquill AI’s AI or our third-party LLM providers’ models. Our LLM sub-processors operate under zero-data-retention (ZDR) agreements, meaning they do not persist your prompts or outputs beyond the time required to return a response.

This commitment exists to support your confidentiality obligations under ABA Model Rule 1.6 and parallel state rules. If we ever change this practice, we will give you advance notice and a meaningful opportunity to opt out before any change takes effect.

5. How We Share Information

We do not sell or rent personal information. We do not “share” personal information for cross-context behavioral advertising as those terms are defined under the CCPA/CPRA.

We share information only with the sub-processors and parties listed below:

5.1 Sub-processors

The categories below summarize the kinds of vendors Vaquill AI engages. Each sub-processor is bound by a written data-processing agreement. The current sub-processor register, with the specific provider names, regions, and per-vendor data scope, is available to customers and their counsel on request at contact@vaquill.ai.

  • Cloud infrastructure & managed services (US): application hosting, managed database and authentication, object storage for documents, content delivery / DDoS protection, and vector search.
  • LLM inference (zero-data-retention agreements): our LLM providers do not retain prompts or outputs beyond the response and do not use them to train models.
  • AI services (non-LLM): text embeddings and reranking for retrieval, and OCR for scanned document uploads.
  • Payments: a PCI-DSS-compliant payment processor for US-dollar billing.
  • Operational tooling: transactional email, error tracking (stack traces only, no customer-document content), product analytics (org-scoped events only), and LLM trace observability.
  • Optional integration partners (only when a customer enables the integration): Slack, WhatsApp Business, Google Drive, and Zoho CRM each receive data only when the customer turns on that specific integration.

All sub-processors are contractually required to use information only to provide services to Vaquill AI and to protect it with administrative, physical, and technical safeguards that are no less protective than our own.

5.2 Legal & Safety

We may disclose information when required to:

  • Comply with a valid subpoena, court order, or other lawful process;
  • Enforce our Terms of Service or investigate suspected violations;
  • Protect the rights, property, or safety of Vaquill AI, our customers, or the public.

Where legally permitted, we will notify the affected firm administrator before producing Customer Data in response to legal process so they can seek a protective order.

5.3 Business Transfers

If Vaquill AI is involved in a merger, acquisition, financing, or sale of assets, information may be transferred to the successor entity, subject to the commitments in this Privacy Policy.

6. Data Location & Security

  • Location: Customer Data is processed and stored in the United States, inside reputable Tier-IV data centers operated by our infrastructure sub-processors:
    • Application servers run in the United States.
    • Structured records (accounts, matters, audit logs) live in a managed Postgres database in an AWS US region.
    • Uploaded documents are stored in US object-storage regions.
    • Vector embeddings of legal corpus and customer documents are stored in a US-hosted vector index.
  • Encryption: AES-256 encryption at rest and TLS 1.3 in transit. OAuth tokens for connected integrations are additionally column-encrypted via a vault-backed pgcrypto helper before persistence, so a database dump alone cannot recover them.
  • Tenant isolation: Each firm’s data is logically segregated so that users from one firm cannot access another firm’s content.
  • Access controls: Role-based access controls, MFA for employees, least-privilege permissions, and internal access logging.
  • Audit logs: System and administrative actions are logged and reviewed.
  • Vulnerability management: Routine dependency scanning and periodic third-party penetration testing.

Customers requiring a single-region or dedicated deployment should contact contact@vaquill.ai for an Enterprise plan with regionally-scoped hosting.

No system is 100% secure. Please use a strong, unique password, enable multi-factor authentication, and notify us promptly if you suspect unauthorized access to your account.

7. Data Retention

  • Account data: retained while your account is active and for up to 30 days after cancellation, then deleted or anonymized.
  • Customer Data (matters, documents, prompts, outputs): exportable for 30 days after cancellation, then deleted from production systems. Residual copies in encrypted backups are purged on our standard backup rotation.
  • Billing records: retained for up to seven years to meet US tax and accounting requirements.
  • Support correspondence: retained for up to three years.
  • Security logs: retained for up to 13 months.

8. Your Rights Under US State Privacy Laws

8.1 California (CCPA/CPRA)

If you are a California resident, you have the right to:

  • Know: request that we disclose the categories and specific pieces of personal information we have collected about you.
  • Delete: request deletion of personal information we have collected from you.
  • Correct: request correction of inaccurate personal information.
  • Portability: receive a copy of your personal information in a portable, machine-readable format.
  • Opt out of sale or sharing: Vaquill AI does not sell or share personal information; see Section 10.
  • Limit use of sensitive personal information: Vaquill AI does not use sensitive personal information for purposes that would trigger this right, but you may still submit a limit request.
  • Non-discrimination: we will not discriminate against you for exercising any of these rights.

To exercise your rights, email contact@vaquill.ai with the subject “CCPA Request” or use our intake form (linked on the Contact page). We will respond within 45 days and may extend once by an additional 45 days if reasonably necessary, with notice to you.

8.2 Virginia, Colorado, Connecticut, Texas, Utah, and Other US States

Residents of Virginia (VCDPA), Colorado (CPA), Connecticut (CTDPA), Texas (TDPSA), Utah (UCPA), and other states with comprehensive privacy laws have substantially equivalent rights, including the right to access, delete, correct, and obtain a portable copy of their personal data, and the right to opt out of targeted advertising, sale, and certain profiling. To exercise these rights, use the same contact methods as Section 8.1.

8.3 How to Submit a Request

  • Email: contact@vaquill.ai (subject: “Privacy Request”)
  • Web form: linked from the Contact page.
  • Response timeframe: within 45 days, extendable once by 45 days with notice.

We will verify your identity using information already associated with your account before fulfilling a request. If we cannot verify you, we will explain why and ask for additional information.

8.4 Appeals

If we deny your request, you may appeal by replying to our decision email within 45 days. We will respond to your appeal within 60 days. If your appeal is denied, you may contact your state’s attorney general (Virginia, Colorado, Connecticut, and other states with explicit appeal provisions).

8.5 Authorized Agents

California residents may designate an authorized agent to submit requests on their behalf. We will require written authorization signed by you and verification of your identity before acting on an agent’s request.

9. Global Privacy Control (GPC)

We honor Global Privacy Control signals sent by your browser as a valid opt-out of “sale” and “sharing” as those terms are defined under the CCPA/CPRA and parallel state laws. Because we do not sell or share personal information in the first place, a GPC signal does not change our handling of your data, but we record and respect it.

10. Do Not Sell or Share My Personal Information

Vaquill AI does not sell or share personal information for monetary or other valuable consideration, and we do not disclose personal information for cross-context behavioral advertising. We disclose this pursuant to the CCPA/CPRA even though no opt-out is strictly required.

If you would still like to formally submit a Do-Not-Sell-or-Share request, email contact@vaquill.ai with the subject “Do Not Sell or Share.” We will record your request and confirm receipt.

11. GDPR / UK GDPR

The Service is designed for US-licensed lawyers, and the overwhelming majority of our users are located in the United States. If you access the Service from the EEA, UK, or Switzerland, Vaquill AI is the controller of your personal data for the purposes of the GDPR and UK GDPR. The legal bases on which we rely are: performance of a contract (for account and billing data), legitimate interests (for analytics and security), and consent (for optional marketing).

You have the rights of access, rectification, erasure, restriction, portability, objection, and to lodge a complaint with your national data-protection authority. You may exercise these rights by contacting contact@vaquill.ai.

Transfers of personal data from the EEA, UK, or Switzerland to the United States are currently made under Standard Contractual Clauses (with the UK International Data Transfer Addendum where applicable).

12. Children’s Privacy

The Service is intended exclusively for licensed lawyers and their authorized firm staff, all of whom must be at least 18 years of age. We do not knowingly collect personal information from anyone under 18. If you believe a minor has provided personal information to us, contact contact@vaquill.ai and we will delete it.

13. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will revise the effective date at the top of this page. For material changes, we will notify you by email or through an in-product notice before the change takes effect. Your continued use of the Service after a change indicates your acceptance of the updated policy.

14. Contact Us

Related Policies