Privacy policy.

1.Scope and definitions

This Privacy Policy applies to all personal data processed by Xycora Technology Limited ("Xycora", "we", "us") in connection with the Xycora platform and any related services. The following defined terms apply throughout this document:

• Firm Data: all content, documents, and data uploaded by your firm to the platform, including matter files, evidence, correspondence, and any annotations or outputs generated during use.
• Processor: Xycora, acting only on your documented instructions in relation to the processing of personal data contained in Firm Data.
• Controller: your firm, as the entity that determines the purposes and means of processing personal data held within Firm Data.
• Privileged Communication: any content within Firm Data that is subject to attorney-client privilege or legal professional privilege under applicable law.
• Sub-processor: any third-party AI provider or infrastructure provider that processes Firm Data on our behalf in order to deliver the contracted service.

2.Data we collect

We collect and process personal data across three categories:

• Account data: name, email address, firm name, billing contact details, and role and permission settings assigned within the platform.
• Matter data: documents uploaded to the platform, AI prompts and outputs generated during use, the full audit trail of platform activity, and any annotations or work product created within Xycora.
• Technical data: SHA-256 hashed IP addresses, truncated user-agent strings, timestamps, and error logs collected automatically to support platform security and reliability.

3.Purpose of processing

We process each category of data for the following purposes, under the lawful bases indicated:

• Account data: to deliver and administer your subscription, including account management, billing, and support. Lawful basis: performance of a contract (GDPR Article 6(1)(b)).
• Matter data: to provide the AI-assisted legal analysis, document processing, and drafting services described in your subscription. Lawful basis: performance of a contract (Article 6(1)(b)); legitimate interest for security monitoring and audit retention (Article 6(1)(f)).
• Technical data: for platform security monitoring, incident investigation, and service improvement. Lawful basis: legitimate interest (Article 6(1)(f)).

4.Zero-training commitment

Firm Data is never used to train any foundation model or fine-tuned model, whether owned by Xycora or by any sub-processor. This is a contractual commitment reflected in our sub-processor agreements with Anthropic, OpenAI, and Google. No prompt, document, or output generated on the Xycora platform is used for model training purposes under any circumstances.

5.Sub-processors

We engage the following sub-processors to provide the platform. Each is bound by a data processing agreement that imposes obligations equivalent to those in this policy:

We will provide 30 days' advance notice to account owners before adding any new sub-processor that processes Firm Data.

6.Data retention

Except for short-lived records that expire automatically, such as notifications and one-time links, Xycora does not apply fixed retention periods to Firm Data. Subject to any overriding legal-hold obligations, Firm Data is retained for the duration of the customer's subscription unless it is deleted earlier, as follows:

• Matter data: documents, notes, AI prompts and outputs, and saved AI conversations are kept until they are deleted by an authorised user or until Firm Data is deleted under this section. Some records that a user deletes, such as saved AI conversations, are removed from view but retained until Firm Data is deleted under this section.
• Audit events: kept for the duration of the subscription. Users cannot delete them.
• Backups: databases are protected by point-in-time recovery, which keeps a continuous backup for 35 days. Stored files are kept in versioned storage, so earlier versions of a file remain after it is replaced or deleted until they are permanently removed under this section.

Firm Data will be deleted from Xycora's systems, including earlier versions of stored files, within 30 days of a written deletion request, subject to any applicable legal-hold obligations communicated to Xycora in advance. Copies held in database backups expire no later than 35 days after deletion. Early deletion can be requested at any time by contacting [email protected].

7.Hosting location

Xycora hosts the platform and stores Firm Data with Amazon Web Services in the AWS us-east-1 region (Northern Virginia, United States). Firm Data is processed in the United States, including by the AI sub-processors listed in section 5, whatever the customer's location. Traffic between users and the platform passes through Cloudflare's global network, so data in transit may be handled at a Cloudflare location near the user before it reaches the United States.

8.Security

Xycora implements and maintains the following technical and organisational measures to protect Firm Data. The same measures form Annex A of the Data Processing Addendum.

1. Encryption in transit between your browser and Xycora and between Xycora and its providers, and encryption at rest for every document and record.
2. A separate encryption key for each firm, held in a managed key service. Xycora staff cannot read a firm's protected data with it.
3. Pseudonymisation of documents and AI requests: names, addresses and identifiers in a document are found by an automated detection step that sends the document's text to OpenAI, a sub-processor listed in section 5, and are then replaced by placeholders specific to the firm before any AI engine answers questions about, analyses or drafts from the document; the same step runs on the text of every AI request from a firm with the anonymiser on, before it reaches the engines that answer; the mapping is encrypted under the firm's key; one original and one protected copy are kept for each document uploaded once the anonymiser is on (the anonymiser).
4. Role-based access control (owner, admin, lawyer, paralegal, viewer) and per-matter permissions, enforced on the server, with strict separation between firms.
5. Password-based sign-in with passwords stored only in hashed form; two-step sign-in available to every person and enforceable by the firm; sessions that expire and can be revoked.
6. An append-only audit trail of sign-ins, access, sharing, role changes and AI actions.
7. Document sealing to named recipients and electronic signing of PDFs with a key held per person in the managed key service, available to every firm.
8. Continuous backups and deletion protection on all stored data.
9. Automated dependency, code and secret scanning on every change before deployment.
10. Incident response: notification to the firm without undue delay, as set out in section 11.

9.Privileged communications

Xycora processes Privileged Communications only to provide the platform to the customer, including the automated AI processing that runs when a user uploads a document or uses an AI feature. No Xycora employee reviews the content of customer documents except (a) with the customer's prior written consent, or (b) under a valid court order or other binding legal obligation, in which case we will notify the customer as promptly as is legally permissible unless prohibited from doing so by law.

10.Your rights

Subject to applicable law, you have the right to access, correct, delete, export, restrict the processing of, and object to the processing of your personal data. All requests should be directed to [email protected] and will be fulfilled within 30 days. Where you are located in the EEA, UK, or Switzerland, you also have the right to lodge a complaint with your local data protection supervisory authority.

11.Security incident response

In the event of an actual or reasonably suspected personal data breach affecting Firm Data, Xycora will notify the affected customer without undue delay, and in any event within 72 hours, after becoming aware of it, and will provide further information about the breach as it becomes available. Security incidents should be reported to [email protected].

12.International transfers

Where Firm Data is transferred from the European Economic Area or the United Kingdom to countries that have not received an adequacy decision, the transfer is governed by the Standard Contractual Clauses approved by the European Commission under Decision 2021/914 (EU SCC 2021) and, where applicable, the UK International Data Transfer Addendum (IDTA) issued by the ICO, and the Swiss-US Data Privacy Framework. Executed copies of applicable SCCs are available on request.

13.Age restriction

The Xycora platform is intended solely for use by professional legal practitioners and authorised firm personnel. The platform is not directed at and should not be used by any person under the age of 18.

14.Contact

For all privacy-related enquiries, please contact: [email protected].

Data Protection Officer: Legal Team, Xycora Technology Limited, [email protected].

15.Updates to this policy

We will provide at least 30 days' advance notice of any material changes to this Privacy Policy via email to account owners. Continued use of the platform following the effective date of a revised policy constitutes acceptance of those changes.