Data Handling

LawyerGPT is built with privacy and compliance at its core. This section outlines how we collect, process, store, and retain your data when you interact with our API.

Data Collection

When you interact with the LawyerGPT API, the following types of data may be collected:

Data Type	Description
Request Payload	The actual legal question, document text, or metadata sent in the API call
Metadata	Includes timestamp, IP address, request ID, and language preferences
API Key Info	API key used, associated organization/project
Usage Metrics	Number of tokens used, latency, endpoint accessed

No personally identifiable information (PII) is required unless you explicitly include it in your queries.

Model Training & Retention

By default, none of your data is used for model training or fine-tuning. All user inputs and outputs are treated as confidential and are not logged persistently beyond the duration of the request, unless you have opted in to logging.

Setting	Behavior
log: false (default)	Input/output is only stored temporarily in memory
log: true	Request/response logged for debugging (retained 7 days)

You can configure this via the log parameter in each API call:

{
  "question": "Explain the difference between a contract and a MoU.",
  "log": false
}

Storage & Encryption

• In-transit: All API communications are encrypted using TLS 1.3

• At-rest: Temporary request logs (if enabled) are encrypted using AES-256

• Data is stored only in ISO/IEC 27001-compliant data centers (currently EU and US regions)

Retention Policy

Data Type	Retention Period	Notes
Transient Data	<1 minute	Discarded after processing
Logged Requests	7 days (opt-in)	For debugging and audit only
Billing & Metrics	90 days	For usage monitoring
API Keys	Until revoked	Stored securely in hashed form

You may request immediate deletion of all logs associated with your API key at any time via our admin panel or support.

Legal Compliance

LawyerGPT complies with:

• GDPR (General Data Protection Regulation)

• CCPA (California Consumer Privacy Act)

• ePrivacy Directive

• SOC 2 Type II security framework

Data Access & Portability

You may request:

• A log history export (if logging was enabled)

• A summary of data usage per API key

• Immediate deletion of all stored data under your account

To make a request, contact [email protected] with your API key and registered email.