Privacy Policy

lawra.io · Version 2026-10-09 · Effective 9 October 2026

This policy explains what personal data we collect on lawra.io, why, who processes it, how long we keep it, and your rights. It applies to visitors, registered users, subscribers and anyone who writes to us.

Lawra is a legal-AI service. That makes one section unusually important, and we have put it early rather than buried it: section 4 explains exactly where the text you type — and the documents you upload — are sent.

1. Who is responsible

The company that handles your data depends on your relationship with us:

For anything about your data, write to privacy@lawra.io.

2. What we collect, why, and on what basis

We do not sell or share your personal data for advertising, we do not build advertising profiles, we do not serve ads, and we do not make decisions about you by automated means alone.

The AI output is not a decision about you. It is a document you asked a tool to draft. Nothing on this site decides anything about your rights, your credit, your employment or your case.

3. Who processes it for us

• Google — hosting (Firebase Hosting), the database (Firestore), file storage for your uploads (Cloud Storage), sign-in (Firebase Authentication), the one server function we run, and Google Analytics until you switch it off. Also Gemini, the AI model behind every tool and the chat, used on its paid tier so that Google does not train on your content (see the next section).
• xAId (CEMI’s own shared sign-in and subscription service, on a separate Google Cloud project) — your identity, your plan and your entitlements, and the Stripe customer record behind your subscription.
• Stripe — card payments, the hosted payment page and the subscription portal.

Within CEMI, only authorised team members can reach account records, and they do so through the Google Cloud console rather than through a tool on this site.

We disclose data to authorities only when the law requires it.

We use no e-mail provider. The site sends no e-mail of any kind: a newsletter sign-up or a contact form writes a record to the database, which our team reads. If you are expecting a reply, it will come from a person’s own mailbox.

4. How the AI tools handle what you type

This is the section that matters most on a legal-AI site, so it says plainly what the code does.

• Your text goes from your own browser straight to Google. When you use the chat, any practice tool, the trial simulator or the Council of Jurists, what you typed is sent directly from your browser to Google’s Gemini service (generativelanguage.googleapis.com). It is not routed through a CEMI server, which means we never see the content of your prompts — we could not produce it if you asked us to, and nor could we hand it over.
• What is sent with it: the tool’s form values, any text you pasted, the profile context you have saved, and — where you have uploaded a playbook and the tool uses it — extracts of that document. Your uploaded files are read and their text extracted inside your browser; the file itself is not sent to the AI, but the text taken from it is.
• Google does not train on it. We use the Gemini API on its paid tier, and Google’s terms for paid use of the Gemini API commit that Google does not use your prompts or the responses to improve or train its models. This is the single most common worry about legal AI, and on this site it is answered by contract rather than by hope. It is a contractual commitment by Google, not something we can enforce technically, and the rest of Google’s terms for the Gemini API govern what else it may do — read them if the point is material to your matter.
• But the text still leaves your browser. Whatever the training terms say, your words are disclosed to a third party. Sending a client’s confidential information to an outside AI service is a professional-responsibility question in its own right in many jurisdictions, and bar guidance commonly treats it as something to consider — and sometimes to obtain the client’s informed consent for — regardless of what the provider promises about training. That judgement is yours as the professional; nothing on this site makes it for you, and nothing here is advice about your own confidentiality duties. If in doubt, leave out the identifying facts: the tools work perfectly well on an anonymised set of facts.
• What we store of it: only what you choose to save — a document you save to your library, a conversation you save, a mock trial you save. If you save nothing, nothing of your prompt stays with us.
• Google is the only AI provider we send your text to. Not Anthropic, not OpenAI, not anyone else. If that ever changes we will update this section and say so before it does.
• We do not log prompt text for monitoring, quality or training — we have no copy of it to log.

5. Where your data is processed

Our providers process data in the United States and other countries, and our two companies are in the United States and the Dominican Republic. We transfer data there because it is necessary to provide the service you asked for, and with your consent where required. Google and Stripe state that they participate in the EU-US Data Privacy Framework; where it does not apply, we rely on standard contractual clauses or on the necessity of the transfer for your contract.

6. How long we keep it

We are describing what the service actually does, not an aspiration:

• Your account, library, saved conversations, profile and uploaded playbooks: kept until you delete them, or until you ask us to close your account. Nothing expires on a timer. Deleting a saved document or an upload removes it; replacing an upload overwrites it in place.
• Share links and saved mock trials: until you delete them. A share link works for as long as it exists.
• Invoices and tax records: 10 years, as Dominican tax law requires for accounting records (Ley 495-06), and at least as long as US tax rules require for the US company. We keep these even if you ask us to delete your account, and we will tell you so.
• Form submissions: as long as needed to answer and follow up.
• Newsletter: until you ask us to remove you.
• Analytics: as set in our Google Analytics property, and in no case used to identify you personally.
• Event registrations and questions: for the event and our record of it.

7. Things that are public on purpose

So that nothing surprises you:

• A share link makes a document readable by anyone who has it. There is no password on it. The token is long and unguessable, but possession of the link is the whole permission.
• Saved mock trials are world-readable. We opened this so simulations could be shown at a live event. A mock trial you save may contain the facts you typed into it, so do not save a simulation built on a real client matter unless you are content for it to be public.
• Comments are published with your display name once a moderator approves them.
• Likes are counted publicly; which article you liked is stored against your account identifier.

You can delete any of these at any time, except a comment, which a moderator removes for you on request.

8. Your rights

You can ask us to:

• access the data we hold about you and know how it is used;
• correct it if it is wrong or incomplete;
• delete it, or object to a use of it;
• switch off analytics at any time, through «Cookie settings» at the bottom of any page, and withdraw any consent you have given us;
• and, if you are in the European Union or the United Kingdom, restrict its use and receive it in a portable format.

Much of this you can do yourself without writing to us: delete documents and uploads from your profile, cancel through the subscription portal, and switch analytics off in the footer.

Otherwise write to privacy@lawra.io from the e-mail you used, and tell us what you need. We answer requests to access your data within 5 business days, and requests to correct or delete it within 10 business days (Ley 172-13). We may ask you to confirm your identity. We keep invoices and other records the law requires us to keep even if you ask us to delete them, and we tell you when that is the case.

If you are not satisfied: in the Dominican Republic you may bring a habeas data action before the courts (Constitution, Art. 70; Ley 172-13). In the European Union or the United Kingdom you may complain to your data-protection authority. In the United States you may contact your state attorney general.

9. Cookies and similar technologies

• Necessary: your language, theme, dark-mode and cookie choices, your free-use counter, and unsent drafts, all kept in your browser’s own storage. They make the site work and need no consent. They never leave your browser.
• Analytics (Google Analytics): on by default, so we can understand how the site is used. You can switch it off at any time through «Cookie settings» at the bottom of any page; we then stop collecting analytics from your browser and the choice is remembered.
• No advertising storage. We deny it outright and do not change that setting.
• Site search runs entirely in your browser. We never see what you search for on this site.
• Do Not Track: we do not track you across other sites. Because there is no common standard for «Do Not Track» signals, the site does not respond to them; your cookie choice controls analytics.

10. Security

We protect your data with per-user access rules on the database, enforced by Google and tested automatically before every release; encrypted connections; access controls on our own team’s reach; and providers with recognised security practices. Your uploaded documents are stored in a per-user location that only your signed-in account can read.

No system is perfectly secure; if a breach affects your data, we will tell you as the law requires.

11. Children

lawra.io is a service for lawyers, law students and businesses, and is not directed to children under 13. We do not knowingly collect personal data from children. If we learn that we have, we delete it.

12. Changes

When this policy changes, we update the version and date at the top and, for significant changes, announce it on the site. The version in force when we collected your data tells you how we used it until the change.

13. Language

This policy is published in several languages. For Dominican users the Spanish version prevails; in every other case, the English version prevails.