THEMIS AI

1. Introduction

The AI Company LTD ("we", "us", or "our") operates THEMIS AI, an AI-powered legal research platform. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our Service.

We are committed to protecting the privacy and confidentiality of the information entrusted to us, particularly given the sensitive nature of legal work.

2. Information We Collect

2.1 Information You Provide

Account Information: Name, email address, organization name, job title, and password when you register
Profile Information: Professional details, preferences, and settings you configure
Documents and Content: Legal documents, case files, and other content you upload to the Service
Queries and Communications: Questions you ask the AI, chat history, and support communications
Billing Information: The details we need to invoice your organisation, such as the billing contact and address

2.2 Automatically Collected Information

Usage Data: Pages visited, features used, time spent, and interaction patterns
Device Information: Browser type, operating system, device identifiers, and IP address
Log Data: Access times, error logs, and referring URLs
Cookies and Tracking: Session cookies, authentication tokens, and analytics data

2.3 AI Interaction Data

When you interact with our AI features, we collect:

Your queries and prompts
AI-generated responses
Feedback you provide on AI responses
Context from uploaded documents used in queries

3. How We Use Your Information

Provide the Service: Process your queries, manage your cases, and deliver AI-powered legal research
Improve the Service: Analyze usage patterns to enhance features and user experience
Customer Support: Respond to inquiries and resolve issues
Security: Detect and prevent fraud, abuse, and security incidents
Communications: Send service updates, security alerts, and (with consent) marketing materials
Legal Compliance: Meet regulatory requirements and respond to legal requests

4. AI and Machine Learning

Important Notice About AI Processing

Your queries and documents may be processed by AI models to provide the Service. We implement strict controls to protect this data.

AI Processing: Uploaded documents are indexed to provide context-aware responses
Model Training: Your documents and queries are not used to train AI models, by us or by the AI service providers we work with
Third-Party AI: AI processing is carried out by the third-party AI service providers listed in section 5.1, under written agreements that do not allow them to retain your data or to train on it, and that require strict access and security controls
Anonymization: Aggregate, anonymized data may be used to improve service quality

5. Data Sharing and Disclosure

We do NOT sell your personal information. We may share data with:

Service Providers: The sub-processors listed in section 5.1, under written contracts
Your Organization: Tenant administrators can access organization-level data
Legal Requirements: When required by law, court order, or to protect our rights
Business Transfers: In connection with mergers, acquisitions, or asset sales (with notice)

5.1 Sub-processors

These providers process your content on our behalf to run Themis. The application itself, its database, its search index and its file storage run on servers we administer in France, not on any of these providers.

Sub-processors: what each does, the data it receives, where it processes it, and the terms that bind it
Sub-processor	What it does	Data it receives	Where	Terms
AI language-model provider	Writes answers and drafts, rewrites questions for searching, and summarises and classifies documents.	Your questions and conversation, the passages of law and of your documents found for them, and text you draft in Scribe.	People’s Republic of China.	Its contract with us does not allow it to retain your data or to train on it.
AI search and document-reading provider	Turns text into search vectors, ranks passages by relevance, reads scanned pages, and extracts the people and organisations a document mentions.	The text of your questions and uploaded documents, passages being ranked, and page images of scanned documents.	Singapore.	Its contract with us does not allow it to retain your data or to train on it.
Email delivery provider	Delivers the emails Themis sends: sign-in codes, invitations and notifications.	Your name and email address, and the content of each email.	Not tied to one region.	The provider’s standard business terms.

6. Data Security

We implement comprehensive security measures including:

Encryption: Data is encrypted in transit between your browser and the Service (TLS 1.3). Credentials you give us, such as single sign-on client secrets, are stored encrypted
Access Controls: Role-based access, per-user and per-organization isolation enforced in the database, and audit logging
Infrastructure: The Service runs on servers we administer in France
Staff Access: Our staff do not access the content of your chats, documents, drafts or Memory, unless the law requires it
Tenant Isolation: Logical separation between tenant data with strict access controls
Incident Response: Documented procedures for security incident detection and response

7. Data Retention

Active Accounts: Data retained while your account is active and as needed for services
Account Deletion: Upon request, we delete personal data within 30 days, subject to legal obligations
Backups: May be retained for up to 90 days for disaster recovery
Legal Holds: Data may be retained longer if required by law or litigation
Ephemeral Files: Temporary uploads are automatically deleted after 24 hours

8. Your Rights

Depending on your jurisdiction, you may have the right to:

Access: Request a copy of your personal data
Rectification: Correct inaccurate or incomplete data
Erasure: Request deletion of your data ("right to be forgotten")
Portability: Receive your data in a structured, machine-readable format
Restriction: Limit how we process your data
Objection: Object to certain processing activities
Withdraw Consent: Where processing is based on consent, withdraw at any time

To exercise these rights, contact us at themis_support@thecompany.ai.

9. Cookies and Tracking

9.1 Types of Cookies We Use

Essential Cookies: Required for authentication and core functionality
Performance Cookies: Help us understand how you use the Service
Preference Cookies: Remember your settings and preferences

9.2 Managing Cookies

You can control cookies through your browser settings. Disabling essential cookies may impact Service functionality.

10. International Transfers

Your data is processed outside Mauritius. Our servers are in France. Our AI processing providers process the content each task needs in the People's Republic of China and in Singapore (see section 5.1), under written contracts that do not allow them to retain your data or to train on it.

11. Children's Privacy

The Service is not intended for individuals under 18 years of age. We do not knowingly collect personal information from children. If we discover that we have collected data from a child, we will delete it promptly.

12. Third-Party Links

The Service may contain links to third-party websites. We are not responsible for the privacy practices of these external sites. We encourage you to review their privacy policies.

13. Changes to This Policy

We may update this Privacy Policy periodically. We will notify you of material changes via email or prominent notice on the Service. Your continued use after changes constitutes acceptance.

14. Data Protection Officer

For privacy-related inquiries or to exercise your rights, contact our Data Protection Officer:

The AI Company LTD Data Protection

Email: themis_support@thecompany.ai

Address: Port Louis, Mauritius

15. Regulatory Authority

If you believe we have not addressed your privacy concerns satisfactorily, you have the right to lodge a complaint with the Data Protection Office of Mauritius or your local data protection authority.