Privacy Policy

Overview

Cedent AI, Inc. ("Cedent," "we," "us") is committed to protecting the privacy and confidentiality of our users' data. This policy describes how we collect, use, and protect information when you use our AI matter assistant platform and marketing website.

Cedent handles three different kinds of information, and our role is not the same for each. For some of it, we decide how it is used. For the rest, which is most of what the platform holds, a law firm decides and we act only on that firm's instructions. The next section sets out which is which. It is worth reading, because it determines who you contact to exercise your rights over your information.

The Information We Handle, and Our Role

1. Website visitor information. We decide how this is used. When you join our waitlist, we collect your email address and county selection. We use Google Analytics to understand how visitors find and use this site, and to measure the performance of our advertising. Google Analytics sets cookies and collects information such as your approximate location, device and browser, the pages you view, and the referring site or ad that brought you here. You can opt out using Google's browser add-on, or by blocking cookies in your browser. This applies to the marketing website only. We do not run advertising or marketing analytics inside the Cedent platform, and we do not use matter data for advertising.

2. Account information. We decide how this is used. When a firm opens a Cedent account, we collect the names, email addresses and roles of the people who use it, together with billing details and records of how the platform is used. We use this to operate your account, support you, secure the service, and improve the product.

3. Matter data. Your law firm decides how this is used, and we act on its instructions. This is the substance of the platform: the emails, attachments, documents, filings, deadlines, contacts and case information that flow through a matter. It includes information about a firm's clients, opposing parties, opposing counsel, courts, witnesses and others connected to a matter. Under data protection law, the firm is the controller of this information and Cedent is a processor. We process it only to deliver the service to that firm, on that firm's instructions, and for no purpose of our own. We do not use it for advertising, we do not sell it, and we do not use it to train AI models.

Google Workspace Data

If you connect a Google account, Cedent requests only the permissions listed below. We request the narrowest permission that delivers each feature, and we do not request broad mailbox or Drive access.

The mail, calendar and file content we access through these permissions is matter data in the sense described above. Your firm is the controller of it and Cedent is a processor.

How this data is shared and retained. Google user data is processed to deliver the features above and for no other purpose. It is not sold, and it is not shared with third parties other than the infrastructure providers listed under Sub-processors below, each of which processes it on our instructions. Message and document content is retained for as long as the matter is active in your account. You can disconnect a Google account at any time, which revokes our access immediately. You may request deletion of the data at any time.

Limited Use. Cedent's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We do not use Google Workspace data to train, retrain, or improve any generalized or standalone AI model.

Automated Processing and AI Agents

Cedent is an AI matter assistant, so it is important you understand what it does on its own. When mail arrives in a connected mailbox, automated agents read it, along with any attachments, and act on what they find without waiting for you to open the message. That processing is how your timeline, case summary and suggested deadlines stay current.

These agents are source-grounded and approval-gated. They can organize information, record facts and dates against a matter, and prepare draft replies and tasks. Actions that leave your account, including sending mail and writing to your calendar, are held for your review and require your approval. The content the agents read is sent to our AI provider for processing at the time of the request, and is not used to train models.

We do not make automated decisions that produce legal effects concerning you. An attorney remains in control of every outbound action.

If Your Information Reached Us Through a Law Firm

You may be reading this because a law firm that uses Cedent holds information about you. Perhaps you corresponded with that firm, are a client of it, or are a party, opposing counsel, witness or other participant in a matter it handles. When a firm connects a mailbox to Cedent, the messages and attachments in it, including ones you sent, are processed on that firm's behalf.

We do not have a direct relationship with you, and we do not decide what happens to that information. The firm does. If you want to access, correct or delete information held about you, or object to how it is processed, please contact the law firm directly, because it is the controller of that information. If you contact us instead, we will refer you to the firm and assist the firm in responding where it asks us to.

Some of what a firm holds may be privileged or subject to other professional obligations, which can affect how, and whether, the firm is able to act on such a request. That is a matter for the firm and its own legal duties, not for Cedent.

Sub-processors

We use the following providers to deliver the service. Each processes data on our instructions and under contract.

• Amazon Web Services (including Amazon Bedrock): cloud hosting, file storage, and AI model inference
• Modal: text extraction from documents and scanned files
• Neon: database hosting
• Railway: application hosting
• Clerk: user authentication
• Resend: platform notification email
• PostHog: product usage analytics
• Netlify: marketing website hosting
• Google Analytics: marketing website traffic and advertising measurement. Marketing website only. It is not present in the Cedent platform and receives no matter data.

Human Access to Your Data

Cedent personnel do not read your matter data, including Google Workspace data, as a matter of routine. We access it only with your affirmative consent, for example when you ask us to investigate a support issue; where it is necessary for security purposes, such as investigating abuse; or where we are required to by law. Access is limited to what is necessary for the specific purpose, and our runtime logs are scrubbed so that message and document content does not appear in them.

How We Use the Information We Decide About

This section covers categories 1 and 2 above, the website visitor and account information we control. Matter data is not used for any of the purposes below. It is processed only on your firm's instructions, as described above.

• To provide and improve the Cedent platform
• To communicate with you about your account and our services
• To process waitlist signups and notify you of availability

What We Do NOT Do

• We do not sell your personal data
• We do not use your client data to train AI models
• We do not share matter data between firms

Data Security

We use encryption in transit (TLS 1.3) and at rest (AES-256). Each firm's data is isolated at the infrastructure level. For more details, see our Security page.

Data Retention

We retain your data for as long as your account is active or as needed to provide the service. Workspace session data is wiped on termination. You may request deletion of your data at any time.

Contact

Questions about this policy? Contact us at privacy@cedent.ai.