Privacy Policy
This policy explains what personal data Scriptum AI Limited collects, why, who receives it and what rights you have. It covers our website, the Scriptum matter workspace and the Scriptum add-in for Microsoft Word.
1. Who we are
Scriptum AI Limited ("Scriptum", "we", "us") is a company registered in Northern Ireland with company number NI740697. Our registered office is at 4 Ballybarnes Meadow, Killarn, Northern Ireland, BT23 4GZ. We run tryscriptum.ai, the Scriptum matter workspace and the Scriptum add-in for Microsoft Word (together, the "Service").
Questions about this policy or your data go to info@scriptumai.co.
2. The two roles we play
We are the controller of data we decide to collect for our own purposes: website visits, demo and contact requests, sales contacts, account administration, billing and security.
We are a processor of the documents and other content that a law firm or legal team puts into the Service. That customer decides what goes in and why, and we handle it on its instructions under our Data Protection Policy.
If your name or details appear in a document held on a matter, for example as a shareholder, director or signatory, the law firm or legal team running that matter is the controller. Please contact it first. If you do not know who that is, write to us and we will help where we can.
3. What we collect
| Category | What it includes | Where it comes from |
|---|---|---|
| Enquiries | Name, work email, organisation, role and your message | The demo and contact forms, or your email to us |
| Business contacts | Name, job title, firm, work email, work phone and professional profile links | You, or public sources such as firm websites and LinkedIn |
| Accounts | Name, work email, firm, role, sign-in credentials (stored in hashed form) and sign-in history | You, or your firm's administrator |
| Invited participants | Name, email, organisation and role on a matter | The firm or legal team that invites you |
| Matter content (as processor) | Documents, drafts, comments, questions and answers, approval decisions and clause library entries, plus any personal data they contain | Our customers and the people they invite |
| Technical and usage data | IP address, browser and device details, pages and features used, activity logs and error logs | Your device, when you use the Service |
| Billing | Billing contact, invoicing address, VAT details and payment records | Your organisation |
| Analytics | Pages visited, approximate location, device type and how you reached the site | Google Analytics, only if you accept analytics cookies |
4. Why we use it, and our lawful basis
| Purpose | Lawful basis under the UK GDPR |
|---|---|
| Providing the Service and managing accounts | Performance of a contract with the person concerned, or our legitimate interest in serving the organisation they work for |
| Answering enquiries and arranging demos | Legitimate interest in responding to people who contact us |
| Telling legal professionals about Scriptum by email | Legitimate interest in promoting our business to relevant firms. You can opt out at any time (section 7) |
| Sending service notices, such as invitations and approval requests | Performance of a contract, or legitimate interest in running the Service |
| Keeping the Service secure, investigating misuse and fixing faults | Legitimate interest in protecting the Service and its users |
| Improving the Service using usage data, in aggregated or de-identified form where practicable | Legitimate interest in developing our product |
| Website analytics | Your consent, which you can withdraw through Cookie settings |
| Invoicing, tax records and meeting legal duties | Legal obligation, or performance of a contract |
| Handling legal claims, or a sale or investment in our business | Legitimate interest in protecting and running our business |
Where we rely on legitimate interests, we have weighed them against your rights, and you can object (section 11). We do not seek special category data. Where a document contains it, the customer that uploaded it is responsible for having a lawful condition to process it.
5. How we use AI
Parts of the Service send matter content to AI providers so that it can be parsed, classified, searched, summarised, drafted and reviewed. At the date of this policy those providers are OpenAI and Anthropic.
No training. We do not use customer documents to train AI models, and we use these providers under commercial API terms that do not permit them to train their models on that content. Those terms may allow a provider to hold inputs for a limited period to detect misuse.
A lawyer decides. AI output is a proposal held for a named lawyer to accept, change or reject. The Service does not make decisions about individuals that produce legal or similarly significant effects, so it does not carry out solely automated decision-making within Article 22 of the UK GDPR.
6. Who receives your data
We do not sell personal data. We share it only as follows:
- Your organisation. Firm administrators can see account details and activity for their firm's users.
- Others on a matter. People invited to a matter see what the firm running it chooses to release to them. Internal drafts and partner limits are not shown to clients or to the other side.
- Service providers, listed below, under contracts that limit what they can do with the data.
- Advisers and authorities. Our professional advisers, and regulators, courts or law enforcement where the law requires it or where it is needed to protect legal rights.
- A buyer or investor, under a duty of confidence, if we sell or reorganise our business or raise funding.
| Provider | What it does for us | Location |
|---|---|---|
| Supabase | Database, sign-in and file storage. All account data and matter content is stored here | Stored in the European Union (Frankfurt) |
| OpenAI | Document parsing, tagging, search indexing, drafting suggestions and questions, when an AI feature runs | Processes text in the United States. Not where we store your data |
| Anthropic | AI agents for drafting, review, negotiation, collaboration and close-out, when an agent runs | Processes text in the United States. Not where we store your data |
| Resend | Service emails such as invitations and notifications | United States |
| Render | Serving the workspace and Word add-in application files | United States |
| Netlify | Hosting this website and receiving form submissions | United States |
| Analytics, only with your consent, and web fonts on this website | United States |
7. Marketing
We may email people at law firms and legal teams about Scriptum where their role makes it relevant. We use professional contact details only, which we collect from the person or from public sources such as firm websites. Every marketing email tells you how to opt out. Reply or write to us at any time and we will stop, keeping only enough detail to make sure we do not contact you again.
8. Where your data is stored, and transfers outside the UK
All account data and matter content is stored in the European Union (Frankfurt, Germany), which the UK treats as providing adequate protection. We do not keep it in a database or document store anywhere else. Some providers listed in section 6 process data in the United States. That includes the AI providers, which receive the relevant text from matter content when an AI feature runs and return the result. For those transfers we rely on the UK-US data bridge where the provider is certified under it, or otherwise on the UK International Data Transfer Agreement or the UK Addendum to the EU standard contractual clauses. You can ask us for details of the safeguard that applies.
9. How long we keep it
| Data | How long |
|---|---|
| Enquiries and sales contacts | 2 years from our last contact, unless you become a customer. Opt-out records are kept for as long as they are needed |
| Account data | For the life of the customer's contract, then as for matter content |
| Matter content | For the life of the customer's contract. After it ends, available for export for 30 days, then deleted from production systems within a further 60 days and from backups in the ordinary course of rotation |
| Security and error logs | Up to 12 months |
| Invoices and tax records | 6 years after the end of the financial year they relate to |
| Analytics data | No longer than 14 months |
We may keep data for longer where the law requires it or where it is needed for a legal claim. A customer can also delete matter content earlier.
10. Security
Data is encrypted in transit and at rest, and each firm's data is separated from every other firm's at the database. Access is limited by role and our own access is limited to what is needed to run and support the Service. No system is perfectly secure, so please keep your sign-in details private and tell us straight away if you suspect misuse. Our Data Protection Policy sets out our security measures in more detail.
11. Your rights
Depending on the circumstances, you have the right to:
- get a copy of your personal data and information about how we use it;
- have inaccurate data corrected;
- have data deleted;
- restrict how we use it;
- object to our use of it, including an absolute right to object to direct marketing;
- receive data you gave us in a portable format; and
- withdraw consent where we rely on it, without affecting what was done before.
Write to us to use any of these. We reply within one month, or tell you within that month if a complex request needs longer. Where we hold the data as a processor, we will pass your request to the customer concerned.
12. Cookies and similar technology
| Name | Purpose | Type | Duration |
|---|---|---|---|
| scriptum-cookie-consent | Remembers your cookie choice on this website (browser storage) | Strictly necessary | 12 months |
| Workspace sign-in session | Keeps you signed in to the workspace (browser storage) | Strictly necessary | Until sign-out or expiry |
| _ga and _ga_* | Google Analytics measurement of how this website is used | Analytics, only with consent | Up to 2 years |
Analytics cookies stay off unless you accept them. You can change your choice at any time using the Cookie settings button on this website. We do not use advertising cookies. This website also loads fonts from Google, which means your browser sends your IP address to Google when a page loads.
13. Children
The Service is for legal professionals and the people they work with on business matters. It is not intended for anyone under 18, and we do not knowingly collect their data as users. If you think we have, please tell us and we will delete it. A minor's details may still appear in a document that a customer uploads, in which case that customer is the controller.
14. Complaints
Please tell us first if you are unhappy with how we have handled your data. We will acknowledge your complaint within 30 days and respond without undue delay. You can also complain to the UK regulator, the Information Commissioner's Office, at any time at ico.org.uk.
15. Changes
We will post any update on this page and change the date at the top. If a change materially affects how we use your data, we will also tell account holders directly.
16. Contact us
Scriptum AI Limited, 4 Ballybarnes Meadow, Killarn, Northern Ireland, BT23 4GZ. Email: info@scriptumai.co.