Privacy policy

This policy explains what personal information LegalBrain collects, why, where it is processed, and the rights you have under South Africa's Protection of Personal Information Act 4 of 2013 (POPIA).

1. Who is responsible

LegalBrain (www.legalbrain.co.za) is operated by Thando Mazaleni, an individual based in South Africa, who is the responsible party for the personal information described here and acts as information officer. Contact: admin@legalbrain.co.za.

2. What we collect

• Account details: your name, email address, the type of account you choose (law student, advocate, attorney or law firm), and your password, which is stored only as a one-way hash.
• Student study profile (optional): university, degree, year of study and the modules you select.
• Content you add: documents and PDFs you upload, notes, flashcards, mock exams, research questions, drafts, and, for practitioners and firms, records such as clients, cases, court dates, deadlines, templates, invoices and team members.
• Activity on LegalBrain: when you are signed in, the pages you open, which AI tools you use and when, and choices you pick from a list (such as the type of document in the drafting tool, or the module you are studying). We never record what you type into an AI tool, the AI's answers, or the documents you attach. When you are signed out, we count which pages are visited, without recording who you are or your IP address. To count how many people visit each day, your browser notes the date it was last counted and whether a visit has just begun (see section 8); no identifier is created or sent.
• Practice activity log: for practitioner accounts, a record of who in the practice created, changed, viewed or downloaded records.
• Security information: when a sign-in fails, the email address used and the IP address are recorded in server logs to protect accounts against password-guessing.

3. Why we use it

• To create and run your account and provide the features you use.
• To process the content you submit to AI features and return results to you.
• To keep the service secure, prevent abuse and investigate problems.
• To understand which features people use and what interests them, so we can improve LegalBrain and plan our marketing. The LegalBrain administrator can see each person's activity, but not what they type into the AI tools.
• To send you emails about your account, such as a welcome email. Marketing emails are sent only if you agreed to receive them, and every one lets you unsubscribe.
• To meet legal obligations.

We do not sell personal information, and we do not use third-party advertising or analytics trackers. Our activity log is kept on our own systems.

4. AI processing

When you use an AI feature (study notes, flashcards, mock exams, the drafting assistant or legal research), the text and any documents you submit with that request are sent to Anthropic, the provider of the Claude AI models, to generate the result. Legal research also sends search queries through Anthropic's web search tool. Anthropic processes this content under its own terms and policies. Only submit information you are entitled to share, and avoid including unnecessary personal information about other people.

5. Client information entered by practitioners

If you are an advocate, attorney or firm and you enter information about your clients or other people, you remain responsible for that information and for your professional duties of confidentiality. LegalBrain processes it on your behalf to provide the service.

6. Firm accounts

In a firm account, people of a higher rank (Director, Senior Associate, Associate, Attorney, from top to bottom) can open, edit, review and move the work of people below them. Each such action is recorded in the firm's activity log with the person's name, rank and the time. The firm decides who joins it and at what rank, and is responsible for how its people use the information in it.

7. Where it is stored and how it is protected

LegalBrain is hosted by Railway in the United States, and AI requests are processed by Anthropic in the United States, so your information is transferred outside South Africa. Emails are sent through Resend, also in the United States. Connections use HTTPS, passwords are hashed, uploaded files are encrypted at rest, and access to your records is limited to your account (and, for practices, the team members you add). No system is perfectly secure; tell us at once at admin@legalbrain.co.za if you suspect your account has been misused.

8. Cookies

We use only the cookies needed to keep you signed in, to protect sign-in and, in firm accounts, to remember whose workspace a superior has opened. We do not use advertising or analytics cookies. To count visitors per day without tracking anyone, LegalBrain also keeps two small notes in your browser's own storage: the date your browser was last counted as a visitor, and a marker that lasts until you close the tab, so that the first page of a visit can be told apart from the rest. Neither contains anything that identifies you or your device, and neither is shared with anyone. You can clear them at any time by clearing your browser's site data.

9. How long we keep it

We keep your information while your account is active. The activity log is kept for up to 12 months and then deleted. If you ask us to delete your account, we delete your account and content from the live service. Copies may remain in encrypted backups for a limited period until they are overwritten. We may keep information for longer where the law requires it.

10. Your rights

Under POPIA you may ask what personal information we hold about you, ask us to correct or delete it, and object to its processing. Email admin@legalbrain.co.za. You may also complain to the Information Regulator of South Africa (inforegulator.org.za).

11. Changes

We will update this page if our practices change, and change the date at the top.