6v2 Inc. d/b/a LegalLayer (the "Company", "we", "us", "our")
Statement from the Company: We are committed to protecting your privacy. This Privacy Policy describes how we collect, use, disclose, and safeguard your personal information when you visit our websites, use our products and services, or otherwise interact with us.
1. Who we are and the scope of this policy
1.1 Controller Identity
| Legal Entity | 6v2 Inc. d/b/a LegalLayer |
|---|---|
| Mailing Address | 2261 Market Street, STE 86874, San Francisco, CA 94114, United States |
| contact@legallayer.ai |
1.2 Scope
This Privacy Policy applies to personal information we collect when you:
Visit our websites, including https://www.legallayer.ai and any subdomains that link to this Policy;
Use our cloud-based software products, APIs, and related services;
Attend our events, webinars, or respond to our marketing communications;
Communicate with us via email, chat, phone, or social media; or
Apply for employment (subject to our separate Candidate Privacy Notice)
(collectively, the "Services").
This Policy does not apply to personal information we process on behalf of our customers as a data processor or service provider. When we process data on behalf of our customers, the customer's privacy policy governs, and our obligations are set forth in our Data Processing Agreement.
Processor/service provider role: When you interact with our Services through your employer or another organization, that organization is the controller (or "business" under the CCPA). We process personal data on their behalf pursuant to written agreements. Please refer to that organization's privacy policy for details on how your data is handled.
2. Information we collect
2.1 Information you provide directly
You may provide us with the following information directly through your interactions with our Services:
Account registration data: name, email address, password, job title, company name;
Payment and billing information: credit card details (processed by our PCI-compliant payment processor), billing address, tax ID;
Communications: content of emails, support tickets, chat messages, and feedback forms;
Survey and research responses: when you voluntarily participate in surveys, beta programs, or user research;
Event registration: name, email, dietary requirements, and accessibility needs when you register for events; or
2.2 Information collected automatically
We may collect certain information automatically, including through the use of cookies or similar technology, through your interactions with our Services, including:
Device and browser information: IP address, browser type and version, operating system, device identifiers, screen resolution, and preferred language;
Usage data: pages visited, features used, clickstream data, session duration, referring URL, and search queries within the Services;
Log data: server logs, error reports, API call metadata, and timestamps;
Location data: approximate geographic location derived from IP address. We do not collect precise geolocation unless you separately consent;
2.3 Information from third parties
We may collect certain information that is shared to us from third parties, including:
Single sign-on providers: if you authenticate via Google, Microsoft, or another SSO provider, we receive your name, email, and profile information as authorized by you;
Business partners and resellers: contact and account information provided by channel partners in connection with joint sales activities;
Public sources and data enrichment: business contact information from publicly available sources (e.g., LinkedIn, company websites) and third-party data providers, used for B2B marketing in accordance with applicable law;
Integrations: if you connect third-party services to your account (e.g., CRM, cloud storage), we receive data you authorize those services to share.
2.4 Sensitive personal information
We generally do not collect sensitive personal information as defined under the GDPR (also known as "special category data" under Article 9), such as racial or ethnic origin, political opinions, religious beliefs, health data, biometric data for identification purposes, or sexual orientation. If you submit such information to us (for example, in the body of a support message), we will process it only as necessary to respond to your inquiry and will apply additional safeguards including access restrictions and prompt deletion.
Under the California Privacy Rights Act (CPRA), certain categories of information we collect may be classified as "sensitive personal information," including account log-in credentials (i.e., your email address in combination with a password) and, where applicable, precise geolocation data. We use these categories only as necessary to provide and secure the Services. You have the right to limit the use of your sensitive personal information to purposes authorized by CPRA Section 1798.121. To exercise this right, please contact us using the methods described in this Policy.
3. How we use your information and our legal basis
We process your personal information only for the purposes described below. For individuals in the European Economic Area (EEA), United Kingdom (UK), and Switzerland, we identify the legal basis for each purpose under the GDPR.
| Purpose | Description | Legal Basis |
|---|---|---|
| Provide the Services | Create and manage your account, process transactions, deliver features, provide customer support, and maintain system performance. | Performance of contract (Art. 6(1)(b)) |
| Communicate with you | Send transactional messages (e.g., confirmations, invoices, security alerts, service updates) and respond to your inquiries. | Performance of contract (Art. 6(1)(b)) |
| Improve and develop products | Analyze usage patterns, conduct A/B testing, develop new features, fix bugs, and optimize performance. | Legitimate interest (Art. 6(1)(f)): improving products for users |
| Marketing and promotions | Send newsletters, product announcements, event invitations, and promotional content. Display targeted advertisements. | Consent (Art. 6(1)(a)) where required; otherwise Legitimate interest (Art. 6(1)(f)): promoting our services to existing and prospective customers |
| Analytics and personalization | Understand how users interact with the Services, generate aggregated insights, and personalize user experience. | Legitimate interest (Art. 6(1)(f)): understanding and optimizing the user experience |
| Security and fraud prevention | Detect, investigate, and prevent fraudulent transactions, unauthorized access, abuse of the Services, and other illegal activities. | Legitimate interest (Art. 6(1)(f)): protecting the security of our systems and users; Legal obligation (Art. 6(1)(c)) where required |
| Legal compliance | Comply with legal obligations, respond to lawful requests from public authorities, enforce our terms, and establish, exercise, or defend legal claims. | Legal obligation (Art. 6(1)(c)); Legitimate interest (Art. 6(1)(f)): establishing, exercising, or defending legal claims |
| Recruitment | Evaluate job applications, conduct interviews, and manage the hiring process (subject to our separate Candidate Privacy Notice). | Pre-contractual steps at your request (Art. 6(1)(b)); Legitimate interest (Art. 6(1)(f)): evaluating candidates |
3.1 Legitimate Interest Assessments
Where we rely on legitimate interest as a legal basis for processing (as indicated in the table above), we have conducted a balancing test weighing our interests against your rights and freedoms as a data subject. We have determined that our interests do not override your rights in each case.
3.2 Whether providing your data is required
In most cases, providing your personal information is voluntary. However, some information is necessary to enter into or perform a contract with us (for example, your name and email to create an account, or billing information to process a payment). If you do not provide such information, we may be unable to provide the relevant Services to you. Where we are required by law to collect certain information (for example, tax identification for invoicing), we will inform you at the point of collection.
3.3 Data minimization
We adhere to the principle of data minimization. We collect and process only the personal information that is adequate, relevant, and limited to what is necessary for the purposes stated in this Policy. We regularly review the data we hold to ensure it remains necessary for the stated purposes.
4. How we share your information
We do not sell your personal information as defined under the CCPA. We may share certain categories of personal information (specifically, Identifiers, Internet or Network Activity, and Inferences) with advertising partners for cross-context behavioral advertising purposes, as further described in Section 8. You have the right to opt out of such sharing.We do not share personal information for cross-context behavioral advertising as that term is defined under the CCPA. We share personal information only in the following circumstances:
4.1 Service providers
We engage third-party companies and individuals to perform services on our behalf (e.g., hosting, payment processing, analytics, email delivery, customer support).
Below is a current list of our sub-processors:
Google LLC (Google Cloud Platform) — cloud hosting — GKE, Cloud SQL for PostgreSQL, Cloud Storage and Secret Manager (us-central1). Corporate headquarters: United States. Data that may be processed: all platform data, including accounts, organizations, entities, matters, thread messages and uploaded documents.
Google LLC (Google Sign-In) — social login. Corporate headquarters: United States. Data that may be processed: name, email address and Google account identifier.
Anthropic PBC — Claude API for intake, and managed agents and routines running on Anthropic infrastructure that reach our systems over MCP. Corporate headquarters: United States. Data that may be processed: matter intake and thread messages, client organization and entity records, document contents, names, email addresses and drafted deliverables.
Slack Technologies, LLC (Salesforce, Inc.) — legal request intake channel and outbound matter mirror. Corporate headquarters: United States. Data that may be processed: legal enquiry message content, participant identities and files uploaded to matter threads.
Granola — call and meeting transcription. Data that may be processed: call audio, transcript content, and the names and email addresses of participants.
Stripe, Inc. — payment processing and subscription billing. Corporate headquarters: United States. Data that may be processed: name, email address, billing and financial information, and subscription and invoice records.
ActiveCampaign, LLC (Postmark) — transactional email. Corporate headquarters: United States. Data that may be processed: name, email address and email content, including verification messages, magic links, invitations, notifications and enquiries.
PostHog, Inc. — product analytics, exception capture, and server logs and traces across the website and application (US region). Corporate headquarters: United States. Data that may be processed: name, email address, user and organization identifiers, workspace kind, staff role, IP address, and page and event telemetry as metadata; not matter content.
Vercel Inc. — website and application hosting. Corporate headquarters: United States. Data that may be processed: IP address, user agent, request paths, session cookies, form submissions and server-rendered content.
4.2 Affiliates
We may share personal information with our corporate affiliates for the purposes described in this Policy. All affiliates are bound by this Policy or equivalent data protection standards.
4.3 Business transfers
In connection with a merger, acquisition, reorganization, sale of assets, or bankruptcy, personal information may be transferred to the acquiring entity. When necessary, we will notify you via email and/or prominent notice on our website of any change in ownership or uses of your personal information, as well as any choices you may have regarding your personal information.
4.4 Legal requirements and protection of rights
We may disclose personal information if required to do so by law or if we believe in good faith that such action is necessary to: (a) comply with a legal obligation, subpoena, court order, or governmental request; (b) protect and defend our rights or property; (c) prevent or investigate possible wrongdoing in connection with the Services; (d) protect the personal safety of users or the public; or (e) protect against legal liability.
4.5 With your consent
We may share personal information for other purposes with your express consent.
5. International data transfers
6v2 Inc. d/b/a LegalLayer is headquartered in Canada. Your personal information may be transferred to and processed in countries other than your country of residence, including the United States, which may have data protection laws that differ from those in your jurisdiction.
6. Data retention
We retain personal information for as long as reasonably necessary to fulfill the purposes for which it was collected. Retention periods are determined based on the following criteria:
the duration of our contractual relationship with you;
applicable legal and regulatory retention obligations (including tax, financial reporting, and employment record-keeping requirements);
applicable statutes of limitation for potential legal claims;
the operational necessity of the data for security, fraud prevention, and service continuity; and
whether the purpose for which the data was collected has been fulfilled or the data subject has requested deletion.
When personal information is no longer required under any applicable criterion, we will securely delete or irreversibly anonymize it. Anonymized data may be retained indefinitely for analytics purposes.
7. Your privacy rights
7.1 How to exercise your rights
To exercise any of the rights described in this Section 7, please submit a request to:
Email: contact@legallayer.ai
Mail: 6v2 Inc. d/b/a LegalLayer, Attn: Data Protection Officer, 2261 Market Street, STE 86874, San Francisco, CA 94114, United States
We will respond to your request within forty-five (45) days (or one (1) month under the GDPR). If we need to extend this period, we will notify you of the extension and the reasons for the delay. We will verify your identity before processing your request. Requests are free of charge unless manifestly unfounded or excessive.
8. Additional information for California residents
This section provides additional disclosures required by the California Consumer Privacy Act, as amended by the California Privacy Rights Act (collectively, "CCPA"), for residents of California. This section should be read in conjunction with our California Notice at Collection, available as a schedule attached to this Policy, which is incorporated into this Policy by reference.
8.1 Your CCPA rights
As a California resident, you have the following rights:
Right to know and access (§ 1798.100, 1798.110): You have the right to request that we disclose the categories and specific pieces of personal information we have collected about you, the sources of collection, the business or commercial purposes, and the categories of third parties with whom we share it.
Right to delete (§ 1798.105): You have the right to request that we delete personal information we have collected from you, subject to certain exceptions.
Right to correct (§ 1798.106): You have the right to request that we correct inaccurate personal information we maintain about you.
Right to opt-out of sale or sharing (§ 1798.120): You have the right to direct us not to sell or share (as those terms are defined under the CCPA) your personal information. We do not sell personal information. We may share certain information with advertising partners for cross-context behavioral advertising. You may opt out of such sharing using the methods described in this Section 8.We do not share personal information for cross-context behavioral advertising.
Right to limit use of sensitive personal information (§ 1798.121): If we collect sensitive personal information for purposes beyond those authorized by the CCPA, you have the right to limit such use. We do not use sensitive personal information for purposes that would trigger this right.
Right to data portability (§ 1798.100(d)): You have the right to request that we transmit your personal information to another business in a structured, commonly used, machine-readable format, to the extent technically feasible. This right applies to personal information you provided to us and that we maintain in a digital format.
Right to non-discrimination (§ 1798.125): We will not discriminate against you for exercising any of your CCPA rights. We will not deny you services, charge you different prices, or provide a different level or quality of service because you exercised a privacy right.
8.2 How to exercise your rights
To exercise any of the rights described in this Section 8, please submit a request to:
- Email: contact@legallayer.ai
We will verify your identity by matching information you provide with information we have on file. You may designate an authorized agent to make a request on your behalf by providing written authorization or a power of attorney. We may require verification of both the agent's authority and your identity.
8.3 Global Privacy Control
We honor Global Privacy Control ("GPC") signals. If your browser or device transmits a GPC signal, we will treat it as a valid request to opt out of the sale or sharing of personal information for that browser or device, as required by § 1798.135(b)(1). GPC signals apply to the specific browser and device from which they are sent. For more information about GPC, visit https://globalprivacycontrol.org.
We do not respond to Do Not Track ("DNT") browser signals, as there is no industry-standard technology for recognizing or honoring DNT signals at this time.
8.4 Financial incentive programs
We do not offer financial incentives or price or service differences in exchange for the retention or sale of personal information.
9. Cookies and tracking technologies
We use cookies, local storage, and similar technologies to operate the Services, keep you signed in, remember your preferences, and measure how the Services are used. We do not use cookies, pixels, or similar technologies for targeted or cross-context behavioural advertising, and we do not permit third parties to do so through the Services.
The technologies we use fall into two categories. Strictly necessary cookies and local storage authenticate you, maintain your session, secure the Services, and remember your settings; these cannot be disabled without preventing the Services from functioning. Analytics and performance technologies allow us and our analytics provider to understand usage, diagnose errors, and improve the Services.
You can control cookies through your browser settings, including by deleting existing cookies and blocking new ones. Blocking strictly necessary cookies will prevent parts of the Services from working. Where applicable law requires consent before non-essential cookies are placed, we will obtain your consent before placing them.
10. Security
We implement appropriate technical and organizational measures designed to protect personal information against unauthorized access, alteration, disclosure, or destruction. If you would like to learn more, please contact us at Email: contact@legallayer.ai.
No method of transmission over the Internet or method of electronic storage is completely secure. While we strive to use commercially reasonable means to protect your personal information, we cannot guarantee its absolute security.
11. Data breach notification
In the event of a personal data breach that is likely to result in a risk to the rights and freedoms of natural persons, we will notify the relevant supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware of the breach, as required by GDPR Article 33.
Where a breach is likely to result in a high risk to your rights and freedoms, we will also notify affected individuals without undue delay, as required by GDPR Article 34, unless one of the exceptions in Article 34(3) applies.
For California residents, we will notify you of a breach of security involving your personal information as required by California Civil Code § 1798.29 and § 1798.82.
12. Children's privacy
The Services are not directed to individuals under the age of 16. We do not knowingly collect personal information from children under 16. If we learn that we have collected personal information from a child under 16 without verification of parental consent, we will take steps to delete that information promptly.
In compliance with the Children's Online Privacy Protection Act ("COPPA"), 15 U.S.C. §§ 6501-6506, and 16 C.F.R. Part 312, we do not knowingly collect personal information from children under 13. If you believe we have collected information from a child under 13, please contact us at contact@legallayer.ai so we can promptly delete it.
We do not knowingly sell or share (as those terms are defined under the CCPA) the personal information of consumers under the age of 16. If we become aware that a user is under 16, we will not sell or share their personal information unless we have received affirmative authorization from the consumer (if aged 13-15) or verifiable parental consent (if under 13), as required by CCPA Section 1798.120(c).
13. Additional U.S. state privacy rights
To exercise your rights under any applicable state privacy law, please use the contact methods described in this Policy. If we deny your request, you may appeal our decision by contacting us at contact@legallayer.ai with the subject line "Privacy Rights Appeal."
13.1 Appeal Rights
If we deny your privacy rights request, you have the right to appeal our decision. To appeal, contact us at contact@legallayer.ai with the subject line "Privacy Rights Appeal." We will respond to your appeal within the timeframe required by applicable law (typically 60 to 90 days). If your appeal is denied, you may contact your state's attorney general to submit a complaint. Contact information for state attorneys general is available at https://www.naag.org/find-my-ag/.
13.2 Universal Opt-Out Mechanisms
We honor Global Privacy Control (GPC) signals as valid opt-out requests under all applicable state privacy laws that recognize universal opt-out mechanisms, including Colorado, Connecticut, Montana, Delaware, Oregon, New Hampshire, New Jersey, and Texas. If your browser or device transmits a GPC signal, we will treat it as a request to opt out of the sale, sharing, or targeted advertising uses of your personal data for that browser or device.
13.3 Profiling and Automated Decision-Making
Under applicable state laws (including Virginia, Colorado, Connecticut, and others), you may have the right to opt out of profiling in furtherance of decisions that produce legal or similarly significant effects concerning you. To exercise this right, please use the contact methods described herein or enable a GPC signal on your browser.
14. Changes to this Privacy Policy
We may update this Privacy Policy from time to time to reflect changes in our practices, technologies, legal requirements, or other factors. When we make material changes, we will:
Update the "Last Updated" date at the top of this Policy;
Provide notice via email to account holders and/or a prominent notice on our website at least 30 days before the changes take effect;
Where required by applicable law, obtain your consent before applying material changes to previously collected data.
We encourage you to review this Privacy Policy periodically.
15. Contact us
If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:
| Legal Entity | 6v2 Inc. d/b/a LegalLayer |
|---|---|
| Mailing Address | 2261 Market Street, STE 86874, San Francisco, CA 94114, United States |
| General Email | contact@legallayer.ai |
| Privacy Email | contact@legallayer.ai |
Schedule A
California Notice at Collection
6v2 Inc. d/b/a LegalLayer (the "Company", "we", "us", "our")
Last Updated: September 9, 2026
This Notice at Collection is provided to California residents pursuant to the California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act of 2020 (collectively, the "CCPA"), Cal. Civ. Code §§ 1798.100 et seq. This Notice supplements our Privacy Policy. Capitalized terms not defined herein have the meanings set forth in the Privacy Policy.
Categories of Personal Information collected
The following table describes the categories of personal information we collect, the purposes for which each category is used, whether it is sold or shared, and the applicable retention period. These categories correspond to the categories set forth in CCPA § 1798.140(v).
| Category (CCPA) | Commercial Purpose | Sold or Shared? | Retention Period | Categories of Third Parties |
|---|---|---|---|---|
| A. Identifiers (Name, email, phone, IP address, etc.) | Provide Services; communicate; marketing; security | Not sold. Shared for cross-context behavioral advertising. Not shared. | Duration of account + 1 year | Cloud hosting providers; analytics providers; advertising networks (if shared for CCBA) |
| B. Personal information (Name, address, phone, financial info) | Billing; provide Services; legal compliance | Not sold or shared. | 7 years | Payment processors; cloud hosting providers; tax/accounting service providers |
| C. Protected classifications (Age, gender) | Analytics; legal compliance | Not sold or shared. | Duration of account + 1 year | Analytics providers; cloud hosting providers |
| D. Commercial information (Transaction history, subscription) | Provide Services; billing; analytics | Not sold or shared. | 7 years | Payment processors; cloud hosting providers; analytics providers |
| E. Biometric information | N/A | N/A | N/A | N/A |
| F. Internet or network activity (Browsing history, interaction with Services) | Improve products; analytics; security | Not sold. Shared for cross-context behavioral advertising. Not shared. | 2 years | Analytics providers; advertising networks (if shared for CCBA); cloud hosting providers |
| G. Geolocation data | Provide localized features; analytics; security | Not sold or shared. | 1 year | Analytics providers; cloud hosting providers |
| H. Sensory data (Audio recordings) | Quality assurance; training | Not sold or shared. | Sales and discovery call transcripts: 12 months. Transcripts and records of client legal consultations are retained under the applicable engagement letter and file-retention schedule. | Cloud hosting providers; quality assurance service providers |
| I. Professional or employment info (Job title, company name) | Provide Services; marketing; recruitment | Not sold or shared. | Duration of account + 1 year | Analytics providers; cloud hosting providers; CRM providers |
| J. Education information | Provide Services; marketing | Not sold or shared. | Not collected | N/A |
| K. Inferences (User preferences, product interests) | Personalization; analytics; marketing | Not sold. Shared for cross-context behavioral advertising. Not shared. | 2 years | Analytics providers; advertising networks (if shared for CCBA); cloud hosting providers |
| L. Sensitive personal information (log-in credentials, email) | Account authentication and security; providing location-based features (with consent) | Not sold or shared. | Account credentials: duration of account + 1 year. Precise geolocation and biometric data are not collected. | Cloud hosting providers; authentication service providers |
Retention Criteria: The retention periods specified in the table above are determined based on the following criteria: (a) the duration of our contractual relationship with you; (b) legal and regulatory retention requirements (e.g., tax and financial reporting obligations, statute of limitations for legal claims); (c) the operational necessity of the data for the purposes for which it was collected; and (d) our legitimate business interests, including product improvement and security. When personal information is no longer required under any applicable criterion, it is securely deleted or irreversibly anonymized.
Sources of Personal Information
We collect personal information from the following categories of sources:
Directly from you: when you create an account, make a purchase, contact support, or otherwise provide information to us;
Automatically: through cookies, pixels, server logs, and similar technologies when you interact with our websites and Services;
From third parties: single sign-on providers, business partners, resellers, data enrichment providers, and publicly available sources;
From your employer or organization: when they set up an account on your behalf.
Your California privacy rights
You have the right to:
Know what personal information we collect, use, disclose, sell, and share about you;
Delete personal information we have collected from you;
Correct inaccurate personal information;
Opt out of the sale or sharing of your personal information;
Limit our use of sensitive personal information to purposes authorized by the CCPA;
Not be discriminated against for exercising your rights.
How to exercise your rights
To submit a verifiable consumer request:
- Email: contact@legallayer.ai
Opt-out of sale or sharing
To opt out of sharing any of your personal information for cross-context behavioral advertising, contact us at contact@legallayer.ai.
Authorized Agent
You may designate an authorized agent to submit a request on your behalf by providing the agent with written permission signed by you. We may require verification of both the agent's authority and your identity before processing the request.
Automated Decision-Making Technology (ADMT): We may use automated decision-making technology in connection with the Services. To the extent we use ADMT and such use is subject to the CPPA's regulations on automated decision-making technology, you have the right to receive a pre-use notice, to access information about the logic involved in such decisions, and to opt out of ADMT-based decisions that produce legal or similarly significant effects. For details and to exercise any applicable ADMT rights, see our Privacy Policy, or contact us using the methods listed below.