Summary of Key Points

Before diving into the details, here is a quick overview of how we handle your privacy at Legaltra LLC:

• What personal information do we collect? We collect your name, email, payment details, account preferences, device and location data, and the Case Materials you upload for claim chart generation.

• Do we process any sensitive personal information? Yes. Because our platform is built for patent litigation, we process highly sensitive Case Materials alongside standard account credentials.

• Do we collect information from third parties? We receive limited payment confirmation data from our payment processor, Stripe.

• How do we use your information? We use your data primarily to deliver our claim chart generation platform, process your payments, secure your account, and improve our software.

• Who do we share your personal information with? We share data only with essential service providers like AWS (for secure cloud hosting), Clerk (for authentication), and Stripe (for payment processing). We never sell your personal data or your Case Materials, we never use them for marketing, and we never train AI models on them. The one marketing exception is that we may name your firm as a customer — never your clients, matters, or case details.

• What are your privacy rights? Depending on where you live, you have the right to access, correct, delete, and port your data, as well as the right to opt out of certain processing.

• How can you contact us? You can reach our privacy team anytime at privacy@legaltra.com.

1. Introduction

Welcome to Legaltra LLC. We provide a specialized online SaaS platform designed to help plaintiffs in patent litigation generate and manage complex claim charts. Because of the highly sensitive nature of patent litigation, we understand that trust is the foundation of our relationship with you.

This Privacy Policy explains in plain language how we collect, use, protect, and share your information when you use our platform. We have designed our privacy practices to align with strict global standards, including the EU General Data Protection Regulation (GDPR), the California Consumer Privacy Act and its amendments (CCPA/CPRA), and other comprehensive US state privacy laws.

If you have any questions about this policy or how we handle your data, please reach out to us at privacy@legaltra.com.

3. How We Use Your Information

We do not collect your data just to have it. Every piece of information we gather serves a specific purpose related to delivering and improving our patent litigation tools.

• Core Service Delivery: We use your account details and Case Materials to generate your claim charts, manage your account, and process your financial transactions.

• Service Improvement: By analyzing usage analytics and technical logs, we identify bugs, optimize our user interface, and develop new features for the platform.

• Communication: We use your email address to send you important service updates, security alerts, billing notices, and responses to your support requests.

• Security and Fraud Prevention: We monitor location data, device information, and technical logs to detect unauthorized access attempts and protect your highly sensitive litigation data.

• Legal Compliance: We may process your information to comply with tax laws, financial regulations, or valid legal requests.

• Marketing: With your explicit consent, we may send you newsletters or promotional materials about new Legaltra features. You can opt out of these communications at any time. Separately, we may identify your firm or organization by name and logo as a Legaltra customer in our marketing materials. That is limited to your organization's branding: we will never identify your clients, your matters, the parties or patents involved, case names or numbers, or any detail drawn from your Case Materials. If you would prefer we not name your organization at all, email privacy@legaltra.com and we will stop.

What we never do with your data: We do not sell, rent, or trade your personal information or your Case Materials, for marketing or for any other purpose. We do not use your Case Materials to train, fine-tune, or evaluate artificial intelligence or machine learning models, whether our own or a third party's, and we do not submit them to any third-party model provider for that purpose. We do not read, review, or index the substance of your Case Materials. Our personnel access them only when you ask us to in connection with a support request, or where access is strictly necessary to restore, secure, or repair the platform.

4. When We Share Your Information

Given the confidential nature of patent litigation, we are incredibly strict about who accesses your data. We never sell your personal data or Case Materials to anyone. We only share information in the following limited circumstances:

• Essential Service Providers: We share necessary data with trusted infrastructure partners who help us run our business. Specifically, we use Amazon Web Services (AWS) for secure cloud hosting and data storage, Clerk for secure user authentication (which stores user details such as your email address), and Stripe for processing your payments. Each receives only what it needs to perform its function, and each is bound by its agreement with us to handle customer content as confidential. We do not authorize any of them to use your data for their own purposes.

• What we cannot promise about our providers: We want to be straightforward with you. We do not operate the underlying infrastructure ourselves. Your data is stored and processed on AWS, and while our agreement with AWS obliges it to treat customer content as confidential, we cannot independently control, audit, or guarantee what AWS does as a matter of its own internal practices. The same is true of Clerk and Stripe within their respective functions. If your obligations to a court or a client require assurances beyond what we are able to give, please raise that with us before uploading the material.

• Legal Requirements: If we are required by law, subpoena, or court order to disclose your information, we will do so. Unless we are legally prohibited, we will give you prompt written notice before disclosing anything, we will disclose only the narrowest set of material the process actually requires, and we will cooperate reasonably with you — at your expense — if you seek a protective order or move to quash.

• Business Transitions: If Legaltra LLC is involved in a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction. Any acquirer or successor is bound by the confidentiality commitments in this policy and in our Terms of Service on the same terms, and such a transfer never operates as a sale of your Case Materials or as a transfer of ownership in them. We will notify you of any change in ownership or policy.

• With Your Consent: We will share your information with other third parties only if you explicitly ask or authorize us to do so.

5. Your Privacy Rights

Whether you are protected by the GDPR in Europe, the CCPA/CPRA in California, or other US state privacy laws (like the VCDPA, CPA, or CTDPA), we believe all our users deserve control over their data. You have the right to:

• Access Your Data: You can request a copy of the personal information we hold about you.

• Correct Inaccuracies: If your account information is wrong or outdated, you can update it directly in your account settings or ask us to fix it.

• Delete Your Data: You can request that we erase your personal information and Case Materials. You do not need an account to ask: if you contacted us through the form on our website and would like the name, email address, message and technical details recorded with your enquiry removed before the 12-month retention period ends, email privacy@legaltra.com and we will delete them.

• Port Your Data: You have the right to receive your data in a structured, commonly used, and machine-readable format so you can transfer it to another service.

• Opt-Out of Marketing: You can unsubscribe from our promotional emails at any time by clicking the "unsubscribe" link at the bottom of our emails.

• Withdraw Consent: If you have given us consent to process your data, you can withdraw it at any time. For analytics cookies, select "Privacy preferences" in the footer of any of our public pages and turn off Performance Cookies or choose Reject All — capture stops and analytics data already stored in your browser is removed. Withdrawal does not affect the legality of any processing we did before you withdrew consent.

• Do Not Sell or Share (California): We do not sell your personal information, and we do not share it for cross-context behavioral advertising as defined by the CCPA/CPRA, and we have not done so in the preceding 12 months. Your cookie choices are always available via "Privacy preferences" in the footer.

• Lodge a Complaint: If you believe we have violated your privacy rights, you have the right to file a complaint with your local data protection authority.

To exercise any of these rights, please email us at privacy@legaltra.com — whether or not you hold an account with us. We will respond to your request within the timeframes required by applicable law (typically within 30 days).

6. Data Security

Because you trust us with Case Materials related to active or pending patent litigation, we maintain an enhanced data risk profile and model our internal controls on the SOC 2 security principles. To be clear about where we stand: Legaltra is not currently SOC 2 certified and no audit is underway. Achieving certification is our intention, and we will say so here plainly when it is complete rather than implying it beforehand.

We protect your data using robust security measures, including:

• Encryption: We use SSL/TLS encryption for all data in transit and employ strong encryption for all data at rest.

• Access Controls: We strictly limit internal access to your data. Only authorized personnel who need access to perform their job duties can interact with our backend systems, and such access is logged. Within the platform, access to your material is governed by organization and case roles that you control.

• Authentication: Accounts are secured through our authentication provider, Clerk, and we require Two-Factor Authentication (2FA) on every account. Given the sensitivity of the material you store with us, this is enforced rather than optional.

While we work tirelessly to protect your information, no cloud-based platform can guarantee 100% security. We ask that you do your part by maintaining a strong, unique password and keeping your account credentials confidential. In the unlikely event of a data breach that compromises your personal information or Case Materials, we will notify you and the relevant authorities promptly, as required by law.

7. Data Retention

We keep our data retention policy simple: we retain your personal information and Case Materials for as long as you have an active account with us. Where information reaches us outside an account — such as a message sent through our contact form — we keep it only for the fixed period set out below.

• Active Account Data: Your claim charts, IP, and profile data are kept until you delete your account. Once you trigger an account deletion, we remove this data from our active systems. Copies may persist in encrypted backups until those backups expire in the ordinary course, and remain subject to the same confidentiality and access restrictions while they do. If you are the sole owner of an organization or case that other people still depend on, we will ask you to transfer ownership or remove that material before the deletion can complete, so that colleagues do not lose access to shared work.

• Financial Records: By law, we are required to keep basic transaction and payment history for tax and accounting purposes (typically up to 7 years).

• Technical Logs: We retain application and infrastructure logs for approximately 3 days to monitor security and platform stability, after which they are automatically deleted. If you have consented to analytics, events captured by our analytics provider are retained on the provider's systems in accordance with its own privacy policy.

• Contact Enquiries: Messages sent through the contact form on our website — together with the name, email address, IP address and browser user-agent recorded with them — are retained for 12 months from the date they are submitted, and are deleted after that. This period applies whether or not you hold an account, and deleting it does not depend on you having one.

8. Cookies & Tracking

We use cookies and similar browser storage—small pieces of information kept on your device—to make Legaltra work properly. When you first visit, a banner asks whether we may also set optional analytics cookies; nothing optional is set unless you agree.

You can make or change your choice at any time: select "Privacy preferences" in the footer of any of our public pages to open the Privacy Preference Center. If you decline or later withdraw consent, analytics cookies and storage already in your browser are removed. Please note that essential cookies cannot be switched off — without them, sign-in and checkout do not function.

The groups of cookies and browser storage we use, as the Privacy Preference Center presents them:

9. Children's Privacy

Legaltra is a professional B2B software platform built for legal professionals and plaintiffs in patent litigation. Our services are not intended for, nor do we knowingly collect personal information from, anyone under the age of 18. We fully comply with the Children's Online Privacy Protection Act (COPPA). If we discover that a child has provided us with personal information, we will take immediate steps to delete that data from our servers.

10. International Transfers

Legaltra is hosted in the United States on Amazon Web Services (AWS). Your data, including your Case Materials, is stored and processed in the United States. We do not currently offer regional data residency, and there is no account setting that changes where your data is held. If your professional or contractual obligations require that your material be held in a particular jurisdiction, please contact us at privacy@legaltra.com before uploading it.

If you are located in the European Economic Area (EEA) or the UK, using Legaltra means your personal data is transferred to and processed in the United States. Where such a transfer requires a legal safeguard, we rely on the European Commission's Standard Contractual Clauses. If you need a copy of the transfer terms that apply to your account, or a data processing agreement, contact us at privacy@legaltra.com.

11. Changes to This Policy

Privacy laws and technology evolve, and our business will too. We may update this Privacy Policy from time to time to reflect changes in our practices or legal obligations.

If we make significant changes, we will notify you by sending an email to the address associated with your account or by displaying a prominent notice within the Legaltra platform before the changes take effect. Your continued use of the platform after the effective date constitutes your understanding of the updated policy.

12. Contact Us

We believe privacy should be a conversation. If you have any questions, concerns, or requests regarding this Privacy Policy or how we handle your Case Materials, we are here to help.

Please contact us at:

Email: privacy@legaltra.com

We monitor this inbox closely and aim to respond to all privacy-related inquiries promptly and thoroughly.