Privacy Policy

Last updated: 4 September 2026

1. ABOUT THIS PRIVACY NOTICE

This Privacy Notice explains how Anycase.ai Technologies Inc. (“Anycase,” “we,” “us,” or “our”) collects, uses, stores, shares, and protects personal data when you:

• visit www.anycase.ai or its related subdomains;

• create or use an Anycase account;

• use our legal research, AI-assisted rese arch, document-review, file-upload, or related services;

• communicate with our support, sales, or administrative teams; or

• otherwise interact with Anycase.

“Services” means the Anycase platform, websites, applications, APIs, and related services.

“User Content” means information submitted to or generated through the Services, including queries, prompts, uploaded documents and files, content contained within those files, extracted text, saved materials, retrieved context, and generated outputs.

This Privacy Notice applies to our individual-user and organizational Services. If your organization has entered into a separate agreement or Data Processing Agreement with Anycase, that agreement may contain additional or different provisions. The applicable Data Processing Agreement will govern personal-data processing performed by Anycase on behalf of that organization if there is a conflict concerning that processing.

In this Notice:

• “Customer” means an individual or organization that maintains an Anycase account;

• “User” means a natural person who accesses the Services, whether as a Customer or on behalf of one; and

• “Organization” means an enterprise, firm, or other entity that administers one or more User accounts.

2. OUR DATA-PROTECTION ROLES

For account registration, billing, business communications, marketing, website administration, security, and legal compliance, Anycase generally acts as a Personal Information Controller.

When an enterprise customer submits User Content containing personal data and instructs Anycase to process it through the Services, the enterprise customer generally acts as the Personal Information Controller and Anycase acts as its Personal Information Processor.

If you use Anycase through your employer or another organization, that organization may administer your account, control your access, and determine how User Content is processed. Privacy requests concerning organization-controlled User Content may need to be directed to or coordinated with that organization.

When an individual user submits User Content without an enterprise agreement or organizational instruction, the user acts as the Personal Information Controller of that User Content, while Anycase acts as a Personal Information Processor that processes the data according to the user’s instructions, except where this Notice expressly states otherwise.

3. PERSONAL DATA WE COLLECT

Depending on how you use the Services, we may collect the following categories of information.

3.1 Account and identity information

This may include:

• name;

• email address;

• organization and role;

• account identifiers;

• login and authentication information;

• account permissions;

• subscription or plan information; and

• other information provided during registration or onboarding.

3.2 User Content

User Content may include:

• legal-research queries and search history;

• prompts and instructions;

• uploaded documents, contracts, pleadings, correspondence, and other files;

• text and other content extracted from uploaded files;

• information retrieved from a customer knowledge base;

• generated answers, summaries, drafts, analyses, citations, and other outputs; and

• saved searches, bookmarks, notes, and prior interactions.

Uploaded files may contain text, images, or other embedded content. Images may be processed to extract information needed to provide the requested Services. Anycase does not separately retain extracted images as standalone image files, although information extracted from them may appear in or be retained as part of User Content or generated outputs.

User Content may contain personal information, sensitive personal information, privileged communications, confidential business information, or information relating to third parties.

You and, where applicable, your organization determine what User Content is submitted to the Services.

3.3 Technical and usage information

This may include:

• device, browser, and operating-system information;

• IP address and approximate location derived from it;

• access dates and times;

• session, authentication, and security events;

• pages and features used;

• usage volume and plan-limit information;

• response times, errors, and performance information;

• content-neutral interaction events, such as opening a citation, saving an item, exporting an output, or providing a rating; and

• cookie and similar-technology identifiers.

3.4 Transaction and billing information

This may include:

• billing name and contact details;

• subscription, invoice, and transaction information;

• payment status;

• tax-related information; and

• limited payment-method information received from our payment providers.

Payment-card and similar financial information may be collected and processed directly by our payment providers rather than stored by Anycase.

3.5 Communications and support information

This may include:

• support requests;

• emails and other communications;

• survey and onboarding responses;

• feedback;

• attachments or selected User Content you voluntarily provide for support; and

• records of our response.

4. SOURCES OF PERSONAL DATA

We may obtain personal data:

• directly from you;

• from the organization that provides or administers your account;

• automatically from your browser, device, or use of the Services;

• from payment, authentication, communications, analytics, and other service providers;

• from public legal and government sources or licensed sources; or

• from other third parties where permitted by law.

5. HOW AND WHY WE USE PERSONAL DATA

We may process personal data for the following purposes.

5.1 Providing the Services

We process information to:

• create and administer accounts;

• authenticate users and manage permissions;

• perform legal research, search, retrieval, document analysis, optical character recognition, indexing, embedding, AI inference, and output generation requested by users;

• store and retrieve User Content where the applicable feature is enabled;

• provide customer knowledge bases, APIs, and other enabled features;

• process subscriptions and transactions; and

• provide support.

Depending on the circumstances, this processing may be necessary to perform a contract, take requested steps before entering into a contract, comply with customer instructions, or pursue our legitimate interest in providing the Services.

5.2 Security, reliability, and abuse prevention

We process information to:

• protect accounts and the Services;

• detect and investigate security incidents, fraud, abuse, or misuse;

• enforce our Terms of Service;

• diagnose errors;

• maintain availability and performance; and

• preserve evidence or establish, exercise, or defend legal claims.

This processing may be necessary for our legitimate interests, compliance with legal obligations, or the protection of our lawful rights and those of our users.

5.3 Administration and communications

We process information to:

• manage subscriptions, billing, and customer relationships;

• respond to inquiries;

• send service, security, transaction, and administrative notices;

• conduct onboarding and surveys; and

• send marketing communications where permitted.

You may opt out of marketing communications, but you may continue to receive necessary service, security, and transaction messages.

5.4 Analytics and product improvement

We may use technical and usage information that does not contain, reveal, reproduce, or permit reconstruction of User Content to understand how the Services perform and are used. This processing is based on our legitimate interest in maintaining and improving the Services in a manner that does not override your fundamental rights and freedoms.

We may also use public, licensed, synthetic, and internally created data to test, evaluate, develop, and improve the Services.

We do not use User Content for generalized model or product improvement except as expressly described in Section 6.

5.5 Legal compliance

We may process information where reasonably necessary to:

• comply with applicable law, regulation, court orders, and lawful government requests;

• respond to regulatory inquiries;

• protect the rights, safety, and property of Anycase, our users, and others; or

• establish, exercise, or defend legal claims.

6. USER CONTENT, AI PROCESSING, AND HUMAN ACCESS

6.1 Automated processing required to provide the Services

Queries, prompts, uploaded files, extracted text, retrieved context, and other User Content may be processed automatically by Anycase systems and approved service providers to perform the functions requested by the user.

Depending on the enabled features, this may include storage, optical character recognition, indexing, embedding, vectorization, retrieval, ranking, AI inference, and output generation.

This processing provides research assistance, document analysis, drafting, and other user-requested outputs. Users remain responsible for reviewing the outputs and deciding how to use them.

6.2 No routine human review

Anycase personnel do not routinely read or review users’ queries, prompts, uploaded files, extracted text, or generated outputs.

Human access to User Content is limited to circumstances where it is reasonably necessary for:

• support or troubleshooting requested or authorized by the user or Customer;

• investigating a security incident, suspected abuse, fraud, or misuse;

• complying with applicable law or a binding legal request; or

• a clearly identified feedback, evaluation, or product-improvement program authorized by the applicable Customer.

Access is limited to authorized personnel who are subject to appropriate confidentiality obligations and only to the information reasonably necessary for the applicable purpose.

A Customer’s authorization for a feedback, evaluation, or product-improvement program does not, by itself, establish that the Customer has the legal basis to permit review of third-party personal data contained in its User Content. The Customer remains responsible for establishing that basis under the applicable Terms of Service or Data Processing Agreement.

6.3 No training on User Content without permission

Without the applicable Customer’s prior authorization, Anycase does not, and does not permit a service provider to, use User Content to train, fine-tune, benchmark, evaluate, or otherwise improve artificial-intelligence or machine-learning models, large language models, optical character recognition engines, embedding models, ranking models, or retrieval systems.

For an enterprise account, an individual authorized user’s action does not constitute the Organization’s authorization unless the Organization has enabled or otherwise authorized the applicable program.

If Anycase offers an optional feedback or evaluation program involving selected User Content, we will clearly identify:

• what information will be used or shared;

• how it will be used;

• whether human review is involved; and

• the consent or authorization required before participation.

6.4 Permitted operational processing

The restriction in Section 6.3 does not prevent Anycase from processing User Content as reasonably necessary to:

• provide the user-requested Services;

• secure and operate the platform;

• maintain availability and reliability;

• troubleshoot and correct defects;

• respond to authorized support requests; or

• investigate security incidents, fraud, abuse, or misuse.

Such processing does not give Anycase a continuing right to retain, reuse, or repurpose User Content for unrelated purposes.

7. WHEN WE SHARE PERSONAL DATA

We do not sell or rent personal data. We do not use User Content for targeted advertising.

We may disclose personal data to the following categories of recipients when reasonably necessary.

7.1 Service providers

We use service providers for functions such as:

• cloud hosting, storage, databases, authentication, and content delivery;

• AI inference, optical character recognition, embedding, ranking, and retrieval;

• payment processing;

• product analytics and feature management;

• communications, forms, surveys, and customer support; and

• security, monitoring, and professional services.

These providers may process information only to provide their services to Anycase and are subject to appropriate contractual, confidentiality, privacy, and security obligations.

Where providers process User Content, we require restrictions against using it for their own model training or generalized improvement without the applicable Customer’s authorization.

Detailed subprocessor information may be provided to enterprise customers through the applicable Data Processing Agreement and its schedules.

7.2 Your organization

If your account is provided or managed by an Organization, authorized administrators may be able to manage your account, permissions, subscription, and organization-controlled information.

Their access to conversations or User Content will depend on the Organization’s account configuration, applicable agreement, and enabled features.

7.3 Customer-directed disclosures

We may disclose information when you or your Organization instructs us to do so, including through integrations, APIs, exports, shared links, or other user-controlled features.

7.4 Legal and safety disclosures

We may disclose information where reasonably necessary to comply with applicable law or a binding legal request, protect rights or safety, investigate fraud or abuse, or establish, exercise, or defend legal claims.

Where legally permitted and appropriate, we will seek to notify the affected Customer before disclosing User Content in response to a compulsory legal request.

7.5 Corporate transactions

If Anycase is involved in a merger, acquisition, financing, reorganization, or sale of assets, information may be disclosed under appropriate confidentiality protections and transferred as part of the transaction, subject to applicable law.

8. INTERNATIONAL PROCESSING

Anycase and its service providers may process or store personal data in the Philippines and other jurisdictions.

Where personal data is transferred internationally, we use contractual commitments and other appropriate safeguards consistent with applicable data-protection law.

Anycase remains responsible for its own processing obligations under applicable law and requires its service providers to protect personal data through appropriate contractual and security safeguards.

Not every service provider or processing location is used for every user, Customer, feature, or request.

9. SECURITY

We maintain reasonable organizational, administrative, physical, and technical safeguards designed to protect personal data and User Content against accidental or unlawful destruction, loss, alteration, unauthorized disclosure, and unauthorized access.

These safeguards may include, where appropriate:

• encryption in transit and at rest;

• authentication and access controls;

• least-privilege access;

• security monitoring and logging;

• vulnerability management;

• secure software-development practices; and

• backup and recovery controls.

No internet service or storage system can be guaranteed to be completely secure. You are responsible for protecting your account credentials and promptly notifying us if you suspect unauthorized access.

If a personal data breach requires notification under applicable law, we will notify the National Privacy Commission and affected data subjects in accordance with the timelines prescribed by law.

10. RETENTION AND DELETION

We retain information only for as long as reasonably necessary for the purposes described in this Privacy Notice, including providing the Services, maintaining security, complying with legal obligations, resolving disputes, and enforcing agreements.

Retention depends on the type of information and the applicable account or agreement:

• Account and subscription information may be retained while the account is active and afterward as necessary for legal, tax, accounting, security, fraud-prevention, or dispute-resolution purposes.

• User Content may be retained during the active account or subscription for as long as necessary to provide the enabled Services, subject to user settings and applicable agreements.

• If a subscription expires, certain account information and prior search history may remain available in read-only form, depending on product functionality and applicable retention rules.

• If an account remains inactive for two years, we may delete or anonymize account information, search history, usage information, and User Content unless continued retention is reasonably necessary or legally required.

• Support communications may be retained as necessary to address the request, maintain business records, improve support, or protect legal rights.

• Security and technical logs may be retained for an appropriate period based on their purpose and applicable operational requirements.

• Information stored solely in protected backups may remain until it is deleted through the ordinary backup cycle.

You may request deletion by contacting dpo@anycase.ai or support@anycase.ai. Deletion requests are subject to identity verification, applicable law, contractual obligations, legitimate security needs, the rights of other persons, and backup or legal-retention exceptions.

We aim to respond to deletion and other rights requests within a reasonable period, generally not exceeding thirty days after verification of the request, except where a longer period is reasonably necessary because of the nature or complexity of the request.

Enterprise-customer deletion and return obligations are governed by the applicable customer agreement and Data Processing Agreement.

11. YOUR DATA-PROTECTION RIGHTS

Subject to applicable law and lawful limitations, you may have the right to:

• be informed about the processing of your personal data;

• request access to your personal data;

• object to certain processing;

• request correction of inaccurate or incomplete information;

• request erasure, blocking, or restriction of processing;

• withdraw consent where processing is based on consent;

• obtain applicable personal data in a portable format;

• lodge a complaint with the National Privacy Commission; and

• seek damages where provided by law.

To exercise a right, contact dpo@anycase.ai. We may request information necessary to verify your identity and authority.

If personal data is controlled by an enterprise customer or another Organization, we may refer your request to that Organization or assist it in responding.

12. COOKIES AND COMMUNICATION CHOICES

We may use cookies, local storage, and similar technologies for:

• authentication and session management;

• security;

• remembering preferences;

• measuring performance and feature usage; and

• analytics.

Where required by law, we will request consent before using optional technologies. You may also control certain technologies through your browser or device settings, although disabling necessary technologies may affect the Services.

You may unsubscribe from marketing emails through the unsubscribe mechanism in the message or by contacting us. This will not stop essential account, security, transaction, or service communications.

13. CHILDREN

The Services are intended for persons who have reached the age of majority and are legally capable of entering into an agreement.

We do not knowingly offer the Services directly to children. If you believe a child has provided personal data without appropriate authorization, contact dpo@anycase.ai.

14. CHANGES TO THIS PRIVACY NOTICE

We may update this Privacy Notice to reflect changes in our Services, practices, or legal obligations.

We will post the updated version and revise the “Last updated” date. Where a change is material, we will provide additional notice through the Services, by email, or by another reasonable method.

15. CONTACT US

Anycase.ai Technologies Inc.

Level 21, 8 Rockwell Building
Hidalgo Drive, Rockwell Center
Brgy. Poblacion, Makati City
NCR 1210, Philippines

Data Protection Officer: Atty. Neil Jerome A. Rapatan
Privacy inquiries and rights requests: dpo@anycase.ai
General support: support@anycase.ai