Legal & Policies

These Terms of Service ("Terms") govern access to and use of the LegalsOne hosted platform, client portals, applications, support services, and related services described in an order form, statement of work, or similar ordering document (collectively, the "Services"). These Terms form part of the agreement between the customer identified in the applicable Order Form ("Customer") and the LegalsOne contracting entity identified in that Order Form ("LegalsOne").

By signing an Order Form, creating an administrative account, or using the Services, Customer agrees to these Terms. If an individual accepts these Terms on behalf of an organization, that individual represents that they have authority to bind the organization.

1. Agreement Structure

The agreement consists of:

• the applicable Order Form;
• these Terms;
• the LegalsOne Data Processing Agreement, when LegalsOne processes personal data for Customer;
• the Acceptable Use Policy;
• any statement of work or service-specific schedule; and
• any other document expressly incorporated by reference.

If documents conflict, the following order controls unless an Order Form expressly states otherwise: the Order Form, a signed statement of work or service-specific schedule, the Data Processing Agreement for data-protection matters, these Terms, and the Acceptable Use Policy.

2. The Services

2.1 Right to Use

Subject to the Agreement and payment of applicable fees, LegalsOne grants Customer a limited, non-exclusive, non-transferable right during the subscription term to permit its authorized personnel to access and use the Services for Customer's internal business and legal-operations purposes.

2.2 Authorized Users

Customer may authorize employees, contractors, and other personnel under Customer's direction to use the Services ("Authorized Users"). Customer is responsible for:

• ensuring that Authorized Users comply with the Agreement;
• assigning access appropriate to each user's role;
• maintaining accurate account and contact information;
• promptly disabling accounts that no longer require access; and
• all activity conducted through Customer accounts, except to the extent caused by LegalsOne's breach of the Agreement.

Accounts are individual and may not be shared. Customer must promptly notify LegalsOne of suspected unauthorized access or credential compromise.

2.3 Administration and Configuration

Customer controls its users, permissions, workflows, matter access, integrations, templates, retention choices made available in the Services, and other administrative settings. Customer is responsible for configuring those settings in a manner appropriate for its professional, ethical, contractual, and legal obligations.

2.4 Changes to the Services

LegalsOne may improve or modify the Services during the subscription term. LegalsOne will not materially reduce the core functionality purchased by Customer during the then-current term without providing reasonable notice, except where a change is required to address security, legal, regulatory, or third-party dependency concerns.

2.5 Beta and Preview Features

LegalsOne may offer preview, pilot, or beta features. Such features are optional, may be changed or discontinued, and may be subject to additional terms. Unless an Order Form states otherwise, beta features are provided without a service-level commitment and should not be used as the sole basis for a filing deadline, trust-accounting decision, legal conclusion, or other critical decision.

3. Customer Data

3.1 Ownership

As between the parties, Customer retains all right, title, and interest in data, documents, communications, recordings, transcripts, files, instructions, configurations, and other content submitted to or processed through the Services by or for Customer ("Customer Data"). LegalsOne retains all right, title, and interest in the Services, documentation, methods, software, designs, and related intellectual property.

3.2 Limited License

Customer grants LegalsOne a limited right to host, copy, transmit, display, modify, and otherwise process Customer Data only as necessary to:

• provide, secure, maintain, and support the Services;
• follow Customer's documented instructions;
• prevent or address fraud, abuse, or security incidents;
• comply with law; and
• exercise rights expressly granted by the Agreement.

LegalsOne does not acquire ownership of Customer Data.

3.3 Customer Responsibilities

Customer represents and warrants that:

• it has all rights, permissions, notices, and lawful bases needed to submit and process Customer Data;
• its instructions to LegalsOne comply with applicable law and professional obligations;
• it will not direct LegalsOne to process data in a manner that violates the rights of another person;
• it will obtain any required consent for recordings, monitoring, communications, electronic signatures, automated messages, or use of artificial intelligence; and
• it will use appropriate judgment before placing particularly sensitive or regulated information in optional features.

3.4 No Sale of Customer Data

LegalsOne will not sell Customer Data, use Customer Data for cross-context behavioral advertising, or use Customer Data to build advertising profiles.

3.5 Aggregated Information

LegalsOne may generate statistical or aggregated information about operation and use of the Services only if that information does not identify Customer, an Authorized User, a client, or another individual. LegalsOne may use such information to operate, secure, support, and improve the Services.

4. Confidentiality

4.1 Confidential Information

"Confidential Information" means non-public information disclosed by one party to the other that is marked confidential or that reasonably should be understood to be confidential. Customer Data is Customer's Confidential Information. Confidential Information does not include information that the receiving party can demonstrate:

• is or becomes public without breach of the Agreement;
• was lawfully known without confidentiality restriction before disclosure;
• is received lawfully from another source without confidentiality restriction; or
• is independently developed without use of the disclosing party's Confidential Information.

4.2 Protection and Use

The receiving party will:

• use Confidential Information only to perform or exercise rights under the Agreement;
• protect it using at least reasonable care;
• disclose it only to personnel and service providers who need access and are bound by confidentiality obligations; and
• remain responsible for its handling as required by the Agreement.

4.3 Required Disclosure

If legally required to disclose Confidential Information, the receiving party may do so after giving reasonable advance notice when legally permitted and reasonably assisting the disclosing party in seeking protective treatment.

5. Legal and Professional Responsibility

5.1 Customer Remains Responsible

The Services support legal operations but do not replace professional judgment. Customer remains solely responsible for:

• legal advice and representation;
• court, agency, contractual, and limitation deadlines;
• conflicts analysis and clearance;
• billing, trust, tax, and accounting decisions;
• client communications and disclosures;
• review and approval of documents, calculations, summaries, and filings; and
• compliance with professional-conduct rules and applicable law.

5.2 Artificial Intelligence and Automation

Automated and artificial-intelligence-assisted outputs may be incomplete, inaccurate, or unsuitable for a particular matter. Customer must ensure meaningful human review before relying on or communicating such outputs. Customer may not use the Services to make a decision that produces legal or similarly significant effects about an individual without appropriate review, authority, notice, and safeguards.

5.3 Communications and Recordings

Customer is responsible for determining when consent, notice, opt-out rights, or other requirements apply to email, text messages, telephone calls, recordings, transcripts, marketing communications, and automated outreach.

6. Security and Shared Responsibility

LegalsOne maintains reasonable administrative, organizational, and technical safeguards designed to protect the confidentiality, integrity, and availability of Customer Data. No service can guarantee absolute security.

Customer is responsible for:

• using strong authentication and available account-security features;
• applying least-privilege access;
• protecting credentials and user devices;
• reviewing access and activity;
• securely configuring Customer-controlled integrations;
• maintaining appropriate endpoint, network, and personnel controls; and
• promptly reporting suspected security events.

Additional processing and security commitments are described in the Data Processing Agreement and client-facing Trust and Security Center materials.

7. Support, Availability, and Maintenance

LegalsOne will provide the support stated in the Order Form. Unless a separate service-level agreement applies, LegalsOne does not guarantee uninterrupted or error-free operation.

LegalsOne may perform maintenance and may suspend affected portions of the Services when reasonably necessary to protect security, prevent harm, comply with law, or maintain the Services. When practicable, LegalsOne will provide advance notice of planned maintenance that is expected to cause material disruption.

8. Fees and Payment

8.1 Fees

Customer will pay the fees and applicable taxes stated in the Order Form. Except as expressly provided in the Agreement, fees are non-cancellable and non-refundable.

8.2 Invoicing

Invoices are due within the period stated in the Order Form. Undisputed overdue amounts may accrue interest at the lesser of 1.5% per month or the maximum amount permitted by law.

8.3 Disputes

Customer must notify LegalsOne of a good-faith invoice dispute before the applicable due date and provide reasonable detail. The parties will work in good faith to resolve the dispute. Customer must timely pay all undisputed amounts.

8.4 Taxes

Fees exclude taxes, duties, and governmental assessments. Customer is responsible for applicable taxes other than taxes based on LegalsOne's net income.

9. Term and Termination

9.1 Subscription Term

The subscription begins and renews as stated in the Order Form. If the Order Form does not specify renewal terms, the subscription does not automatically renew.

9.2 Termination for Cause

Either party may terminate the Agreement if the other party materially breaches it and fails to cure the breach within 30 days after written notice. A party may terminate immediately if the breach is not capable of cure, involves unlawful use, or creates a material security risk.

9.3 Suspension

LegalsOne may suspend access to the affected Services if:

• Customer's use presents an imminent security or legal risk;
• Customer materially violates the Acceptable Use Policy;
• continued use could harm the Services or another person; or
• undisputed fees remain overdue after reasonable notice.

LegalsOne will limit a suspension to the extent reasonably practicable and restore access after the issue is resolved.

9.4 Effect of Termination

Upon termination:

• Customer's right to use the Services ends;
• accrued payment obligations remain due;
• each party will return or protect Confidential Information as required by the Agreement; and
• Customer may request export or return of Customer Data during the post-termination period stated in the Order Form or Data Processing Agreement.

LegalsOne may delete Customer Data after the applicable return period, subject to legal obligations and routine backup lifecycles.

10. Intellectual Property

10.1 LegalsOne Materials

LegalsOne and its licensors own the Services and related intellectual property. No rights are granted except those expressly stated in the Agreement.

10.2 Restrictions

Customer may not:

• copy, modify, or create derivative works of the Services except as expressly permitted;
• reverse engineer or attempt to discover source code except where law prohibits this restriction;
• remove proprietary notices;
• resell, sublicense, or provide the Services as a bureau service without written permission;
• access the Services to build or benchmark a competing product for publication; or
• use the Services beyond licensed limits.

10.3 Feedback

Customer may provide suggestions or feedback. LegalsOne may use feedback without restriction or obligation, provided it does not disclose Customer Confidential Information.

11. Warranties

LegalsOne warrants that during the subscription term:

• the Services will materially conform to applicable documentation;
• LegalsOne will provide the Services in a professional and workmanlike manner; and
• LegalsOne will not knowingly introduce malicious code into the Services.

Customer's exclusive remedy for breach of this warranty is re-performance or correction. If LegalsOne cannot materially correct the breach within a reasonable period, Customer may terminate the affected Services and receive a prorated refund of prepaid fees for the unused portion of the terminated term.

Except for the express warranties in the Agreement, the Services are provided "as is" and "as available." To the extent permitted by law, each party disclaims implied warranties of merchantability, fitness for a particular purpose, non-infringement, and any warranty arising from course of dealing or usage of trade.

12. Indemnification

12.1 LegalsOne Indemnity

LegalsOne will defend Customer against a third-party claim that Customer's authorized use of the Services infringes a patent, copyright, or trademark, and will pay damages and costs finally awarded or agreed in settlement. LegalsOne may modify or replace the affected Services or terminate them and refund prepaid fees for the unused portion of the term.

This obligation does not apply to claims arising from Customer Data, Customer instructions, unauthorized use, modification not made by LegalsOne, or combination with items not supplied or approved by LegalsOne.

12.2 Customer Indemnity

Customer will defend LegalsOne against a third-party claim arising from Customer Data, Customer's unlawful use of the Services, or Customer's material violation of the Acceptable Use Policy, and will pay damages and costs finally awarded or agreed in settlement.

12.3 Procedure

The indemnified party must promptly notify the indemnifying party, provide reasonable cooperation, and allow the indemnifying party to control the defense and settlement. A settlement may not admit fault by or impose non-monetary obligations on the indemnified party without written consent.

13. Limitation of Liability

To the maximum extent permitted by law:

• neither party is liable for indirect, incidental, special, exemplary, punitive, or consequential damages, or for loss of profits, revenues, goodwill, or data, even if advised of the possibility; and
• each party's aggregate liability arising from the Agreement will not exceed the fees paid or payable for the affected Services during the 12 months preceding the event giving rise to liability.

The limitations above do not apply to:

• payment obligations;
• fraud or willful misconduct;
• infringement or misappropriation of the other party's intellectual property;
• a party's indemnification obligations;
• Customer's violation of the use restrictions; or
• liability that cannot lawfully be limited.

If applicable law does not permit a limitation stated above, the limitation applies to the maximum extent permitted.

14. Compliance with Law

Each party will comply with laws applicable to its performance under the Agreement. Customer will not use the Services in violation of export-control, sanctions, anti-corruption, communications, privacy, employment, or professional-responsibility laws.

The Services are not directed to children and may not be used to create accounts for children unless Customer has a lawful professional reason, appropriate authority, and necessary safeguards.

15. General Terms

15.1 Notices

Contract notices must be sent using the notice contacts and methods stated in the Order Form. Operational notices may be delivered through the Services or by email to Customer's administrative contact.

15.2 Assignment

Neither party may assign the Agreement without the other's written consent, except to an affiliate or in connection with a merger, reorganization, or sale of substantially all relevant assets, provided the assignee agrees to the Agreement.

15.3 Governing Law and Venue

The governing law and exclusive forum are those identified in the Order Form. The United Nations Convention on Contracts for the International Sale of Goods does not apply.

15.4 Force Majeure

Neither party is liable for delay or failure caused by circumstances beyond its reasonable control, except for payment obligations.

15.5 Independent Contractors

The parties are independent contractors. The Agreement does not create an agency, partnership, fiduciary, employment, or joint-venture relationship.

15.6 No Third-Party Beneficiaries

The Agreement creates no third-party beneficiary rights except as expressly required by applicable data-protection law.

15.7 Severability and Waiver

If a provision is unenforceable, it will be modified to the minimum extent necessary, and the remaining provisions remain effective. Failure to enforce a provision is not a waiver.

15.8 Entire Agreement

The Agreement is the complete agreement regarding the Services and supersedes prior or contemporaneous proposals, communications, and agreements on the same subject.

15.9 Updates to These Terms

LegalsOne may update these Terms for future subscription periods. Material changes will be communicated before they apply. Changes required by law or necessary to address an urgent security concern may take effect earlier with reasonable notice.

16. Contact

Questions about these Terms may be submitted through the LegalsOne support or legal contact identified on the applicable website, Order Form, or customer support channel.

This Privacy Policy explains how LegalsOne collects, uses, discloses, and protects personal information when individuals visit LegalsOne websites, communicate with LegalsOne, create or use a LegalsOne account, access a client-facing portal, or otherwise interact with LegalsOne services.

"LegalsOne" means the LegalsOne contracting entity identified in the applicable Order Form. "Services" means the LegalsOne hosted platform, client portals, applications, support services, and related offerings.

1. Our Roles

LegalsOne handles personal information in two different roles.

1.1 Information LegalsOne Controls

LegalsOne acts as a controller or business for personal information used for its own business purposes, such as:

• account registration and administration;
• customer, prospect, and business contact management;
• contracting, billing, and support;
• website operation and security;
• service communications;
• product improvement using de-identified or aggregated information; and
• legal, compliance, and fraud-prevention purposes.

This Privacy Policy applies directly to that information.

1.2 Customer Data LegalsOne Processes

Customers use the Services to manage information relating to their personnel, prospects, clients, matters, communications, documents, payments, operations, and other activities ("Customer Data"). For Customer Data, the Customer generally determines why and how personal information is processed, and LegalsOne processes it on the Customer's instructions.

If you are a client, prospect, employee, contractor, or other individual associated with a LegalsOne Customer and have a question about Customer Data, please contact that Customer first. LegalsOne will assist the Customer as required by the Data Processing Agreement and applicable law.

2. Personal Information We Collect

Depending on how you interact with the Services, LegalsOne may collect the following categories.

2.1 Account and Identity Information

• name, username, business email address, telephone number, and professional contact details;
• organization, title, department, and role;
• account status, group membership, permissions, and authentication information;
• communication and notification preferences; and
• records relating to account requests, approvals, and support.

2.2 Customer and Legal-Operations Information

Customer Data may include:

• client, prospect, witness, provider, referral, opposing-party, and related-contact information;
• legal matter details, intake answers, notes, conflicts information, deadlines, tasks, and calendars;
• documents, questionnaire responses, uploads, signatures, and document metadata;
• email, text, telephone, and other communication content and metadata;
• recordings, transcripts, summaries, and consultation information;
• billing records, time and expense entries, invoices, payment status, trust-related records, and financial information;
• employee directory, onboarding, leave, performance, credential, and personnel information;
• training, policy acknowledgement, assignment, and assessment records; and
• other information a Customer chooses to submit.

Customer Data may contain sensitive personal information. Customers are responsible for deciding what information to submit and ensuring that their processing is lawful.

2.3 Payment and Transaction Information

LegalsOne may process:

• billing contact and invoice information;
• transaction amount, date, status, and reference information;
• payment-link activity and related records; and
• information needed to reconcile, refund, or support a payment.

Unless expressly agreed otherwise, payment credentials used to complete a transaction are handled through the selected payment service and are not intended to be stored in full by LegalsOne.

2.4 Communications and Support Information

We collect information you provide when you:

• request a demonstration or proposal;
• communicate with sales, implementation, support, privacy, or security personnel;
• report a problem or security concern;
• participate in training or a consultation; or
• respond to a survey or provide feedback.

This information may include message content, attachments, call details, and support history.

2.5 Device, Usage, and Security Information

We may collect:

• internet protocol address and general network information;
• browser, device, and operating-system information;
• sign-in, access, session, and authentication events;
• pages or features accessed and actions taken;
• diagnostic, performance, and error information;
• security, fraud, and abuse signals; and
• cookie, local-storage, and preference information described in the Cookie Policy.

2.6 Activity Metadata

If a Customer enables optional activity-capture features, the Services may collect metadata about work activity, such as application or process name, window title, domain, document path, timestamps, device identifier, work interval, idle or pause state, and timezone. These features are intended to support review-first timekeeping and operational audit. They are not intended to capture keystrokes, passwords, or the contents of unrelated files.

Pending activity metadata is generally retained for a limited review period, which may be 45 days unless Customer configuration or a contractual requirement states otherwise. Information converted into a business, billing, or audit record may be retained with that record.

2.7 Information from Customer-Directed Services

When a Customer connects another service to LegalsOne, we may receive information that the Customer authorizes that service to provide, such as identity, calendar, communication, document, advertising, signature, payment, or call information. The Customer controls which connections are enabled and is responsible for the permissions it grants.

3. Sources of Personal Information

We collect personal information:

• directly from you;
• from the Customer that creates or administers your account;
• from clients or other individuals using a Customer-authorized portal;
• through your use of the Services;
• from services that a Customer chooses to connect;
• from public or professional sources where permitted by law; and
• from business partners involved in sales, implementation, support, or service delivery.

4. How We Use Personal Information

LegalsOne uses personal information for the following purposes.

4.1 Provide and Operate the Services

• create and administer accounts;
• authenticate users and manage sessions;
• provide requested workflows, portals, documents, communications, billing, and reporting;
• process Customer instructions;
• maintain preferences and configurations; and
• deliver support, training, implementation, and service communications.

4.2 Secure the Services

• prevent unauthorized access, abuse, fraud, and misuse;
• investigate suspicious activity;
• maintain access, security, and audit records;
• protect the rights and safety of Customers, users, and others; and
• test, monitor, and improve reliability.

4.3 Manage Our Business Relationship

• communicate about proposals, subscriptions, renewals, invoices, and accounts;
• manage contractual obligations;
• respond to inquiries and requests;
• conduct customer-success activities; and
• maintain business and legal records.

4.4 Improve the Services

• understand how features are used;
• troubleshoot and improve performance;
• develop new features;
• conduct quality assurance; and
• create aggregated or de-identified insights.

LegalsOne does not use Customer Data to train a generalized artificial-intelligence model unless Customer expressly agrees in writing.

4.5 Comply with Law

• respond to lawful requests;
• establish, exercise, or defend legal claims;
• comply with tax, accounting, regulatory, and recordkeeping obligations; and
• enforce agreements and policies.

5. Legal Bases

Where a legal basis is required, LegalsOne relies on one or more of the following:

• performance of a contract;
• steps requested before entering a contract;
• compliance with a legal obligation;
• legitimate interests, including operating, securing, supporting, and improving the Services;
• consent, when required; and
• establishment, exercise, or defense of legal claims.

Where LegalsOne processes Customer Data for a Customer, the Customer determines the applicable legal basis unless law provides otherwise.

6. How We Disclose Personal Information

LegalsOne may disclose personal information to the following categories of recipients.

6.1 Customer and Authorized Users

Information may be available to the Customer that controls the relevant account, portal, matter, workspace, or record and to users authorized by that Customer.

6.2 Service Providers

We use service providers to support functions such as hosting, storage, communications, identity, customer support, document processing, payments, monitoring, security, and professional services. They may process personal information only for authorized purposes and under appropriate contractual obligations.

Current categories and material changes are described through LegalsOne's client-facing Trust Center or contractual notice process. This Privacy Policy intentionally does not list individual providers.

6.3 Customer-Directed Connections

We disclose information to services that a Customer chooses to connect or use. The Customer controls those connections and should review the terms and privacy practices applicable to them.

6.4 Professional Advisers

We may disclose information to auditors, insurers, accountants, legal counsel, and other professional advisers subject to appropriate confidentiality duties.

6.5 Legal and Safety Disclosures

We may disclose information when we reasonably believe disclosure is required by law or necessary to:

• respond to valid legal process;
• protect rights, safety, and security;
• investigate fraud, abuse, or unlawful conduct; or
• enforce our agreements.

When legally permitted and appropriate, we will direct a request for Customer Data to the Customer or notify the Customer before disclosure.

6.6 Corporate Transactions

Information may be disclosed in connection with a financing, merger, acquisition, restructuring, sale of assets, or similar transaction, subject to appropriate confidentiality and data-protection measures.

7. No Sale or Behavioral Advertising

LegalsOne does not sell personal information for money. LegalsOne does not share personal information for cross-context behavioral advertising and does not use Customer Data for targeted advertising.

If LegalsOne changes these practices, it will update this Privacy Policy and provide any legally required choices before the change applies.

8. Artificial Intelligence

Some optional features may use artificial intelligence to assist with summaries, drafting, translation, questionnaires, or other workflows.

• The Customer decides whether to enable and use those features.
• Outputs require human review and should not be treated as legal advice.
• LegalsOne processes inputs and outputs to provide the requested feature, maintain security, and support the Customer.
• LegalsOne does not use Customer Data to train generalized models without express written agreement.
• Customers should not use automated outputs to make legal or similarly significant decisions about an individual without appropriate authority, notice, review, and safeguards.

9. Retention

LegalsOne retains personal information only as long as reasonably necessary for the purposes described in this Privacy Policy, including to:

• provide the Services;
• comply with Customer instructions and contractual commitments;
• maintain security and auditability;
• comply with law; and
• resolve disputes and enforce agreements.

Retention depends on the type of information:

• Customer Data is generally retained for the subscription term and the agreed return or deletion period.
• Account, billing, and contract records may be retained for legal and business recordkeeping.
• Security and diagnostic records are retained for a limited operational period appropriate to their purpose.
• Optional activity metadata may be retained for a short review window unless converted into a business record.
• Backup copies are overwritten according to the applicable backup lifecycle.

When information is no longer required, LegalsOne deletes, de-identifies, or securely isolates it, subject to legal obligations and technical limitations inherent in routine backups.

10. Security

LegalsOne uses reasonable administrative, organizational, and technical safeguards designed to protect personal information. These include controls relating to identity, authentication, access, permissions, auditability, secure development, service monitoring, recovery, and incident response.

No method of transmission or storage is completely secure. Customers and users also play an important role by protecting credentials and devices, using available security features, granting least-privilege access, and promptly reporting concerns.

More information is available in the client-facing Trust and Security Center.

11. International Data Transfers

Personal information may be processed in a country different from the country where it was collected. Where required, LegalsOne uses recognized legal mechanisms and contractual safeguards for international transfers.

Customers may request information about the transfer mechanism applicable to their Services through the privacy contact identified in their Agreement or customer support channel.

12. Your Privacy Rights

Depending on your location and relationship with LegalsOne, you may have the right to:

• request access to personal information;
• request correction of inaccurate information;
• request deletion;
• request restriction of processing;
• object to certain processing;
• receive portable information;
• withdraw consent;
• opt out of certain uses;
• appeal a decision on a privacy request; and
• lodge a complaint with an appropriate regulator.

These rights may be subject to exceptions. LegalsOne will not discriminate against you for exercising a privacy right.

12.1 Requests Relating to Customer Data

If your information was submitted by a LegalsOne Customer, please direct your request to that Customer. LegalsOne will assist the Customer as required.

12.2 Requests Relating to LegalsOne

For information LegalsOne controls, submit a request through the privacy or support contact identified on the applicable LegalsOne website, Order Form, or customer support channel. We may need to verify your identity and authority before completing a request.

Authorized agents may submit requests where permitted by law. We may require proof of authorization and identity verification.

13. Cookies and Similar Technologies

LegalsOne uses cookies and browser storage for authentication, security, requested functionality, and user preferences. LegalsOne does not currently use advertising cookies in the Services.

For more information, including typical retention periods and browser controls, see the LegalsOne Cookie Policy.

14. Communications Choices

You may opt out of promotional email using the unsubscribe method included in the message or by contacting LegalsOne. You will continue to receive transactional, security, account, and service communications when necessary.

Communications sent by a Customer through the Services are controlled by that Customer. Contact the Customer regarding those messages.

15. Children

The Services are intended for organizations and professional users and are not directed to children. LegalsOne does not knowingly collect personal information directly from a child for its own marketing purposes.

A Customer may process information about a minor when necessary for legal representation or another lawful professional purpose. In that situation, the Customer is responsible for authority, notices, consents, and safeguards.

16. Changes to this Privacy Policy

LegalsOne may update this Privacy Policy to reflect changes in law, the Services, or processing practices. The revised policy will show a new effective date. If a change materially affects how LegalsOne uses personal information, LegalsOne will provide additional notice when required.

17. Contact

Privacy questions and requests may be submitted through the privacy or support contact identified on the applicable LegalsOne website, Order Form, or customer support channel.

This Data Processing Agreement ("DPA") forms part of the agreement between the customer identified in an Order Form ("Customer") and the LegalsOne contracting entity identified in that Order Form ("LegalsOne") for the provision of the Services (the "Agreement").

This DPA applies when LegalsOne processes Customer Personal Data on behalf of Customer. It is designed to address generally applicable controller-to-processor and business-to-service-provider requirements. The parties may enter a jurisdiction-specific addendum when required.

1. Definitions

1.1 Applicable Data Protection Law

"Applicable Data Protection Law" means privacy, data-protection, and data-security law applicable to the processing of Customer Personal Data under the Agreement.

1.2 Customer Personal Data

"Customer Personal Data" means personal information, personal data, or a similar regulated category contained in Customer Data and processed by LegalsOne on behalf of Customer.

1.3 Data Subject

"Data Subject" means an identified or identifiable individual to whom Customer Personal Data relates.

1.4 Process and Processing

"Process" and "Processing" mean any operation performed on Customer Personal Data, including collection, recording, organization, storage, adaptation, retrieval, consultation, use, transmission, disclosure, restriction, deletion, or destruction.

1.5 Security Incident

"Security Incident" means a confirmed breach of security leading to accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to Customer Personal Data processed by LegalsOne. Security Incident does not include unsuccessful attempts or events that do not compromise Customer Personal Data, such as blocked scans, failed sign-in attempts, or rejected requests.

1.6 Subprocessor

"Subprocessor" means a service provider engaged by LegalsOne to process Customer Personal Data on behalf of Customer in connection with the Services.

Terms such as "controller," "processor," "business," "service provider," "contractor," "sell," and "share" have the meanings assigned by Applicable Data Protection Law.

2. Roles and Scope

2.1 Roles

As between the parties:

• Customer is the controller or business for Customer Personal Data.
• LegalsOne is the processor, service provider, or contractor acting on Customer's behalf.
• Each party is independently responsible for complying with obligations applicable to its role.

If Customer is itself a processor, Customer appoints LegalsOne as its subprocessor and represents that it has authority to do so.

2.2 Processing Details

The subject matter, duration, nature, purpose, data types, and Data Subject categories are described in Annex I.

2.3 Instructions

LegalsOne will process Customer Personal Data only:

• to provide, secure, support, and maintain the Services;
• as described in the Agreement;
• on Customer's documented instructions; or
• as required by law.

The Agreement, Customer's use and configuration of the Services, support requests, and other written directions consistent with the Agreement constitute documented instructions.

If LegalsOne reasonably believes an instruction violates Applicable Data Protection Law, LegalsOne will inform Customer unless prohibited by law and may pause the affected processing while the parties address the issue.

2.4 Required Processing

If law requires LegalsOne to process Customer Personal Data other than on Customer's instructions, LegalsOne will inform Customer before processing unless legally prohibited.

3. Customer Obligations

Customer will:

• comply with Applicable Data Protection Law;
• provide all required notices and obtain any required consents or authorizations;
• have a lawful basis for processing and for instructing LegalsOne;
• ensure its instructions are lawful and proportionate;
• limit Customer Personal Data to what is necessary for the intended purpose;
• configure access, permissions, retention, integrations, and optional features appropriately;
• respond to Data Subjects and regulators as required; and
• maintain reasonable security for Customer-controlled accounts, devices, networks, and systems.

Customer is responsible for determining whether the Services are appropriate for its processing and for completing any legally required risk or impact assessment.

4. LegalsOne Obligations

4.1 Compliance

LegalsOne will comply with obligations applicable to processors, service providers, and contractors under Applicable Data Protection Law.

4.2 Confidentiality

LegalsOne will ensure that personnel authorized to process Customer Personal Data:

• are subject to confidentiality obligations;
• receive access only as needed for their duties; and
• receive appropriate privacy and security guidance.

4.3 Purpose Limitation

LegalsOne will not:

• sell Customer Personal Data;
• share Customer Personal Data for cross-context behavioral advertising;
• retain, use, or disclose Customer Personal Data outside the direct business relationship with Customer except as permitted by law;
• combine Customer Personal Data with personal information received from another person or collected from LegalsOne's own interactions, except as permitted by law and necessary to provide the Services; or
• use Customer Personal Data for advertising profiles.

LegalsOne will process Customer Personal Data only for the limited and specified purposes described in the Agreement.

4.4 Compliance Notice

LegalsOne will notify Customer if LegalsOne determines that it can no longer meet an applicable obligation under this DPA. Customer may take reasonable and appropriate steps to stop and remediate unauthorized processing.

5. Security

5.1 Safeguards

LegalsOne will maintain reasonable and appropriate administrative, organizational, and technical safeguards designed to protect Customer Personal Data against unauthorized or unlawful processing and against accidental loss, destruction, alteration, or disclosure.

The safeguards will take into account:

• the nature and sensitivity of Customer Personal Data;
• the risks presented by the processing;
• the state of the art;
• implementation costs; and
• the scope, context, and purposes of processing.

5.2 Security Program

LegalsOne's security program includes measures appropriate to the Services relating to:

• access governance and least privilege;
• authentication and account protection;
• tenant and matter-level access separation;
• logging and auditability;
• secure development and change management;
• protection of data during transmission and storage;
• backup, recovery, and service continuity;
• vulnerability, threat, and security-event management;
• incident response;
• personnel confidentiality and security awareness;
• service-provider review; and
• secure deletion or isolation at the end of applicable retention periods.

The client-facing Trust and Security Center provides additional high-level information. LegalsOne may update safeguards over time, provided the overall level of protection is not materially reduced.

5.3 Shared Responsibility

Customer acknowledges that security also depends on Customer's configuration and use of the Services. Customer will use available authentication controls, maintain appropriate permissions, protect credentials and endpoints, review access, and promptly report suspected misuse.

6. Security Incidents

6.1 Notice

LegalsOne will notify Customer without undue delay after confirming a Security Incident affecting Customer Personal Data.

Notice will be delivered to Customer's designated security, privacy, or administrative contact. Customer is responsible for keeping those contacts current.

6.2 Information

To the extent known and legally permitted, LegalsOne will provide:

• a description of the nature of the Security Incident;
• the categories of affected data and individuals;
• known or reasonably estimated scope;
• likely consequences;
• measures taken or planned to contain, investigate, and remediate the incident; and
• a contact for follow-up.

Information may be provided in phases as the investigation progresses.

6.3 Cooperation

LegalsOne will take reasonable steps to contain, investigate, mitigate, and remediate a Security Incident and will reasonably assist Customer with legally required notices and assessments.

Notification is not an admission of fault or liability. Customer is responsible for determining whether notice to a regulator, Data Subject, client, insurer, or other person is required.

7. Subprocessors

7.1 General Authorization

Customer provides general written authorization for LegalsOne to engage Subprocessors as necessary to provide the Services, subject to this Section.

7.2 Subprocessor Obligations

LegalsOne will:

• conduct reasonable review before engaging a Subprocessor;
• enter a written agreement requiring data-protection and security obligations appropriate to the processing;
• limit Subprocessor access to what is necessary;
• remain responsible for the Subprocessor's performance of obligations delegated by LegalsOne; and
• maintain a client-facing list of Subprocessor categories and processing purposes.

The client-facing materials will describe Subprocessors by service category and purpose and will not publicly disclose confidential implementation information.

7.3 Changes

LegalsOne will provide reasonable advance notice of a material new Subprocessor category through the Trust Center, customer notice channel, or another agreed method.

Customer may object on reasonable data-protection grounds by providing written notice within 30 days after notice. The parties will work in good faith to resolve the objection. If no reasonable resolution is available, either party may terminate the affected Services, and LegalsOne will refund prepaid fees for the unused portion of the terminated term.

8. Data Subject Requests

Taking into account the nature of the processing, LegalsOne will provide reasonable assistance to Customer in responding to verified requests to exercise privacy rights.

If LegalsOne receives a request relating to Customer Personal Data:

• LegalsOne will not independently respond except to confirm that the request relates to a Customer or as required by law;
• LegalsOne will direct the individual to Customer when reasonably possible; and
• LegalsOne will notify Customer unless prohibited by law.

Customer is responsible for verifying the requester, determining whether a right applies, and providing the substantive response.

9. Assistance and Compliance Information

9.1 Assessments and Consultations

Taking into account the nature of processing and information available to LegalsOne, LegalsOne will reasonably assist Customer with:

• privacy and security impact assessments;
• consultation with regulators;
• records of processing;
• breach assessments; and
• other processor-assistance obligations under Applicable Data Protection Law.

Additional assistance beyond standard documentation or product functionality may be subject to reasonable fees.

9.2 Information

LegalsOne will make available information reasonably necessary to demonstrate compliance with this DPA, which may include:

• this DPA;
• Trust and Security Center materials;
• security and privacy questionnaires;
• summaries of relevant policies and controls; and
• available independent reports or assessments, if any.

LegalsOne will not be required to disclose information that would compromise security, confidentiality, privilege, another customer's information, or legal obligations.

10. Reviews and Audits

10.1 Review Process

Customer may review LegalsOne's compliance with this DPA no more than once in a 12-month period, unless:

• required by a regulator;
• following a Security Incident affecting Customer Personal Data; or
• Customer has reasonable evidence of material non-compliance.

The parties will first use current questionnaires, summaries, and available independent materials.

10.2 Audit Conditions

If those materials are insufficient and Applicable Data Protection Law requires further review, Customer may conduct a narrowly scoped audit through a qualified independent auditor that:

• provides reasonable advance notice;
• occurs during normal business hours;
• avoids unreasonable disruption;
• follows LegalsOne's security and confidentiality requirements;
• does not access another customer's information; and
• provides LegalsOne a copy of the resulting report.

Customer bears audit costs unless the audit identifies material non-compliance by LegalsOne. The parties will agree on scope, timing, and safeguards before the audit.

11. Government and Legal Requests

If LegalsOne receives a legally binding request for Customer Personal Data, LegalsOne will, when legally permitted:

• notify Customer before disclosure;
• direct the requester to Customer when appropriate;
• disclose only information legally required; and
• take reasonable steps to seek confidential or protective treatment.

LegalsOne will not voluntarily provide bulk or indiscriminate access to Customer Personal Data.

12. International Transfers

12.1 Transfer Safeguards

When Customer Personal Data is transferred across national borders and Applicable Data Protection Law requires a transfer mechanism, the parties will use a recognized mechanism, which may include:

• an adequacy decision;
• approved standard contractual clauses;
• a legally recognized certification or framework; or
• another lawful safeguard.

12.2 Standard Contractual Clauses

If approved standard contractual clauses are required and not otherwise executed, the then-current clauses applicable to the parties' roles are incorporated by reference and completed using the information in the Agreement and Annexes to this DPA.

If the clauses conflict with this DPA, the clauses control for the transfer. LegalsOne will provide reasonable information needed for a transfer assessment.

12.3 Government Access

LegalsOne will use reasonable safeguards designed to protect Customer Personal Data from disproportionate government access and will challenge a request when there are reasonable grounds to do so.

13. Return and Deletion

13.1 During the Term

Customer may access, export, correct, or delete Customer Personal Data using available functionality, subject to permissions, legal holds, and record integrity.

13.2 After Termination

Following termination, LegalsOne will make Customer Personal Data available for return or export during the period stated in the Agreement. If no period is stated, Customer may request a reasonable export for 30 days after termination.

After the return period, LegalsOne will delete or de-identify Customer Personal Data within a commercially reasonable period unless retention is required by law. Backup copies will be overwritten according to the regular backup lifecycle and will remain protected and unavailable for ordinary business use until overwritten.

13.3 Legal Retention

If law requires continued retention, LegalsOne will:

• retain only the information required;
• protect it under this DPA;
• process it only for the legally required purpose; and
• delete it when the legal requirement ends.

14. Sensitive and Regulated Information

The Services may process sensitive information when Customer has a lawful professional need and appropriate authority. Customer is responsible for identifying additional legal or contractual requirements.

Customer will not use the Services to process information subject to a specialized regulatory regime that requires a separate written agreement unless the parties have entered the required agreement. Examples may include protected health information requiring a business associate agreement, regulated payment credentials, criminal-justice information, or government-classified information.

This DPA is not a business associate agreement and does not independently authorize processing under such a regime.

15. Liability and Term

15.1 Liability

Each party's liability under this DPA is subject to the exclusions and limitations in the Agreement, except to the extent Applicable Data Protection Law prohibits limitation.

15.2 Term

This DPA begins when LegalsOne first processes Customer Personal Data and continues until LegalsOne no longer processes Customer Personal Data, subject to provisions that by their nature survive.

15.3 Conflict

For matters involving processing of Customer Personal Data, this DPA controls over conflicting provisions of the Agreement. Jurisdiction-specific mandatory terms or approved transfer clauses control over conflicting provisions of this DPA.

16. Contact and Notices

Privacy and DPA notices must be sent through the privacy, legal, or notice contact identified in the Order Form or applicable customer support channel.

Annex I - Processing Description

A. Subject Matter

Provision, security, support, maintenance, and improvement of the LegalsOne Services purchased by Customer.

B. Duration

The subscription term and the agreed return, deletion, backup, and legally required retention periods.

C. Nature and Purpose

Processing necessary to provide Customer-directed legal-operations functions, which may include:

• user and access administration;
• client and prospect intake;
• contact and matter management;
• tasks, calendars, workflows, and communications;
• document preparation, storage, sharing, and questionnaires;
• billing, payment-status, time, expense, and financial operations;
• training and personnel administration;
• reporting, audit, support, security, and service continuity;
• Customer-enabled integrations; and
• Customer-enabled automation or artificial-intelligence assistance.

D. Categories of Data Subjects

• Customer personnel, applicants, contractors, and former personnel;
• Customer clients and prospective clients;
• contacts, family members, witnesses, experts, providers, referral sources, opposing parties, and other matter participants;
• payors, recipients of invoices, and portal users;
• business contacts and service users; and
• other individuals whose information Customer submits.

E. Categories of Personal Data

• identifiers and contact information;
• account, authentication, role, permission, and activity information;
• professional, employment, and education information;
• legal matter, intake, conflict, and case information;
• communications, recordings, transcripts, and metadata;
• documents, signatures, questionnaire responses, and uploads;
• calendar, task, deadline, location, and work-activity information;
• billing, time, expense, transaction, account, and trust-related information;
• device, network, diagnostic, security, and usage information;
• marketing source, referral, and engagement information; and
• other Customer-selected data.

F. Sensitive Personal Data

Depending on Customer's use, Customer Personal Data may include:

• government identifiers;
• financial-account and transaction information;
• health and medical information;
• biometric or voice information;
• precise location information;
• racial or ethnic origin, religious beliefs, sexual orientation, or other protected characteristics;
• information about children;
• criminal allegations, offenses, or proceedings;
• attorney-client privileged, work-product, or confidential legal information; and
• account credentials or authentication information.

Customer must use appropriate legal authority, notices, permissions, and safeguards for sensitive data.

G. Processing Frequency

Continuous or as initiated by Customer and Authorized Users during the term.

H. Retention

As described in the Agreement, Customer configuration, and Section 13 of this DPA. Certain optional activity metadata may have a shorter review period, while converted business and audit records may follow the related record's retention.

Annex II - Security Measures

LegalsOne maintains a risk-based security program appropriate to the Services and Customer Personal Data. Measures include, as applicable:

• identity and access management;
• strong authentication options;
• role- and permission-based access;
• separation of customer environments and records;
• confidentiality obligations and personnel security awareness;
• protection of data during transmission and storage;
• secure development, review, and controlled change processes;
• monitoring, logging, and audit support;
• backup, recovery, continuity, and restoration processes;
• vulnerability and incident management;
• restrictions for public portals and shared links;
• service-provider diligence and contractual safeguards; and
• secure return, deletion, or isolation of data.

Specific security configuration may vary by service, deployment, Customer selection, and risk. Client-facing Trust and Security Center materials describe the current program at a high level without exposing sensitive implementation details.

Annex III - Subprocessor Categories

LegalsOne may use the following categories of Subprocessors when needed to provide Customer-selected Services:

• cloud hosting and computing;
• data storage, backup, and recovery;
• identity, authentication, and access services;
• email, messaging, telephone, and meeting communications;
• document generation, conversion, signature, and sharing;
• payment enablement and transaction-status services;
• mapping, address, and translation services;
• customer support and service communications;
• monitoring, diagnostics, and security operations;
• artificial-intelligence processing selected by Customer; and
• professional advisers and implementation support.

Not every category applies to every Customer. LegalsOne will provide contractual notice of material category changes as described in Section 7.

This Acceptable Use Policy ("AUP") governs use of the LegalsOne Services. It applies to Customers, Authorized Users, portal users, and anyone who accesses or uses the Services. Capitalized terms not defined here have the meanings given in the LegalsOne Terms of Service.

Use of the Services must be lawful, professional, secure, and consistent with the rights of others.

1. Authorized and Lawful Use

You may use the Services only:

• for purposes authorized by the Customer responsible for the account;
• within licensed and contractual limits;
• in compliance with applicable law, professional obligations, and court or agency rules;
• with appropriate authority to process the information involved; and
• in accordance with the Agreement and Customer policies.

You may not use the Services to facilitate, promote, or conceal unlawful conduct.

2. Account and Access Rules

You must not:

• share an individual account or authentication credential;
• access another person's account without authorization;
• misrepresent your identity, authority, organization, or relationship to a matter;
• bypass authentication, permissions, approval workflows, or account restrictions;
• retain access after your authorization ends;
• allow an unauthorized person to use your account; or
• use automated methods to create accounts or credentials without written permission.

You must protect credentials, devices, and access methods and promptly report suspected compromise.

3. Privacy, Confidentiality, and Legal Data

You must not:

• submit personal information without a lawful professional purpose and appropriate authority;
• disclose privileged, confidential, sealed, protected, or restricted information to an unauthorized person;
• use a public link, portal, communication, or shared record for information that should remain internal;
• collect or use personal information in violation of a notice, consent, court order, professional duty, or applicable law;
• attempt to identify individuals from de-identified information; or
• upload information subject to a specialized legal regime requiring a separate agreement unless that agreement is in place.

Customers are responsible for configuring access and for determining whether consent or notice is required for recordings, transcripts, monitoring, location or activity data, communications, electronic signatures, or automated processing.

4. Communications

You must not use the Services to:

• send spam or unsolicited bulk communications;
• send messages that violate consent, opt-out, telemarketing, or marketing laws;
• impersonate another person or organization;
• send deceptive, fraudulent, threatening, harassing, hateful, or abusive content;
• obscure the origin or purpose of a communication;
• continue messaging a person who has validly opted out, except where law permits a necessary transactional message; or
• distribute malware, phishing content, or harmful links.

Customer must maintain appropriate recipient lists, suppression records, consent evidence, and message content.

5. Security and Service Integrity

You must not:

• probe, scan, or test the vulnerability of the Services without written authorization;
• defeat or interfere with security, rate limits, monitoring, or access controls;
• introduce malware, ransomware, destructive code, or corrupted data;
• access or attempt to access another Customer's information;
• intercept data or credentials;
• use the Services to attack, disrupt, or gain unauthorized access to another system;
• overload, flood, or unreasonably burden the Services;
• exploit an error or vulnerability rather than reporting it; or
• publish vulnerability details before LegalsOne has had a reasonable opportunity to investigate and remediate them.

Good-faith security concerns should be reported through the security contact identified in the LegalsOne Security Center or customer support channel.

6. Content and Intellectual Property

You must not submit, generate, distribute, or store content that:

• infringes intellectual-property, privacy, publicity, confidentiality, or contractual rights;
• is unlawful, defamatory, fraudulent, or intentionally deceptive;
• promotes violence, exploitation, or unlawful discrimination;
• contains sexual exploitation material;
• is intended to harass, intimidate, or cause unlawful harm; or
• you do not have the right to use.

LegalsOne may preserve or disclose content when legally required but does not assume responsibility for reviewing all Customer Data.

7. Artificial Intelligence and Automation

You must not use artificial-intelligence or automation features:

• as a substitute for required professional judgment;
• to provide legal advice without qualified human review;
• to fabricate citations, evidence, facts, communications, or records;
• to make a legal or similarly significant decision about an individual without appropriate authority, notice, safeguards, and meaningful human review;
• to profile or discriminate unlawfully;
• to generate deceptive impersonations or misleading content;
• to process information beyond the authority granted by the Customer; or
• to bypass workflow approvals or recordkeeping requirements.

Users must review outputs for accuracy, completeness, privilege, confidentiality, bias, and suitability before relying on or sharing them.

8. Billing, Payments, and Trust Information

You must not:

• create or alter a payment, invoice, trust, time, expense, or accounting record without authorization;
• use public payment links or portals deceptively;
• misstate payment status or financial information;
• circumvent required review, reconciliation, or approval;
• use the Services to process unlawful transactions; or
• treat an automated calculation or status as a substitute for required legal, accounting, or professional review.

Customer remains responsible for financial controls, reconciliations, client funds, and compliance with professional and jurisdictional requirements.

9. Data Collection, Scraping, and Competitive Use

You must not:

• scrape, crawl, harvest, or bulk extract information except through authorized export or interface functions;
• use bots or automated agents that materially burden the Services without permission;
• build an unauthorized database from Service content;
• use the Services or documentation to create or train a competing product;
• publish performance or security test results without written permission; or
• circumvent usage, storage, user, or module limits.

10. Public Portals and Shared Links

Portal links, questionnaire links, payment links, document links, and similar access methods may be used only for their intended recipient and purpose.

You must not:

• guess, enumerate, collect, or redistribute access links or codes;
• access a portal or document not intended for you;
• remove or bypass a required access code;
• upload malicious or unrelated files;
• disclose link contents to an unauthorized person; or
• continue using a revoked or expired link.

Recipients should report a misdirected or suspicious link to the issuing organization.

11. Monitoring and Enforcement

LegalsOne may investigate suspected violations using information reasonably necessary to protect the Services, Customers, and others.

If LegalsOne reasonably believes a violation has occurred, it may:

• request corrective action;
• remove or restrict affected content or functionality;
• rate-limit or block activity;
• suspend an account, integration, portal link, or affected Service;
• preserve information as required by law;
• notify the Customer administrator; or
• terminate access as permitted by the Agreement.

When practicable, LegalsOne will limit enforcement to the affected user, content, or function and provide notice and an opportunity to cure.

12. Reporting Concerns

Report suspected abuse, unlawful content, unauthorized access, or security concerns through the LegalsOne support or security contact identified on the applicable website, Order Form, or customer support channel.

Include enough information to permit a responsible investigation, but do not send passwords, access codes, or unnecessary sensitive information.

13. Changes

LegalsOne may update this AUP to address changes in law, risk, or the Services. Material changes will be communicated as described in the Agreement.

This Cookie Policy explains how LegalsOne uses cookies and similar browser-storage technologies in LegalsOne websites, hosted services, applications, and client-facing portals (collectively, the "Services").

This policy should be read with the LegalsOne Privacy Policy.

1. What Cookies and Similar Technologies Are

Cookies are small text files placed on a browser or device. They can help a service recognize a browser, maintain a secure session, remember a preference, or support requested functionality.

Similar technologies include local storage and session storage. They allow a browser to remember information either until the browser session ends or until the information is cleared.

In this policy, "cookies" includes these similar technologies unless a distinction is necessary.

2. How LegalsOne Uses Cookies

LegalsOne uses cookies for:

• authentication and secure session management;
• fraud, abuse, and security prevention;
• public portal and form functionality;
• maintaining user-interface and accessibility preferences;
• remembering search, calendar, communication, task, and display choices;
• preserving in-progress work within a browser session; and
• operating features requested by the user.

LegalsOne does not currently use advertising cookies in the Services and does not use cookies to build cross-context behavioral advertising profiles.

3. Cookie Categories

3.1 Strictly Necessary Cookies

These cookies are needed to provide a service requested by the user or to secure the Services. They may:

• keep a user signed in;
• protect forms and state-changing actions;
• maintain a public portal session;
• complete an authentication or account-security flow;
• prevent abuse or repeated unauthorized attempts; or
• route a user to the correct service.

Because these cookies are necessary for requested functionality and security, the Services may not work correctly if they are blocked.

3.2 Functional and Preference Cookies

These cookies remember choices such as:

• search scope and result types;
• calendar view and selected calendars;
• task filters and workflow views;
• communication filters;
• collapsed or expanded sections;
• sidebar and display preferences;
• theme or appearance; and
• recently selected workspace settings.

These cookies improve convenience but are not used for advertising.

3.3 Analytics Cookies

LegalsOne does not currently use optional third-party analytics cookies in the authenticated Services. If optional analytics are introduced, LegalsOne will update this policy and obtain consent where required before setting them.

3.4 Advertising Cookies

LegalsOne does not use advertising cookies in the Services.

4. Typical Retention Periods

Retention varies by service, configuration, and the purpose of the cookie or browser-storage technology. Session technologies generally expire when the session ends, while preferences may remain until they expire or the user clears browser data. A Customer may also configure or update certain Service behavior.

5. First-Party and Customer-Directed Technologies

Most cookies used directly by the Services are first-party, meaning they are set by the LegalsOne service the user is visiting.

A Customer may enable a connection or embedded function that is subject to separate terms or privacy practices. LegalsOne does not publicly identify individual providers in this policy. Customers should review the settings and notices applicable to the functions they enable.

6. Your Choices

6.1 Browser Controls

Most browsers allow users to:

• view stored cookies;
• delete cookies and browser storage;
• block all or selected cookies;
• clear information when the browser closes; and
• restrict cross-site storage.

Blocking strictly necessary cookies may prevent sign-in, public portal access, secure form submission, or other requested functions.

6.2 Preference Controls

Some preferences can be changed within the Services. Clearing cookies or browser storage will reset stored preferences.

6.3 Optional Cookies

If LegalsOne introduces cookies that require consent, users will be given a choice before those cookies are placed. Refusing optional cookies will not block strictly necessary Service functionality.

7. Do Not Track and Global Privacy Signals

Because the Services do not use advertising cookies or sell or share personal information for cross-context behavioral advertising, browser "Do Not Track" settings do not change current Service behavior.

Where a legally recognized privacy signal applies to a future optional use, LegalsOne will process it as required by law.

8. Customer Responsibilities

Customers may use the Services to send links, operate portals, or direct individuals to Customer-managed pages. Customers are responsible for:

• providing notices required for their own websites and communications;
• obtaining consent for Customer-selected technologies when required;
• configuring optional functions lawfully; and
• responding to questions about Customer-controlled processing.

9. Changes to this Cookie Policy

LegalsOne may update this Cookie Policy when cookie practices, the Services, or applicable law changes. The effective date at the top indicates when the policy was last updated.

10. Contact

Questions about this Cookie Policy may be submitted through the privacy or support contact identified on the applicable LegalsOne website, Order Form, or customer support channel.