Privacy

Your account. You sign in with an email address and a password. We store the address; the password is held by our authentication provider as a salted hash and is never visible to us. Access is by invitation.

What you type and upload. The facts you describe, the questions you ask, the matters you create and any documents you attach. Assume that anything you paste here is stored.

Usage records. A timestamped count of the analyses you run, so quotas can be enforced and abuse spotted. No advertising trackers, no third-party analytics, no cookies beyond the one that keeps you signed in.

How you use the app. We record a log of your use of the service: the screens you open and when, which actions you take (for example running a memo, exporting it, starting a dictation or a voice call), how long each took to show a result, your device type, screen size and connection type, and the thumbs-up or thumbs-down ratings you give to a section or an authority, with the reason you pick from a list. These records contain no text that you typed, dictated, said or uploaded, no matter titles, no party names and no filenames; they carry only counts, lengths, timings and fixed labels. They are tied to your account so we can find and fix a fault you report, and they are kept for 90 days, after which only anonymous totals remain. They stay in our own database in Mumbai; no third-party analytics service receives them. A random identifier for each browser tab is kept in that tab's session storage, not in a cookie. Part of this (the operational record of each analysis: its timing, cost and error) is needed to run, secure and bill the service and cannot be switched off. The rest (screens, actions and ratings) is optional: switch it off in Settings, Privacy and data and we stop recording it from your next page load. It is included in the copy of your data you can download.

In a Supabase Postgres database hosted on AWS in Mumbai (ap-south-1) — your data does not leave India at rest. Rows are scoped to your user id and enforced with row-level security, so one account cannot read another’s matters or documents.

To answer a question, the text of that question — and the passages retrieved for it — is sent to two processors. Anthropic drafts the analysis. OpenAI converts text into search vectors, transcribes voice calls and dictation, and acts as a backup for drafting and analysis when the primary is unavailable. Both are used under their commercial API terms, under which submitted content is not used to train their models. These calls leave India.

There are no zero-data-retention agreements yet. Not being used for training is not the same as not being kept: each of the two processors may retain what we send it for as long as its own standard commercial terms allow. We have not negotiated anything stricter. See “Client confidentiality” below for what that means in practice.

Operational providers. The application is hosted on Vercel (Mumbai region). Account and billing emails are sent through Resend. Sentry receives error reports; they carry the technical details of a failure and the signed-in account id, and are built to leave out the text of questions, matters and drafts and to mask email addresses. An uptime monitor checks that the service is reachable. There is no session recording or replay of what you do on screen.

Nothing is sold, and nothing is shared with anyone else — no advertisers, no data brokers, no other users.

CICERRO is a research aid in private testing, not a secure client file. Because there are no zero-data-retention agreements with the processors above, anything you send can be retained by them, outside India, under their standard terms. For privileged or sensitive matters, our advice today is to describe the legal question with names, identifiers and other identifying facts removed or changed, and not to upload unredacted client documents. Questions asked in the abstract lose nothing in the research. The decision, and the professional duty of confidence, stay with you.

Your matters and documents are kept until you delete them or ask us to close your account. Email privacy@cicerro.com from your registered address and we will delete your account and everything attached to it within 30 days, and confirm when it is done. You can ask for a copy of your data the same way.

Traffic is encrypted in transit, data is encrypted at rest, and every request is authenticated. Row-level security is switched on in the production database: the database itself, not only the application code, restricts each account to its own rows. Access to the production systems is limited to the people who run CICERRO.

Backups: the database is backed up daily and each backup is kept for 7 days. Point-in-time recovery is not switched on, so a restore would return us to the last daily backup and up to a day of recent work could be lost.

No system is perfect; if data is ever exposed we will tell affected users directly rather than quietly. This notice has not yet been reviewed by a lawyer.

If this policy changes materially, testers are emailed before it takes effect. Questions, complaints or deletion requests: privacy@cicerro.com. For anything else, support@cicerro.com.