Last Updated: August 25, 2025
Owner: Legal & Security, Iqidis, Inc.
Contact: security@iqidis.ai
Iqidis, Inc. (“Iqidis,” “we,” “us,” or “our”) is committed to protecting your privacy and safeguarding your information. This Privacy & Data Policy explains how we collect, use, disclose, secure, and retain information when you use our legal AI services, our website at https://iqidis.ai, and any related applications or services (collectively, the “Services”). By accessing or using the Services, you agree to the practices described here. If you do not agree, please discontinue use of the Services. This Policy complements and should be read together with our Terms of Service, Acceptable Use Policy, and Service Providers & Subprocessors Policy.
This Policy applies to (i) enterprise customers and their authorized users, (ii) visitors to our website and marketing properties, and (iii) prospective customers who engage with us through demos, events, or forms.
We may receive limited information from (i) security/fraud prevention partners, (ii) marketing/event platforms, and (iii) analytics vendors, consistent with this Policy.
We may use public legal sources (e.g., court rulings, filings) to develop and improve our platform, in compliance with applicable law, without processing data restricted by confidentiality or contract.
By default, requests are handled in‑house by Iqidis within Iqidis‑controlled infrastructure using our KG/RAG and orchestration layers. Customer Content is stored and processed within your organization’s dedicated Iqidis tenant and per‑user profile containers—not pooled or commingled with other customers or matters. We do not use Customer Content to train models.
For certain discrete aspects of a query (e.g., language polish, format transformation, translation, or general‑knowledge reasoning), our orchestrator may invoke a subprocessor (e.g., OpenAI, Anthropic, Google) for inference only. We disable vendor caching/retention, apply data minimization (often redaction/abstraction and least‑necessary context), and contractually require no training on Customer Content. Many requests are satisfied entirely in‑house without any external call.
Third‑party model calls are stateless and ephemeral: prompts/outputs are not retained by vendors, and Customer Content is never used to train Iqidis or third‑party models. Internally, any temporary access for support/troubleshooting is purpose‑limited and deleted or anonymized consistent with Section 6 (Retention).
We process personal data under one or more of the following bases: contract performance, legitimate interests (e.g., service security and improvement), consent (where required), and legal obligations.
Authorized personnel may access Customer Content only to resolve technical issues, provide support, ensure operation, or enforce terms, consistent with strict access control and audit logging. Access is purpose‑limited and time‑bound.
We do not sell personal data. We may share data with:
8.1 Technical & Organizational Measures.
We maintain controls aligned with SOC 2 and ISO 27001 frameworks, including encryption in transit and at rest; least‑privilege access and SSO/IdP; network segmentation and WAF; vulnerability scanning and independent penetration testing; centralized logging and anomaly detection; and secure SDLC practices.
8.2 Data Security Incidents.
If Iqidis becomes aware of a confirmed unauthorized access to or disclosure of Customer Content processed by the Services (a “Data Security Incident”) that is caused by Iqidis’s breach of this Policy or our Security Measures, Iqidis will:
8.3 Exclusions.
“Data Security Incident” does not include: (i) unsuccessful or attempted attacks (e.g., pings, scans, DDoS); (ii) events impacting only anonymized/aggregated data or telemetry; (iii) incidents caused by Customer’s configurations, credentials, devices, or third‑party systems not controlled by Iqidis; or (iv) Customer’s breach of the Agreement or AUP.
8.4 Customer Responsibilities (Shared Responsibility).
Customer is responsible for (i) configuring security features (e.g., SSO, MFA, role‑based access), (ii) managing user access/permissions and credential hygiene, (iii) classifying and minimizing sensitive data uploaded to the Services, and (iv) promptly notifying Iqidis of suspected compromise of Customer accounts or credentials.
8.5 Subprocessor Incidents.
Iqidis requires subprocessors to provide equivalent incident notice and cooperation. Iqidis will coordinate the response and relay material updates to Customer where the subprocessor’s processing relates to the Services used by Customer.
8.6 No Public Statements.
Iqidis will not name or make public statements about Customer in connection with a Data Security Incident without Customer’s prior approval, unless required by law or regulator. This does not limit Iqidis’s obligation to provide timely notices to regulators/individuals where legally required.
8.7 Security Contacts.
Security questions and incident reports may be submitted to: security@iqidis.ai (or through Customer’s support channel). For sensitive disclosures, encryption instructions are available on request.
Note on costs/remedies. Iqidis will bear its own reasonable, documented costs to investigate and remediate a Data Security Incident caused by Iqidis. Any indemnification or broader cost allocation (e.g., data‑subject/regulator claims, credit monitoring) is governed by a separate DPA or enterprise agreement, as referenced in Section 9.
9.1 DPA (Controller–Processor Terms; Indemnity & Costs).
For controller–processor obligations under GDPR/UK GDPR/CCPA (including Standard Contractual Clauses/UK addendum for international transfers), privacy/security indemnification, and cost allocation relating to Data Security Incidents, see the Iqidis Data Processing Addendum (DPA) available upon request. If there is a conflict between this Policy and the DPA, the DPA controls for the subject matter of that conflict.
9.2 Subprocessors and Change Notice.
Current subprocessors and our 30‑day change‑notice/objection process are described in the Service Providers & Subprocessors Policy.
Depending on your jurisdiction, you may have rights to access, correct, delete, restrict/object to processing, portability, and to withdraw consent without affecting prior processing. You may also have the right to lodge a complaint with a supervisory authority. To exercise rights, contact info@iqidis.ai.
We do not use personal data to make decisions that have legal or similarly significant effects solely through automated processing.
Data may be processed in the U.S. and E.U. We use appropriate safeguards (e.g., Standard Contractual Clauses and UK addenda) for cross‑border transfers. Regional routing can be configured on request for applicable features, subject to technical feasibility.
We do not knowingly collect data from individuals under 18. If such data is identified, it will be promptly deleted.
Our Services do not currently respond to browser “Do Not Track” signals. Please use the controls available in our Cookie Policy to manage non‑essential cookies.
We may update this Policy to reflect legal, technical, or business developments. Material changes will be posted with a new effective date, and we will provide reasonable advance notice where appropriate.
Iqidis, Inc.
3 Columbus Circle, Floor 15
New York, NY 10019
Email: security@iqidis.ai
By using our Services, you acknowledge that you have read and understood this Privacy & Data Policy and agree to our collection, use, and disclosure of your personal information as described herein.