Ruli, Inc. (“Ruli,” “we,” “us,” and “our”) provides an AI-first legal operations platform with tools for legal research, document review, drafting, and related legal workflows.

This Platform Privacy Notice explains how Ruli collects, uses, discloses, and otherwise processes Personal Information when you use Ruli’s cloud-based legal operations platform and its related content, features, and services collectively, the “Services.” It also describes the privacy rights and choices available to you under applicable law.

For information about how Ruli handles Personal Information collected through its public marketing website, www.ruli.ai, please review the Website Privacy Notice available on the Site.

If you access the Services through an organization, the organization’s agreement with Ruli, including any enterprise agreement or data processing addendum, governs Ruli’s processing of enterprise workspace data on the organization’s behalf.

1. Services Covered

Ruli provides the following types of Services:

Enterprise Services: Platform access provided through your employer or another organization.

Consumer Services: An individual subscription purchased directly by you.

Enterprise Users

If you access Ruli through your employer or another organization, that organization generally determines how enterprise workspace content is submitted to and used through the Services. Ruli processes that content on the organization’s behalf under the applicable customer agreement.

Your organization’s policies govern its use of Personal Information and its administration of your enterprise workspace. Questions or requests concerning enterprise workspace content should ordinarily be directed to your organization.

Consumer Users

If you purchase the Services directly, Ruli processes your Personal Information as described in this Privacy Notice, subject to your rights under applicable law and the terms governing your subscription.

2. Definitions

  • “Consumer User” means an individual who purchases and uses the Services directly for the individual’s own purposes.

  • “Enterprise User” means an individual who accesses the Services through an employer or another organization.

  • “Google Workspace Data” means data Ruli obtains through Google Workspace APIs when you connect a Google account to the Platform, including raw data and data aggregated, de-identified, anonymized, or otherwise derived from it.

  • “Personal Information” means information about an identified or identifiable individual, as defined under applicable law.

  • “Third-Party Services” means applications or services not operated by Ruli that integrate or otherwise interact with the Platform.

3. Scope and Ruli’s Role

This Privacy Notice applies to Personal Information Ruli processes in connection with the Services, including Platform account administration, support, security, billing, and service communications.

For Consumer Services and Ruli’s account administration, security, billing, support, and business operations, Ruli generally determines the purposes and means of processing Personal Information.

When Ruli processes enterprise workspace content under an enterprise customer’s instructions, Ruli generally acts as a processor or service provider for the enterprise customer. The enterprise customer determines the purposes and means of processing that content.

Enterprise Workspace Data

Enterprise workspace data includes information uploaded, stored, generated, or analyzed in an enterprise workspace. Ruli processes that information in accordance with the enterprise customer’s instructions and applicable agreements.

Enterprise Users should ordinarily direct requests concerning enterprise workspace content to their organization. Ruli assists the organization with those requests as required by applicable law and the applicable customer agreement.

Third-Party Services

This Privacy Notice does not govern the privacy practices of Third-Party Services. If you enable an integration, the third-party provider’s privacy notice and account settings apply to the information processed by that provider.

This Privacy Notice applies to information Ruli receives through an integration after the information reaches the Platform. Section 5 controls over any conflicting provision of this Privacy Notice with respect to Google Workspace Data.

4. Personal Information We Collect

Information You Provide

Subscription and Account Information

Consumer Users may provide:

  • Name and email address

  • Account authentication information, such as a password stored in protected form

  • Billing information and payment information provided directly to Ruli’s payment processor

Enterprise Users and enterprise administrators may provide:

  • Name, business email address, job title, and organization name

  • Billing and transaction information, as applicable

  • Contact information for individuals authorized to use the Services

When you create or access an account, Ruli may also receive:

  • First and last name

  • Email address

  • Account authentication information for Consumer Users

  • Authentication tokens and associated profile attributes from an Enterprise User’s identity provider

  • Information you choose to add to your Platform profile

Platform Content

You may submit, generate, or process content through the Platform, including:

  • Legal memoranda and strategy documents

  • Playbooks and internal policies

  • Intake forms

  • Documents and attachments

  • Prompts and queries submitted to AI features

  • Drafts, summaries, redlines, and other generated content

  • Other information you choose to upload, create, or process

Platform content can contain Personal Information about you or other individuals. You and your organization are responsible for determining what content to submit to the Services and ensuring that the submission is authorized.

AI Training Practices

Consumer Users. By default, Ruli does not use Consumer User data to train its AI models. If a Consumer User affirmatively opts in through an available account setting, Ruli may use de-identified and aggregated data, excluding Google Workspace Data, to improve its AI models and Services. Ruli does not use identifiable content for this purpose. An updated preference applies prospectively.

Enterprise Users. By default, Ruli does not use enterprise workspace data to train its AI models. Ruli will use de-identified and aggregated enterprise workspace data for that purpose only if the enterprise customer expressly authorizes the use. Google Workspace Data is always excluded.

Ruli contractually prohibits third-party AI providers from using Platform data to train or improve their models.

Google Workspace Data. Ruli does not use Google Workspace Data, including data aggregated, de-identified, anonymized, or otherwise derived from it, to train or improve its AI models. Section 5 provides additional information about Ruli’s handling of Google Workspace Data.

Communications With Ruli

If you contact Ruli for support, guidance, or another request, Ruli may collect:

  • Your name

  • Your email address

  • Your phone number, if you provide it

  • The content of your communication

  • Information reasonably necessary to respond to your request

If your request requires Ruli personnel to access Google Workspace Data, the restrictions in Section 5 apply.

Surveys and Testing Programs

If you participate in a survey, alpha program, beta program, or similar initiative, Ruli may collect feedback and other information you choose to provide.

Information Collected Automatically

When you use the Services, Ruli automatically collects certain information, including:

  • Device information: Internet Protocol address, browser type, device type, and operating system

  • Usage information: Features and pages accessed, time spent, interaction history, and frequency of use

  • Approximate location: General location inferred from an Internet Protocol address

  • Referral information: Pages or services visited before or after using the Services

  • Performance information: Load times, errors, diagnostic information, and system activity

Cookies and Similar Technologies

Ruli uses cookies and similar technologies to:

  • Authenticate users and maintain sessions

  • Recognize returning users

  • Save preferences

  • Support Platform functionality

  • Understand Platform usage and performance

  • Detect and prevent fraud, unauthorized access, and misuse

You may control cookies through your browser settings and, where available, Ruli’s cookie preference tool. Disabling certain cookies can affect Platform functionality. Where required by applicable law, Ruli obtains consent before using nonessential cookies.

Information From Other Sources

Payment Processors

Complete payment-card information is generally provided directly to Ruli’s payment processor. Ruli receives transaction and billing information from the payment processor, such as:

  • Payment status

  • Transaction identifiers

  • Billing information

  • Limited payment-method details

Third-Party Services

When you connect Google Drive or another supported Third-Party Service, Ruli may receive your account identifiers and the information needed to provide the integration.

Section 5 governs Ruli’s access to and use of Google Workspace Data.

Your Organization

Ruli may receive your business contact information, account information, or authorization status from your organization or an enterprise administrator.

Combining Information

Ruli may combine information collected from different sources. If the combined information identifies you, Ruli treats it as Personal Information.

Ruli does not combine Google Workspace Data with other information except as necessary to provide the user-facing features described in Section 5.

5. Google Workspace API Data

This Section explains how Ruli accesses, uses, stores, and discloses Google Workspace Data. It applies whenever you or your enterprise administrator connects a Google account to the Platform.

The Google integration is optional, and the Platform functions without it. If this Section conflicts with another provision of this Privacy Notice, this Section controls with respect to Google Workspace Data.

Information Ruli Accesses

Ruli requests the OAuth scopes necessary to provide the integration features you enable. Ruli requests access when you initiate or enable the relevant feature.

How Ruli Uses Google Workspace Data

Ruli uses Google Workspace Data solely to provide the user-facing features for which access was granted. Depending on your instructions, this includes:

  • Retrieving documents you authorize for use with Ruli

  • Processing those documents in response to your instructions

  • Extracting, comparing, and analyzing document terms

  • Generating requested summaries, redlines, issue lists, and drafting outputs

  • Displaying requested results in the Platform

Ruli does not use Google Workspace Data for general product development, unrelated analytics, personalization, marketing, or another secondary purpose unrelated to the user-facing feature for which access was granted.

Artificial Intelligence and Machine Learning

Ruli uses automated processing, including large language models, to provide the features described above.

Ruli does not use Google Workspace Data, including raw data and information aggregated, de-identified, anonymized, or otherwise derived from it, to create, train, fine-tune, or improve any artificial intelligence or machine-learning model, including any foundation model. This restriction applies regardless of any AI training preference you or your organization enables elsewhere in the Platform.

When a third-party model provider processes Google Workspace Data to provide a requested feature, Ruli requires the provider by contract to:

  • Process the data only in accordance with Ruli’s instructions

  • Use the data only to provide the requested service

  • Refrain from using the data to train or improve any model

  • Retain the data only as long as necessary to provide the requested service

Ruli does not build or maintain indexes, embeddings, clause libraries, or other derived data stores from Google Workspace Data for purposes unrelated to the feature for which access was granted.

Disclosures and Transfers

Ruli does not sell Google Workspace Data. Ruli transfers Google Workspace Data to a third party only:

  • To service providers acting on Ruli’s behalf under written contract, solely to provide the user-facing features described in this Section;

  • When necessary to investigate suspected abuse, a security incident, or a technical issue;

  • When required to comply with applicable law or regulation, including valid legal process; or

  • In connection with a merger, acquisition, or sale of assets, after obtaining the affected user’s explicit prior consent.

Ruli does not transfer Google Workspace Data to data brokers or information resellers or use it to determine creditworthiness or for lending purposes.

Human Access

Ruli does not permit its personnel to read Google Workspace Data except when:

  • You provide documented, explicit authorization to access specific files or other data, such as when you request technical support;

  • Access is necessary to investigate suspected abuse, a security incident, or a technical issue; or

  • Access is required to comply with applicable law or regulation.

Authorization to access Google Workspace Data for one matter does not authorize access for another purpose.

Access under these exceptions is limited to authorized personnel, logged, and subject to review.

Storage and Security

Google Workspace Data is encrypted in transit and at rest. OAuth access and refresh tokens are encrypted at rest. Ruli restricts access through least-privilege controls and multi-factor authentication.

Ruli does not scrape Google services or build databases of Google Workspace Data for purposes unrelated to the user-facing features for which access was granted.

Retention and Deletion

Ruli retains Google Workspace Data only as long as necessary to:

  • Provide the feature for which access was granted;

  • Maintain content saved in the Platform at the user’s or customer’s direction;

  • Follow the applicable customer agreement and customer instructions; or

  • Satisfy applicable legal obligations.

Disconnecting the integration or revoking access prevents Ruli from obtaining additional information from your Google account. It does not automatically delete content previously imported into or saved in the Platform.

Previously imported content is deleted in accordance with applicable workspace retention settings, the applicable customer agreement, or a verified deletion request. Residual backup copies are deleted through Ruli’s standard backup lifecycle.

Your Controls

You may revoke Ruli’s access through your Google account at:

https://myaccount.google.com/permissions

Revocation prevents Ruli from obtaining additional Google Workspace Data through the revoked authorization.

You may request deletion of Google Workspace Data previously obtained by contacting legal@ruli.ai. Ruli responds within the period required by applicable law, subject to applicable exceptions and any instructions governing an enterprise workspace.

An enterprise administrator may manage integrations and workspace content subject to the organization’s configuration and agreement with Ruli.

Personnel and Successors

Ruli requires its employees, agents, contractors, and successors to comply with the Google API Services User Data Policy with respect to Google Workspace Data.

Limited Use Affirmation

Ruli’s use and transfer to any other application of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Google Workspace Data Questions

Contact Ruli at:

Email: legal@ruli.ai

Mail:

Ruli, Inc.

Attention: Legal Team

10900 Research Boulevard, Suite 160C, PMB 3176

Austin, TX 78759

United States

6. How We Use Personal Information

Ruli uses Personal Information to:

  • Provide the Services: Create and administer accounts, manage access, process transactions, provide requested features, and deliver support

  • Operate and improve the Services: Monitor performance, correct errors, maintain functionality, understand use of the Services, and develop features

  • Communicate with you: Respond to requests and send administrative, security, support, and service-related communications

  • Send product information: Send information about Ruli’s own Services where permitted by law and subject to applicable consent and opt-out requirements

  • Protect Ruli and the Services: Prevent fraud, unauthorized access, abuse, and security incidents

  • Comply with law: Meet legal obligations, respond to lawful requests, and maintain required records

  • Complete disclosed purposes: Carry out another purpose disclosed when Personal Information is collected, subject to applicable law

Google Workspace Data is excluded from these uses except as expressly permitted by Section 5.

Legal Bases for EU, EEA, and UK Processing

For individuals in the European Union, European Economic Area, and United Kingdom, Ruli relies on the following legal bases:

  • Performance of a contract: Processing necessary to provide requested Services, administer an account, process a subscription, or provide support

  • Legitimate interests: Securing, operating, analyzing, and improving the Services; preventing fraud and misuse; communicating with users; and administering Ruli’s business, where those interests are not overridden by individual rights

  • Consent: Optional processing where consent is required, including certain communications, nonessential cookies, and optional AI-improvement programs

  • Legal obligations: Maintaining required records, complying with applicable law, and responding to valid legal process

If you do not provide information required to establish or administer an account, Ruli may be unable to provide the requested Services.

Ruli does not use solely automated processing to make decisions about individuals that produce legal or similarly significant effects.

7. How We Disclose Personal Information

Ruli discloses Personal Information in the circumstances described below.

Vendors and Service Providers

Ruli discloses Personal Information to vendors and service providers that perform services on its behalf, including:

  • Cloud hosting and data storage

  • Security and fraud prevention

  • Analytics and performance monitoring

  • Payment processing

  • AI processing

  • Identity and access management

  • Customer support

  • Professional and business operations

These providers process Personal Information under contractual restrictions and only for authorized purposes.

Business Transactions

Ruli may disclose Personal Information in connection with a merger, acquisition, financing, reorganization, bankruptcy, sale of assets, or similar corporate transaction.

Any transfer of Google Workspace Data in connection with such a transaction is governed by Section 5.

Legal and Security Requirements

Ruli may disclose Personal Information when reasonably necessary to:

  • Comply with applicable law, regulation, subpoena, court order, or other valid legal process

  • Enforce Ruli’s agreements and policies

  • Protect the rights, safety, and security of Ruli, its users, or others

  • Detect, prevent, or investigate fraud, abuse, or security incidents

The additional restrictions in Section 5 apply to Google Workspace Data.

At Your Direction or With Your Consent

Ruli may disclose Personal Information when you direct Ruli to do so or provide consent.

Aggregated and De-Identified Information

Ruli may disclose aggregated or de-identified information that cannot reasonably identify an individual. Ruli maintains de-identified information in de-identified form and does not attempt to reidentify it except as permitted by applicable law.

Ruli does not disclose information aggregated or de-identified from Google Workspace Data.

8. Your Privacy Rights and Choices

Your rights depend on your location, the Services you use, Ruli’s role in processing the information, and applicable law.

Rights and Choices Available to Users

Subject to applicable law, you may have the right to:

  • Access Personal Information about you

  • Correct inaccurate Personal Information

  • Request deletion of eligible Personal Information

  • Obtain a portable copy of eligible Personal Information

  • Restrict or object to certain processing

  • Withdraw consent for consent-based processing

  • Opt out of promotional emails by using the unsubscribe link in the message

  • Manage available cookie preferences

  • Disconnect Third-Party Service integrations

  • Appeal Ruli’s denial of a privacy request where applicable

Consumer User Choices

Consumer Users may:

  • Request deletion of their account and eligible Personal Information

  • Request a portable copy of eligible Personal Information

  • Manage available preferences concerning the use of eligible data to improve Ruli’s AI models

Google Workspace Data is not used for AI training regardless of an AI training preference.

California Privacy Rights

Subject to applicable exceptions, California residents have the right to:

  • Know the categories and specific pieces of Personal Information Ruli has collected about them

  • Access their Personal Information

  • Request deletion of eligible Personal Information

  • Request correction of inaccurate Personal Information

  • Receive information about Ruli’s collection, use, and disclosure practices

  • Receive equal service and pricing when exercising privacy rights

Ruli has not sold or shared Personal Information, as those terms are defined under the California Consumer Privacy Act, during the preceding 12 months.

Ruli does not use or disclose Sensitive Personal Information to infer characteristics about individuals or for purposes that trigger a right to limit under the California Consumer Privacy Act.

California residents may use an authorized agent to submit a request. Ruli may require evidence that the agent is authorized to act on the resident’s behalf and may require the resident to verify their identity directly with Ruli.

Ruli will not discriminate against an individual for exercising a privacy right.

California Collection and Disclosure Information

The following table describes the categories of Personal Information Ruli has collected and disclosed for business purposes during the preceding 12 months.

Category

Examples

Sources

Purposes

Categories of Recipients

Retention Criteria

Identifiers

Name, email address, Internet Protocol address, account identifiers, and transaction identifiers

You, your organization, identity providers, payment processors, and automatic collection

Providing and securing the Services, account administration, support, and communications

Hosting, security, identity, support, and payment providers

Duration of the account or customer relationship and applicable record-retention, deletion, and backup periods

Customer records

Contact information, billing address, and limited payment-method information

You, your organization, and payment processors

Account administration, billing, support, and legal compliance

Payment, accounting, hosting, and support providers

Duration required for the customer relationship and applicable tax, accounting, transaction, and legal records

Commercial information

Subscription, transaction, and service-use information

You, your organization, and payment processors

Providing the Services, billing, account administration, and maintaining business records

Payment, accounting, hosting, and support providers

Duration required for account administration, transaction records, and legal compliance

Internet or electronic network activity

Device, browser, log, usage, referral, diagnostic, and interaction information

Automatic collection and service providers

Operating, securing, analyzing, and improving the Services

Hosting, security, and analytics providers

Duration reasonably necessary for operations, security, diagnostics, and legal compliance

Approximate geolocation

General location inferred from an Internet Protocol address

Automatic collection

Security, fraud prevention, and understanding use of the Services

Hosting, security, and analytics providers

Duration reasonably necessary for security, operations, and legal compliance

Professional or employment information

Job title, employer, team, and business contact information

You, your organization, and identity providers

Providing Enterprise Services, administering accounts, support, and business communications

Hosting, support, identity, security, and business-operations providers

Duration of the business relationship and applicable record-retention period

Sensitive Personal Information

Account login information and sensitive information included in content submitted by a user or organization

You or your organization

Authenticating users, securing accounts, and providing requested Services

Identity, hosting, security, AI-processing, and support providers, as applicable

Duration necessary to provide and secure the Services, subject to customer instructions and applicable deletion requirements

Enterprise workspace content can contain additional categories of Personal Information selected and submitted by an enterprise customer. Ruli processes that content on the enterprise customer’s behalf.

EU, EEA, and UK Privacy Rights

Subject to applicable law, individuals in the European Union, European Economic Area, and United Kingdom have the right to:

  • Access Personal Information

  • Correct inaccurate or incomplete Personal Information

  • Request erasure

  • Restrict processing

  • Receive eligible Personal Information in a portable format

  • Object to processing based on legitimate interests

  • Object to direct communications

  • Withdraw consent

  • Lodge a complaint with the competent supervisory authority

Withdrawal of consent does not affect processing lawfully conducted before withdrawal.

Information about applicable international-transfer safeguards is available by contacting legal@ruli.ai.

Exercising Your Rights

To exercise a privacy right, contact legal@ruli.ai or use the mailing address in Section 15.

Ruli may request information reasonably necessary to verify your identity and protect your information. If Ruli cannot verify your identity, Ruli may be unable to complete the request.

If your request concerns enterprise workspace content, Ruli may direct the request to the organization that controls the workspace or respond in accordance with that organization’s instructions.

Ruli responds to verified privacy requests within the period required by applicable law. Where permitted, Ruli may extend the response period and will notify you of the extension and the reason for it.

If applicable law provides a right to appeal Ruli’s decision, you may submit an appeal to legal@ruli.ai.

9. Children’s Privacy

The Consumer Services are not intended for individuals under 18, and individuals under 18 may not create Consumer accounts.

Ruli does not knowingly collect Personal Information through Consumer Services from individuals under 18. If Ruli learns that it collected such information, Ruli will take appropriate steps to delete it.

Enterprise Users under 18 must be authorized by their organization in accordance with applicable law and the organization’s agreement with Ruli.

10. Links and Third-Party Content

The Services may contain links to third-party websites, services, and applications that Ruli does not operate or control.

This Privacy Notice does not apply to those third parties’ privacy practices. Review the applicable third-party privacy notice before providing Personal Information to a third party.

11. International Data Transfers

Ruli is based in the United States. Personal Information is hosted in the United States and may be processed in countries where Ruli or its service providers operate.

For transfers subject to European Union, European Economic Area, or United Kingdom data-protection law, Ruli uses legally recognized transfer mechanisms, including the European Commission’s Standard Contractual Clauses and the UK International Data Transfer Addendum, as applicable.

You may request information about the safeguards applicable to a transfer by contacting legal@ruli.ai.

12. Data Retention

Ruli retains Personal Information only as long as reasonably necessary for the purposes described in this Privacy Notice, as required by law, or as necessary to resolve disputes, protect security, maintain business records, and enforce Ruli’s rights and agreements.

Ruli considers the following factors when determining retention periods:

  • The duration of the applicable customer or user relationship

  • The purposes for which the information was collected

  • Customer instructions and contractual requirements

  • The amount, nature, and sensitivity of the information

  • Security, fraud-prevention, and business-continuity needs

  • Applicable legal, tax, accounting, and regulatory obligations

  • Applicable limitation periods and dispute-resolution needs

Consumer Users

Ruli retains account information while an account remains active. Following account deletion or a verified deletion request, Ruli deletes or de-identifies eligible Personal Information through its standard deletion and backup lifecycle.

Ruli retains information when continued retention is required for legal compliance, transaction records, security, dispute resolution, or enforcement of Ruli’s agreements.

Enterprise Users

Retention of enterprise workspace content is governed by the applicable customer agreement and customer instructions, subject to legal obligations and Ruli’s standard backup and business-continuity processes.

Google Workspace Data

The retention and deletion practices in Section 5 apply to Google Workspace Data.

13. Security

Ruli maintains administrative, technical, and organizational safeguards designed to protect Personal Information. These measures include:

  • Encryption in transit and at rest

  • Least-privilege access controls

  • Multi-factor authentication

  • Confidentiality obligations

  • Personnel security measures

  • Employee security and privacy training

  • Risk assessments and security monitoring

  • Controls maintained under Ruli’s SOC 2 Type II framework

OAuth access and refresh tokens associated with Google integrations are encrypted at rest.

No security measure eliminates all risk. If you believe your account or information has been compromised, contact Ruli immediately at contact@ruli.ai.

14. Changes to This Privacy Notice

Ruli may update this Privacy Notice to reflect changes in its practices, Services, or legal obligations.

Where required by applicable law, Ruli will provide notice of a material change through the Site, Platform, email, or another appropriate channel before the change takes effect. Ruli will obtain consent where required before applying a material change to Personal Information previously collected.

For other changes, Ruli may post the updated Privacy Notice and revise the “Last Updated” date.

Changes take effect on the Effective Date stated in the updated Privacy Notice.

15. Contacting Ruli

For privacy questions, concerns, and requests, including requests concerning Google Workspace Data:

Privacy requests: legal@ruli.ai

Security incidents: contact@ruli.ai

General legal inquiries: legal@ruli.ai

Mail:

Ruli, Inc.

Attention: Legal Team

10900 Research Boulevard, Suite 160C, PMB 3176

Austin, TX 78759

United States

Previous versions of this Privacy Notice are available upon request at legal@ruli.ai.