Welcome to Ruli! Ruli, Inc. (“Ruli,” “we,” “us,” and/or “our”) is an AI software company developing AI legal agents and products to advance legal operations.

This Platform Privacy Notice describes how Ruli handles Personal Information that we collect from and about you when you use our cloud-based legal ops platform (the “Platform”) and related content, features, and services (collectively, our “Services”). It also describes certain legal rights you may have, subject to applicable law, and how you can exercise them.

To understand how Ruli handles information collected from and about visitors to our marketing website, www.ruli.ai (the “Site”), please see our Website Privacy Notice.

Enterprise agreements may control certain processing. If you access the Services through an organization, your organization’s agreement with Ruli (such as an Enterprise Agreement and any data processing addendum) may govern how we process enterprise workspace data on the organization’s behalf.

1. Services Covered and Important Distinctions

We offer two types of services:

  • Enterprise Services: Platform access provided through your employer or organization.

  • Consumer Services: Individual self-serve subscriptions purchased directly by you.

Enterprise Users. If you access Ruli through your employer, your organization controls the data you create in the Platform. This Privacy Notice explains Ruli’s practices, but your employer’s policies also apply.

Consumer Users. If you purchased your own Ruli subscription, you control your data. You are both the customer and the end user, giving you full rights over your information.

2. Definitions

  • “Personal Information” means information about an identifiable person, as defined by applicable law.

  • “Third-Party Services” means applications or services not operated by Ruli that may integrate with our Platform.

3. Scope of This Notice

This Privacy Notice applies to information we collect and use for our own purposes, including information we collect from users when they register for or access the Services, and individuals in connection with our marketing activities.

Enterprise workspace data processed on customer instructions. When an enterprise customer uses the Platform, Ruli may process data (including Personal Information) uploaded, stored, or analyzed in that enterprise workspace. In those contexts, Ruli processes that data on behalf of the enterprise customer and in accordance with the customer’s instructions and applicable agreements.

Third-Party Services (integrations). This Privacy Notice does not apply to Third-Party Services. If you enable an integration (for example, email, calendar, or cloud storage), the provider’s privacy practices and settings apply to their services.

4. Information We Collect

A. Information You Give Us Directly

When you subscribe to our Services

Consumer Users may provide:

  • Name and email address

  • Password (encrypted; not stored in plain text)

  • Payment information via our third-party payment processor

  • Optional phone number for account recovery

Enterprise Users (or enterprise admins) may provide:

  • Name, business email address, job title, and organization name

  • Payment details provided to our payment processor (as applicable)

  • Contact details for individuals within the organization who will use the Services

When you create an account and populate your profile

To log into the Platform, we may collect:

  • Email address

  • First and last name

  • Password (consumer users) or SSO credentials (enterprise users)

Optional profile information may include: profile photo, job title/team designation, LinkedIn profile link, and phone number.

When you use our Platform (content you submit or generate)

Because of the nature of our Services, you may submit or generate a wide range of content in the Platform, such as: legal memoranda, playbooks, strategy documents, internal policies, intake forms, calendar/project info, email messages/attachments, prompts and queries submitted to AI features, and other content you create or upload.

Important data ownership and AI training distinctions:

  • Consumer Users: You own your data. By default, we do not use your data to train our AI models. If you opt in through your account settings, we may use only de-identified and aggregated data (and not your identifiable content) to improve our AI models and Services. You can opt out at any time; training already performed cannot be reversed.

  • Enterprise Users: Your organization controls the data in the enterprise workspace. By default, we do not use enterprise workspace data to train our AI models unless your organization expressly opts in (for example, through an admin setting) or your Enterprise Agreement expressly authorizes such use. If enabled, we use only de-identified and aggregated data. We never allow third-party AI providers to train on Platform data.

When you communicate with us

If you contact us for technical support or guidance, we may collect your name, email address, phone number, and the contents of your communication.

When you communicate with other Ruli users

If you use built-in messaging tools, we collect the contents of those communications. We use messaging content to resolve disputes between users, for safety and security purposes, to improve the Services, and for analytics.

Surveys; alpha/beta programs

If you participate in surveys or alpha/beta launches, we may collect demographic information, feedback, and other information relevant to that survey or launch.

B. Information We Collect Automatically

We automatically collect certain information as you use our Services, including:

  • Device information (IP address, browser type, operating system)

  • Usage information (pages accessed, time spent, frequency of visits)

  • Location information (general location inferred from IP address)

  • Referral information (pages visited before and after)

  • Performance data (load times, errors)

Cookies and similar technologies. We use cookies and similar technologies to recognize returning users, save preferences, understand platform usage, help the Platform work properly, and prevent fraud. You can control cookie preferences through your browser settings.

Do Not Track. Ruli does not currently change its behavior in response to “do not track” signals. If a universally accepted standard emerges, we will assess and provide an appropriate response.

C. Information We Collect From Other Sources

Payment processors. In general, when you pay for our Services, your payment information is provided directly to our payment processor. For consumer users, while the payment processor receives complete payment information, Ruli typically receives limited details such as transaction confirmations, partial card details (e.g., last 4 digits), and billing addresses.

Third-Party Services (integrations). When you connect services like Gmail or Google Drive, we may receive your username, email address, and information necessary for the integration. We use Google Workspace APIs only to provide and enhance our services. Data from those APIs is not used to develop or train generalized AI or machine learning models.

Another individual at your organization. We may receive your business contact information from another person at your organization in connection with providing Services to your organization.

Other sources. We may obtain Personal Information from business partners, publicly available sources (e.g., LinkedIn), and third parties that help us update, expand, and analyze our records and inform networking and marketing efforts.

Combining information. We may combine information we collect from different sources. If the combined information identifies you, we treat it as Personal Information.

5. How We Use Your Information

We use Personal Information to:

  • Provide our Services: manage access, send updates, and provide support

  • Operate and improve: monitor usage trends, fix bugs, and develop new features

  • Communicate with you: respond to requests and provide relevant information

  • Personalize content: tailor experiences and recommendations

  • Marketing (Consumer Users): notify you about offers and services (opt-out anytime)

  • Protect and secure: prevent fraud, unauthorized access, and misuse

  • Legal compliance: meet legal obligations and maintain records

  • Carry out any other purpose described to you at the time information is collected

6. How We Share Your Information

We may share Personal Information in the following circumstances:

  • Vendors and Service Providers: cloud hosting, analytics, and support providers

  • Advertising Partners (Consumer Users): for relevant ads and campaign measurement (you can opt out)

  • Business Transfers: in connection with mergers, acquisitions, reorganization, bankruptcy, or asset sales

  • Legal Requirements: to comply with legal obligations or protect rights and safety

  • With Your Consent / At Your Direction: when you explicitly consent or direct us to share

We may also share aggregate or de-identified information that cannot reasonably identify you.

7. Your Rights and Choices

Rights available to all users

  • Accessing your information: view your data through account settings or by contacting us

  • Updating your information: modify profile and preferences in account settings

  • Opting out of marketing: unsubscribe from promotional emails anytime

  • Cookie management: control cookies through browser settings

Additional rights for Consumer Users

  • Downloading your data: export content and data in portable formats

  • Deleting your account: permanently delete your account and data within 30 days

  • AI training preferences: control whether your data is used to improve AI models (default: OFF)

  • Restricting processing: request limits on how we use your information

Trial and free tier users

Your data is automatically deleted 60 days after your trial ends if you do not upgrade (unless you log in to extend retention).

State/region-specific privacy rights

California (CCPA/CPRA). California residents have rights to know, access, delete (subject to exceptions), correct, opt out of sale/sharing, and limit use of sensitive personal information. We do not “sell” Personal Information in the traditional sense. For consumer users, we may “share” information with advertising partners, and you can opt out through your account settings. You may also exercise this right via our cookie preference tool (where available) and any “Do Not Sell or Share My Personal Information” link we provide. If we detect a legally-recognized opt-out preference signal (such as Global Privacy Control) in jurisdictions where it applies, we will process it as required.

EU/EEA/UK (GDPR). EU/EEA/UK residents have rights including access, rectification, erasure, restriction, portability, objection, withdrawal of consent, and lodging a complaint with a supervisory authority.

How to exercise your rights

To exercise your rights, contact us at privacy@ruli.ai or via the address in the “Contacting Us” section below. We may need to verify your identity to protect your information.

Response time targets: (i) 10 business days for general questions; (ii) 45 days for formal rights requests (as required by applicable law); and (iii) 30 days for EU/EEA/UK requests (as required by GDPR).

8. Children’s Privacy

Our Services are not intended for children under 13, and we do not knowingly collect Personal Information from children under 13.

Ages 13–17. Consumer Users are permitted only with verifiable parental consent; a parent/guardian must create the account and consent to this Privacy Notice. Enterprise Users who access the Services through their employer and are under 18 must have parent/guardian consent according to their organization’s policies.

9. Links to Other Websites and Third-Party Content

We may link to third-party websites, services, and applications not operated or controlled by Ruli. This Privacy Notice does not apply to those third parties’ privacy practices. We encourage you to review third-party privacy policies before providing Personal Information to them.

10. Data Transfers

Ruli is based in the United States. Personal Information may be stored and processed in the U.S. or other countries where we have operations or engage service providers. For EU/EEA/UK users, we transfer data using approved mechanisms including Standard Contractual Clauses and maintain appropriate safeguards.

11. Data Retention

We retain Personal Information only as long as necessary for the purposes described in this Privacy Notice, as required by law, or as necessary to resolve disputes and enforce our rights and agreements.

Consumer Users. Active accounts are retained while the account is active. After deletion, most data is deleted within 30 days and backups within 90 days. Trial accounts are deleted 60 days after the trial ends if not upgraded. Subscription transaction records are retained for 7 years for tax purposes.

Enterprise Users. Retention of enterprise workspace content is governed by the applicable customer agreement and instructions, subject to legal obligations and operational needs (including backups and business continuity).

12. Security

Ruli uses commercially reasonable safeguards to protect Personal Information. Security measures include encryption in transit (TLS 1.2+) and at rest (AES-256), security assessments and penetration testing, secure authentication and access controls, automated monitoring, employee training, and secure data centers.

Despite our efforts, no security measures are perfect. If you believe your account is compromised, contact us immediately at contact@ruli.ai.

13. Changes to This Privacy Notice

We may update this Privacy Notice to reflect changes in our practices, services, or legal requirements.

Material changes. We may post prominent notice on our Site and Platform, email you if we have your email address, provide at least 30 days’ notice, and may require acknowledgment for continued use.

Minor changes. We may post the updated Privacy Notice, update the “Last Updated” date, and note changes in a changelog at ruli.ai/privacy-updates.

Your continued use of the Services after changes indicates acceptance of the updated Privacy Notice, to the extent permitted by law.

14. How to Opt Out of “Sharing” for Targeted Advertising (Consumer Users)

If you are a Consumer User and we “share” Personal Information with advertising partners for relevant ads and campaign measurement, you can opt out through your account settings.

15. Contacting Us

For privacy questions, concerns, or requests:

  • Email: legal@ruli.ai

  • Mail: Ruli, Inc., Attention: Legal Team, 10900 Research Boulevard, Suite 160C, PMB 3176, Austin, TX 78759

For EU/EEA/UK inquiries (Data Protection Officer): legal@ruli.ai.

Previous versions are available upon request at legal@ruli.ai.

16. Glossary

  • Consumer User: an individual who purchases and uses Ruli services for their own purposes.

  • Enterprise User: an individual who accesses Ruli services through their employer or organization.

  • Data Controller: entity that determines purposes and means of processing Personal Information.

  • Data Processor: entity that processes Personal Information on behalf of the data controller.

  • Third-Party Services: applications/services not operated by Ruli that may integrate with the Platform.