This Privacy Policy explains how Supra Legal AI ("Supra," "we," "us," or "our"), a trade name of Baum Systems, available at supralegalai.com and app.supralegalai.com (collectively, the "Website" or the "Service"), a software-as-a-service provider of Bluebook citation generation and document cite-checking, collects, uses, stores, and protects your personal data and the documents you submit.
You may print this document using your browser's print function.
By accessing https://supralegalai.com, https://app.supralegalai.com, or any related domains, or by agreeing to our Terms of Service, you acknowledge and agree to be bound by this Privacy Policy, the Terms of Service, and any related agreements. If you do not agree, you must not access or use the Website or the Service.
Supra reserves the right to modify or update this Privacy Policy and/or the Terms of Service at its sole discretion. Changes will be posted on the Website. If we make material changes to how we process or share personal information or customer documents previously collected, we will notify you through the Website, the Service, email, or other communication methods, as required by law.
You have the right to receive notifications regarding significant updates to this Privacy Policy, in accordance with applicable legal requirements.
Last Updated: October 9, 2026
Data Controller:
Baum Systems DBA Supra Legal AI
8903 Glades Rd Ste A8 #2469
Boca Raton, FL 33434
Website: supralegalai.com
Privacy and legal requests: legal@supralegalai.com
Product support: support@supralegalai.com
Because our users are lawyers, law students, and law review editors who upload work product, the points that matter most are stated here first and in detail below:
We collect three categories of data:
Your data is collected, stored, used, and disclosed solely to provide or improve the Service. We may collect, store, process, share, or disclose your data for purposes including:
When you create an account, make a purchase, or contact us, we or our providers may collect personal information such as:
Ownership. You retain all right, title, and interest in Customer Content. You grant us only the limited license described in the Terms of Service to host, process, and display it for the purpose of providing the Service to you.
How it is processed. When you submit a document or a source, the Service extracts citation text, runs deterministic checks against our rules corpus, and sends citation text and relevant document text to our AI model provider (currently Anthropic, via its API) to generate and verify citations. Results are stored with the job so you can review them.
No training. We do not use Customer Content to train, fine-tune, or otherwise improve machine-learning models, and our AI model provider is contractually prohibited from doing so with the data we send it. Improvements to the citation engine are made with internal, non-customer test datasets. If we ever wish to use a customer's content for this purpose we will ask for explicit, separate consent first.
Human access. Our personnel may access Customer Content only when necessary to provide support you have requested, to investigate abuse or a security incident, or as required by law.
Confidentiality. We treat Customer Content as confidential. It is not shared with other customers, published, or used for marketing. Note that using an online service to process privileged or confidential material may have professional-responsibility implications in your jurisdiction; you are responsible for determining whether the Service is appropriate for a given document.
When you access the Website or the Service, we may automatically collect and store device-related information, such as:
We recommend reviewing your device's privacy policy to understand what data it may share.
Our servers and third-party providers automatically log information when you access the Website or the Service, including:
If an error occurs, we may automatically save logs to identify, troubleshoot, or document the issue. Log data alone does not identify you, but it may be combined with other data that could.
We collect operational data generated by your use of the Service, including account settings, citation jobs and their results, credit balances and the ledger of credit grants and deductions, transaction records, and support history.
We collect first-party analytics to ensure the quality of our product. We do not use third-party analytics or advertising trackers.
On the marketing site we record page views, clicks on calls to action, and how far down a page is scrolled. In the app, and on our servers when you use the Service, we record usage events such as pages viewed, sign-in, uploads, citation and document-check work, and finished jobs.
With those events we store the page path, a first-party visitor id kept in your browser, a session id, the referring site's host name, campaign parameters from the link you followed, a coarse device type, a short browser description, and a hash of your IP address. The hash is keyed with a secret that is different for each environment and includes the date. We do not store the raw IP address. A visit on the marketing site is not tied to an account until you continue into the app, which passes that visitor id along so the visit can be joined to the account.
You can turn product analytics off or on at any time on the Analytics choices page. That choice covers the marketing site and the app in the browser where you make it. The app has the same control under Settings.
Visitors in the European Union, the European Economic Area, the United Kingdom, and Switzerland are asked first. Until you accept, we store no analytics event and no visitor id. Declining is as easy as accepting, and you can change the choice at any time.
We estimate that region from your browser's time zone, on your device. The time zone is not sent to us. If we cannot tell, we ask.
Elsewhere, analytics run unless you opt out or your browser sends Do Not Track or Global Privacy Control.
If you opt out while signed in, we also stop the events our servers record for your account, such as account creation and finished citation jobs. Until you opt out, those server events are stored so we can operate the Service. They are not stored on your device.
If you deactivate your account, we keep recording analytics events for it until deactivation takes effect at the end of your paid billing period, and stop after that. Events already recorded are kept unless you ask us to erase your data.
Personal data is retained only for as long as necessary to fulfill the purpose for which it was collected. In certain cases data may be retained longer to comply with legal obligations (for example, accounting and tax requirements), to resolve disputes, or as required by an authority.
Customer Content and the results produced from it are retained so that you can revisit results and re-run failed jobs.
Deactivating your account keeps your data. When you deactivate your account in Settings, we cancel any subscription so it does not renew. Deactivation takes effect at the end of the billing period you have already paid for. Until then your account works as usual and you can keep using your credits. If no paid billing period remains, deactivation takes effect right away. Once it takes effect, you cannot use the Service until you sign in and reactivate. We keep your account, Customer Content, citation results, feedback, credit balance, usage records, and first-party analytics so they are there if you come back.
We erase your data only when you ask. To have your data permanently erased, choose "Also permanently erase my data" when you deactivate, or email legal@supralegalai.com from the email address on your account. We verify the request and erase within 30 days after deactivation takes effect: your account profile and sign-in identity, Customer Content and uploaded files, citation jobs and results, feedback reports, the contents of AI usage records (the prompts and model responses), and first-party analytics tied to the account, including marketing-site events that share the visitor id the account used. To have your data erased sooner, choose "Deactivate now" in Settings or contact us. Erased data is removed from active systems at that time and from backups as they cycle out on the backup rotation schedule. Erasure cannot be undone. Unused credits cannot be used after erasure. Keeping your account before deactivation takes effect, or reactivating before we erase, cancels the request.
After erasure we keep billing records (orders, payments, subscription history, and the credit ledger) where we need them for accounting, tax, or legal obligations, without your name on an active account profile. We also keep AI usage cost totals (model, token counts, dollar amount, and timestamps) linked to that internal account number, with the stored prompts and responses removed. We also keep a record that the erasure was carried out, with the date and an internal account number but not your name or email. Our payment processor, Lemon Squeezy, keeps its own records as merchant of record.
We safeguard your data using commercially reasonable technical and organizational measures designed to prevent unauthorized access, theft, disclosure, modification, or destruction, including encryption in transit, access controls, and hosting on infrastructure with independent security certifications. Your data may be accessible to personnel who operate the Service and to the external providers listed below, each bound by confidentiality obligations. You may request a current list of these parties at any time by emailing legal@supralegalai.com.
Your personal data and Customer Content may be shared with:
We do not sell personal data or Customer Content.
Data protection laws vary by country, and the laws governing our data processing may differ from those in your jurisdiction. We comply with applicable privacy regulations as outlined in this Privacy Policy.
You have the following rights:
To exercise these rights, email legal@supralegalai.com. We will respond within 30 days. You can also request erasure in Settings when you deactivate your account.
The Website may link to external websites or services we do not control. We are not responsible for their data-handling practices. We recommend reviewing their privacy policies before using their services.
This Privacy Policy is intended to satisfy Articles 13 and 14 of Regulation (EU) 2016/679 (General Data Protection Regulation). It applies to the Website and the Service unless otherwise stated.
Under GDPR, Supra, located at the address above, acts as a Data Controller for account and usage data and as a Data Processor for Customer Content you submit, depending on the data concerned.
We collect and process personal information only when permitted by law, in a fair and transparent manner. You must be at least 18 years of age (or the age of majority in your jurisdiction) to use the Service.
Our legal bases for processing include:
For product analytics, we rely on consent in the European Union, the European Economic Area, the United Kingdom, and Switzerland, and on legitimate interests elsewhere. You may opt out at any time.
The Service is hosted in the United States. We implement appropriate safeguards, such as standard contractual clauses with our providers, to ensure the secure transfer of personal information from the EEA to countries outside it, in compliance with applicable law.
You have the following GDPR-specific rights:
To exercise these rights, email legal@supralegalai.com. We will respond within 30 days. This section applies only to GDPR and may not extend to other jurisdictions' privacy laws.
If your browser sends a Do Not Track signal or Global Privacy Control, the marketing site and the app do not send the product-analytics events described under "Product Analytics". Our servers also drop events that arrive with either signal.
Events our servers record while providing the Service, such as account creation and finished citation jobs, are stored unless you opt out of product analytics while signed in. Opting out stops those events for your account. They are not stored on your device.
The Service uses cookies and similar technologies that are necessary for it to function: keeping you signed in, protecting against cross-site request forgery, and remembering settings. One of those necessary cookies, named supra_analytics_consent (supra_analytics_consent_dev on the development site), remembers whether you allowed or declined product analytics. It is set by us, lasts about six months, and is not used for advertising. The marketing site does not use advertising or cross-site tracking cookies. The visitor id described under "Product Analytics" is stored in your browser's local storage, not in a third-party cookie, and only after analytics are allowed. You may decline cookies via your browser settings, though the Service may not function without the necessary ones.
In the past 12 months, we have collected the following categories of personal information from California residents:
See "Types of Data Collected" for details on data sources. We do not sell personal information, and we do not offer financial incentives in exchange for personal information.
If you reside in California, under the California Consumer Privacy Act (CCPA) you may:
Email legal@supralegalai.com with questions about these rights. We will respond within 30 days. This section applies only to the CCPA and may not extend to other jurisdictions.
California residents may request details about how we share data with third parties for their direct-marketing purposes, as defined by California Civil Code § 1798.83. We do not share personal information with third parties for their direct-marketing purposes. To make a request, email legal@supralegalai.com with the subject "California Privacy Rights: Request for Privacy Information."
For questions about your data, privacy, or this Privacy Policy, email legal@supralegalai.com or write to us at the mailing address above. For help with your account or the Service, email support@supralegalai.com.