Justik Privacy Policy
Justik, Inc., a Delaware corporation with its registered address at 131 Continental Drive, Suite 305, Newark, Delaware, United States, together with its affiliates ("Justik", "we", "us"), provides an AI-assisted case-analysis platform for criminal defence practitioners (the "Service"). This Privacy Policy describes how we collect, use, disclose and protect personal data in connection with the Service and our website at justik.ai. It forms part of our Terms of Service.
We process personal data in accordance with the data-protection laws that apply to the processing concerned, including the Protection of Privacy Law, 5741-1981 (the "PPL"), the Protection of Privacy Regulations (Data Security), 5777-2017 (the "Data Security Regulations") and the Protection of Privacy Regulations (Transfer of Data Abroad), 5761-2001; Regulation (EU) 2016/679 (the "GDPR"); the GDPR as retained in the law of the United Kingdom and the Data Protection Act 2018 (the "UK GDPR"); the Swiss Federal Act on Data Protection; and, in Canada, the Personal Information Protection and Electronic Documents Act ("PIPEDA") and the substantially similar private-sector privacy laws of Alberta and British Columbia (the "Canadian Privacy Laws"). References in this Policy to the GDPR include the UK GDPR where it applies.
1. Two roles, two kinds of data
1.1 Data for which Justik is the controller ("Account Data"). Information about the people who use the Service: attorneys, firm staff, outside counsel and others who receive access to a Case, as well as visitors to our website and people who correspond with us. For this data Justik is the owner of the database under the PPL and decides how it is used.
1.2 Data for which Justik is a processor ("Case Data"). Everything a law firm uploads to or generates within a Case: indictments, investigation files, statements, recordings, images, transcripts, the analyses the Service produces, notes and assistant conversations. Case Data routinely contains sensitive information about third parties who have no relationship with Justik, such as defendants, complainants, witnesses and investigators. For Case Data the law firm is the owner of the database and controller; Justik processes it only on the firm's instructions, as set out in the Data Processing Terms (Schedule A of the Terms of Service). If you are a person whose data appears in a Case, the law firm handling that matter is responsible for it, and Section 9 explains how to exercise your rights.
2. Personal data we collect
2.1 Account Data
| Category | Data | Source |
|---|---|---|
| Identity and contact | name, professional e-mail address, telephone number, firm name, role, professional title | you; your firm's administrator |
| Authentication | sign-in identifier, hashed credentials or federated identity token, session identifiers, and, if you enable two-step sign-in, the telephone number or authenticator enrolment used as a second factor | you; Google Firebase Authentication / Identity Platform |
| Billing | quotes, orders, invoices, payment status, payment-token reference and last four card digits | you; Stripe (our payment processor) |
| Usage | Cases opened, features used, timestamps, error reports, device and browser type, IP address | automatically |
| Security logs | every access to a Case, who performed it, when and from where | automatically, as required by Regulation 10 of the Data Security Regulations |
| Communications | support requests, correspondence, meeting notes | you |
We never receive or store full payment-card numbers. Card details are entered directly on pages served by Stripe, a PCI DSS Level 1 certified provider. Payment records sent to Stripe carry an order reference and the amount, never the name or contents of a Case.
2.2 Case Data
Files and content uploaded by the firm; text extracted from them by optical character recognition; transcripts produced from recordings; descriptions of images and video; analyses, drafts and findings generated by the Service; the firm's own notes, corrections, verdicts on findings and conversations with the assistant; and access grants the firm creates for colleagues or clients. Case Data may include criminal-proceedings information, health information, information about intimate life and family, financial information, identification numbers, voice recordings and images. We collect it only because and to the extent the firm uploads it.
2.3 Website visitors
If you visit justik.ai without signing in, we collect only technical data necessary to serve the site (IP address, browser type, pages requested) in server logs retained for up to 30 days. We do not use analytics or advertising cookies.
To suggest your country and the product's language on the sign-in page, we look up the country of your IP address in a geolocation database kept on our own servers. The address is not sent to any third party for this lookup and the result is not stored; a country you choose yourself always takes precedence. IP Geolocation by [DB-IP](https://db-ip.com), licensed under [CC BY 4.0](https://creativecommons.org/licenses/by/4.0/).
3. How and why we use personal data
3.1 Account Data. We use Account Data to: create and administer workspaces and access rights; authenticate users; take payment and issue tax invoices; provide support; send service notices (for example, completion of an analysis, security alerts, changes to terms); secure the Service, detect abuse and maintain the access log required by law; comply with legal obligations; and enforce our Terms. The legal bases on which we rely under the GDPR are:
| Purpose | Legal basis |
|---|---|
| Creating and administering accounts and workspaces; authentication; providing the Service and support; service notices | performance of the contract with your firm (Article 6(1)(b)), and our legitimate interest in providing the Service to the firm that engaged us (Article 6(1)(f)) where you are not personally a party to that contract |
| Payment, invoicing, tax and accounting records | compliance with legal obligations (Article 6(1)(c)) |
| Access and security logs; fraud and abuse prevention; securing the Service | compliance with legal obligations, including the Data Security Regulations (Article 6(1)(c)), and our legitimate interest in the security of the Service and of our customers' data (Article 6(1)(f)) |
| Establishing, exercising or defending legal claims; enforcing our Terms | our legitimate interests (Article 6(1)(f)) |
| Marketing e-mail | your consent (Article 6(1)(a)), which you may withdraw at any time |
Where we rely on legitimate interests, we have balanced them against your rights and freedoms; you may obtain information about that assessment on request. Providing Account Data is a contractual requirement: without it we cannot give you access to the Service. We do not send marketing e-mail to users without consent, and every marketing message includes an unsubscribe link.
Canada. Under the Canadian Privacy Laws we collect, use and disclose Account Data with your consent, which is implied by your registration for and use of the Service for the purposes described in this section, and only for those purposes; business contact information used to communicate with you in your professional capacity is handled as those laws permit. Marketing e-mail is sent only with your express consent. You may withdraw consent at any time on reasonable notice, subject to legal and contractual restrictions; withdrawing consent to the processing needed to provide the Service means we can no longer provide it to you.
3.2 Case Data. We process Case Data exclusively to provide the Service to the firm: to store files; to read, transcribe, translate and describe them; to index them for retrieval; to generate analyses using large language models; to review processing quality before results are released; to display results to the users the firm authorises; and to support and secure the Service. We do not use Case Data for any purpose of our own, except that, on the firm's instruction under the Terms, the Service distils de-identified practice knowledge from how lawyers use it (section 3.5).
3.3 What we do not do. We do not train or fine-tune machine-learning models on Case Data. We do not sell personal data. We do not use personal data for advertising or profiling. We do not review Case Data except where necessary to operate the Service, to review processing quality before delivery, or when the firm asks for support, and every such access is logged.
3.4 Aggregated statistics. We derive aggregated, non-identifying metrics (volumes, processing times, error rates) to operate and improve the Service. These metrics cannot be traced to a firm, Case or individual.
3.5 Practice knowledge. The Service learns generalised methods and tactics from how lawyers use it (corrections, instructions and conversations with the assistant) and keeps them as abstract rules. Before a rule is stored, and again before it is shared, automated checks discard any rule that carries a person's name, an identification number, contact details, an address, a case number, an exact date or the firm's name; rules contain no facts of a Case. A rule is first available only to the firm in which it was learned; a method arrived at independently by several firms may be made available to all users. Case Data itself is never shared with another firm, and practice knowledge is not used to train machine-learning models.
4. Automated processing and AI
The Service uses automated techniques, including large language models, to read, transcribe, translate, organise and analyse Case Data. Results are produced for review by a qualified attorney, who remains responsible for them; the Service does not make decisions with legal effect about any person, and its results are not legal advice. Attorneys can mark any finding as incorrect, add their own reading of a document, and exclude material from analysis. Our AI providers process Case Data under enterprise terms that prohibit its use for model training.
5. Sub-processors and disclosure
5.1 Sub-processors. We use a small number of service providers, bound by written data-processing terms, to deliver the Service:
| Provider | Purpose | Location |
|---|---|---|
| Google Cloud (Google LLC / Google Ireland Ltd.) | hosting, object storage, managed database, compute jobs, Vertex AI models (including Gemini and third-party models offered through Vertex AI), Speech-to-Text, Cloud Vision, Document AI, reCAPTCHA | United States (us-central1); transcription compute in Belgium (europe-west1); model inference may use Google's global endpoints |
| Google Firebase Authentication / Identity Platform | sign-in, identity and two-step sign-in (including SMS codes) | United States |
| TypeSafe AI, Inc. | fast classification of document text to prioritise analysis (receives text extracted from Case documents; does not train models on it) | United States |
| Stripe, Inc. | card payments and saved payment methods | United States |
| Namecheap, Inc. (Private Email) | transactional e-mail sent from info@justik.ai | United States |
| Giluy Naot | verification of case-law citations (receives citation numbers only, not Case Data) | Israel |
Speech-to-text transcription runs on infrastructure we operate within Google Cloud. The current list is published at justik.ai/subprocessors and in Schedule A of the Terms of Service; firm administrators are notified by e-mail at least 14 days before a new sub-processor of Case Data is engaged.
5.2 Within your firm. Case Data is visible to the users your firm's administrator authorises. The firm may also share a Case by an invitation to a verified e-mail address; those grants are recorded and revocable by the firm.
5.3 Legal requirements. We disclose personal data to courts, regulators or law-enforcement authorities only where legally required. We treat any such demand concerning Case Data as compelled disclosure, disclose only what is strictly required, and notify the firm before disclosure unless the law prohibits it.
5.4 Corporate transactions. If Justik is involved in a merger, acquisition or sale of assets, personal data may be transferred to the successor, who will remain bound by this Policy; we will notify firms before their data becomes subject to a different policy.
5.5 No other disclosure. We do not otherwise disclose personal data to third parties.
6. International transfers
Our production systems are located primarily in Google Cloud's us-central1 region in the United States, with transcription compute in Google Cloud's europe-west1 region (Belgium). Uploading Case Data to the Service therefore transfers it outside Israel. For Case Data this occurs on the firm's instruction as controller. In all cases we rely on written contractual safeguards with our sub-processors that meet the requirements of the Transfer of Data Abroad Regulations: the recipient processes data only on our instructions, applies security measures no weaker than those required by Israeli law, and does not transfer it onward without equivalent protection. Data is encrypted in transit (TLS 1.2 or higher) and at rest. Firms requiring hosting in another region may contact us about enterprise arrangements.
Where personal data subject to the GDPR or the UK GDPR is transferred to Justik in the United States or to our sub-processors in other countries that are not recognised as providing an adequate level of protection, the transfer is made under the European Commission's standard contractual clauses (Decision (EU) 2021/914) and, for the United Kingdom, the UK International Data Transfer Addendum, as incorporated in Schedule A of the Terms of Service; Israel is recognised by the European Commission as providing an adequate level of protection. We have assessed the laws of the destination countries and apply supplementary measures, including encryption in transit and at rest, strict access controls and a policy of challenging unlawful requests from public authorities. You may obtain a copy of the relevant safeguards by writing to us; commercial terms may be redacted.
Canada. Personal information of individuals in Canada, including Case Data uploaded by Canadian firms, is stored and processed outside Canada, principally in the United States and, for transcription, in Belgium, by Justik and the sub-processors listed in section 5.1. While it is outside Canada it is subject to the laws of those countries and may be accessible to their courts, law-enforcement and national-security authorities under those laws. We protect it there by contract and by the security measures described in section 8, so that it receives a level of protection comparable to that required in Canada. Questions about our practices for service providers outside Canada may be directed to our Privacy Officer (section 13).
7. Retention
| Data | Retention |
|---|---|
| Case Data | for as long as the Case exists in the firm's workspace; deleted from production systems when the firm deletes the Case, and from backups within 30 days |
| Account Data | for the life of the workspace and 30 days after closure, then deleted |
| Billing records | 7 years, as required by Israeli tax law; an order for a deleted Case keeps amounts and quantities only, nothing of the Case's material |
| Access and security logs | 24 months (Regulation 10 of the Data Security Regulations) |
| Website server logs | 30 days |
| Support correspondence | 24 months after the ticket closes |
A firm may download its Case Data at any time while its workspace exists. A workspace is closed only at the firm's request, after which its Case Data is deleted as described above.
8. Security
Justik operates an information-security programme intended to meet the "medium" security level under the Data Security Regulations, including a database definitions document, a written security procedure and an incident-response procedure. Key measures include:
- encryption of all data in transit and at rest;
- strict tenant isolation: each firm's data is segregated in the database by row-level security keyed to the firm, and every query runs within that firm's scope;
- least-privilege, role-based access for Justik personnel and service accounts, two-step sign-in available to every user, and logging of access to Case Data;
- signed, time-limited links for every file upload and download, so files are never publicly addressable;
- separation of production and development environments, with no Case Data in development;
- point-in-time recovery and encrypted backups of the production database, and changes deployed only through reviewed and tested releases;
- written confidentiality undertakings for all personnel with access to production systems.
If a security incident affects your personal data, we will notify the affected firm without undue delay and, where feasible, within 72 hours of becoming aware of it, and we will notify the Privacy Protection Authority where Regulation 11 requires. Israel Bar ethics. The Service is built so that attorneys can use it in line with the Israel Bar Association Ethics Committee's Decision 1/22 on cloud services: a reliable hosting provider, regular backups, protection of client confidentiality, and prompt notice to the firm of any security incident so that it can inform its clients.
No system is perfectly secure; we ask users to protect their credentials and to report suspected incidents to info@justik.ai.
9. Your rights
9.1 Users of the Service. Subject to the conditions and exceptions of the applicable law, you have the right to request access to the Account Data we hold about you and a copy of it; to have inaccurate or incomplete data rectified; to have data erased; to restrict its processing; to receive data you provided to us in a structured, commonly used and machine-readable format and to have it transmitted to another controller; to object at any time to processing based on our legitimate interests, on grounds relating to your particular situation, and to object without any reason to direct marketing; and, where processing is based on consent, to withdraw that consent at any time without affecting the lawfulness of processing before its withdrawal. Under sections 13 and 14 of the PPL you may also request to inspect your information and ask that it be corrected or deleted. Write to info@justik.ai. We will verify your identity before acting on a request and will respond within one month of receipt, which may be extended by two further months where necessary, taking into account the complexity and number of requests; we will tell you of any extension and the reasons for it. We may decline requests that are manifestly unfounded or excessive, or where retention is required by law, for example tax records and access logs. Firm administrators can update most Account Data directly in the Service; erasure of a user's account at the firm's request leaves the firm's Cases in place.
Canada. Under the Canadian Privacy Laws you may ask whether we hold personal information about you, how it has been used and to whom it has been disclosed, and request access to it and its correction. We will respond within 30 days, which may be extended as those laws allow, and tell you of any extension; access is free of charge unless the law permits a minimal fee, of which we will tell you in advance. If we refuse a request in whole or in part, we will tell you why and how to challenge that decision.
9.2 Persons whose data appears in a Case. If you are a defendant, witness, complainant or other person whose information is contained in Case Data, the law firm that uploaded the material is the controller of that data and the party to which requests concerning it must be addressed. If you contact us, we will forward your request to the firm without undue delay and assist the firm in responding, unless the law requires otherwise. We do not independently confirm or disclose the existence or content of any Case.
9.3 Complaints. You may lodge a complaint with the Israeli Privacy Protection Authority (Ministry of Justice) and, if you are in the European Economic Area, the United Kingdom or Switzerland, with the supervisory authority of your habitual residence, place of work or place of the alleged infringement (in the United Kingdom, the Information Commissioner's Office). In Canada you may complain to the Office of the Privacy Commissioner of Canada and, where the law of your province applies, to the Information and Privacy Commissioner of Alberta or of British Columbia. We would welcome the opportunity to address your concern first.
9.4 No automated decisions about you. We do not make decisions based solely on automated processing that produce legal effects concerning you or similarly significantly affect you within the meaning of Article 22 GDPR.
10. Cookies and similar technologies
The Service uses only strictly necessary technologies: an authentication session managed by Firebase Authentication; small local-storage items that remember your workspace preferences (for example, the last Case you opened, your language, or that you have answered a prompt); and Google reCAPTCHA, which is loaded only when an SMS code is sent and is used solely to prevent abuse. We do not use advertising, analytics or cross-site tracking cookies, and we do not respond to "Do Not Track" signals because we do not track.
11. Children
The Service is intended for legal professionals and is not directed at anyone under 18. We do not knowingly collect Account Data from minors. Case Data may lawfully contain information about minors involved in criminal proceedings; it is processed solely on the instructions of the responsible firm.
12. Changes to this Policy
We may update this Policy from time to time. Material changes will be notified by e-mail to firm administrators at least 14 days before they take effect. The current version is always available at justik.ai/privacy.
13. Contact
Privacy Officer: Roy Klein, Founder · Justik, Inc. · 131 Continental Drive, Suite 305, Newark, Delaware, United States · info@justik.ai
The Privacy Officer is accountable for Justik's compliance with this Policy and with the data-protection laws listed above, including the Canadian Privacy Laws.
Our databases are maintained in accordance with the PPL, and our database definitions document is available to customers on request under confidentiality.