Your Privacy, By Design

CounselConduit collects the minimum information necessary to provide our services: • **Account Information:** Firm name, administrator email, and billing details provided during registration. • **Session Metadata:** Timestamp, duration, and token count. The flat monthly fee is not a per-session bill. Prompt and response text is not a billing record. • **Usage Analytics:** Aggregated site metrics via Google Analytics 4 when that tag is configured. **What We Do NOT Collect:** • Client search queries or AI conversation content • Browser history or browsing behavior • Documents, files, or case materials • Any personally identifiable information (PII) of your clients

ZDR means Zero Data Retention. In plain English: after the AI finishes processing a request, the provider does not keep the prompt or response in durable storage. That is different from no training. ZDR does not create attorney-client privilege. • AI inference is designed to run in short-lived compute contexts. • Session content is not retained as a long-term product archive; operational exceptions and outages can still create residual records. • Infrastructure logs may be retained for up to 30 days for security monitoring and are purged on schedule. • Universal zero-retention or zero-metadata is not claimed.

CounselConduit does not sell, rent, or trade your information. We share data only in these limited circumstances: • **Service Providers:** Google Cloud Platform (infrastructure), Whop (firm membership billing; paid catalog CTAs currently book a pilot). All providers are bound by data processing agreements. • **Legal Compliance:** We may disclose information if required by law, subpoena, or court order. We can only produce records that actually exist under our retention controls. • **Business Transfer:** In the event of a merger or acquisition, your data would be subject to the same privacy protections.

• TLS protects traffic to this website. • ShadowTagAI is not currently SOC 2 certified. • No system is perfectly secure.

When a firm connects Google services, that data is used only to provide features the firm has enabled. Drive file selection is not live on this site. CounselConduit's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We do not use Google user data for advertising. We do not sell it. We do not use it to train generalized AI models. A person reads it only with the firm's agreement for a specific support purpose, for security, or to comply with law. Do Not Track. This site does not respond to browser Do Not Track signals.

Depending on your jurisdiction, you may have the following rights: • **Access:** Request a copy of the personal data we hold about you. • **Correction:** Request correction of inaccurate personal data. • **Deletion:** Request deletion of your personal data (subject to legal retention obligations). • **Portability:** Request your data in a structured, machine-readable format. • **Objection:** Object to processing of your personal data for specific purposes. **GDPR (EU/EEA):** We process data under legitimate interest (Article 6(1)(f)) and contractual necessity (Article 6(1)(b)). DPA available upon request. **CCPA (California):** We do not sell personal information. California residents may exercise their rights by contacting privacy@kovelai.com.

For privacy inquiries, data subject requests, or to report a concern: • **Email:** privacy@kovelai.com • **Mail:** ShadowTagAI, Inc. — Privacy Team This policy is effective as of January 1, 2026 and was last updated on September 21, 2026. We will notify registered users of material changes via email at least 30 days before they take effect.