PART A — PRIVACY POLICY

1. Who We Are and What This Covers

This Privacy Policy and Security Policy (together, this “Policy”) describes how The Mentor Esq Inc. (“Company,” “we,” “us,” “our”) collects, uses, discloses, retains, and protects information in connection with the Illuminate artificial-intelligence platform and related websites, applications, and services (the “Service”).

This Policy is incorporated into, and forms part of, The Mentor Esq. Pledge, Disclaimer & Terms of Use (the “Terms”). Capitalized terms not defined here have the meanings given in the Terms. Where this Policy and the Terms conflict on a privacy or security matter, this Policy controls.

By accessing or using Illuminate, you acknowledge that you have read and understood this Policy.

2. Information We Collect

2.1 Information you provide

• Account information — your name, email address, law firm or organization, jurisdiction(s) of admission, bar number where you provide it, role, and the credentials you use to sign in.
• Authentication information — the second-factor method you register (authenticator app, security key, or phone number for one-time codes) and associated verification records.
• User Content — everything you put into Illuminate and everything it generates for you: uploaded documents, police reports, medical records, transcripts, pleadings, correspondence, matter names, prompts, instructions, chat history, and all generated output.
• Billing information — plan, transaction history, and billing contact. Payment card numbers are collected and processed directly by our payment processor, Stripe, Inc.. We do not receive or store full payment card numbers.
• Communications — support requests, feedback, survey responses, and correspondence with us.

2.2 Information collected automatically

• Usage data — features used, actions taken, timestamps, session duration, and error and diagnostic events.
• Device and technical data — IP address, browser type and version, operating system, device identifiers, and referring pages.
• Security and audit logs — sign-in attempts, two-factor verification events, password and account changes, and administrative actions, retained for security and fraud-prevention purposes.
• Cookies and similar technologies — strictly necessary cookies for authentication and session management only. We do not use advertising cookies or third-party ad trackers, and we do not participate in cross-site behavioral advertising.

3. How We Use Information

We use information only for the following purposes:

• to provide, operate, and deliver the Service and generate the output you request;
• to authenticate you, enforce two-factor authentication, and secure your account;
• to provide customer and technical support when you request it;
• to monitor, investigate, prevent, and respond to security incidents, abuse, fraud, and violations of the Terms;
• to maintain, troubleshoot, debug, and improve the reliability and performance of the Service;
• to process payments, administer subscriptions, and communicate about your account, including service, security, and billing notices; and
• to comply with law, respond to lawful legal process, and establish, exercise, or defend legal claims.

4. What We Do Not Do

This section is as important as the one above.

• We do not sell your information. We do not sell, rent, license, or trade User Content or personal information to anyone, for any purpose, ever.
• We do not share your files with other users. No other Illuminate user, law firm, or subscriber can view, search, retrieve, or otherwise access your uploads, matters, chat history, or generated output.
• We do not use your User Content to train artificial-intelligence models. Not our own models, and not anyone else’s. Your documents do not become training data.
• We do not use your information for advertising, behavioral profiling, or marketing to your clients.
• We do not mine your matters for competitive or business intelligence.

We may generate and use aggregated, de-identified statistics that cannot reasonably be used to identify you, your clients, or your matters — for example, the total number of documents processed platform-wide in a month — to operate and improve the Service.

5. How Illuminate Processes Your Content with AI

Illuminate generates output using large language models provided by Anthropic, PBC, accessed through Anthropic’s commercial application programming interface. To produce a result, the relevant portions of your prompt and the documents you supply are transmitted to Anthropic for processing, and the resulting output is returned to you.

Under Anthropic’s Commercial Terms of Service, which govern our use of that interface: you retain all rights to inputs and own the outputs; and Anthropic may not train its models on customer content submitted through the commercial API. Anthropic processes and retains such content only as described in its Commercial Terms and Data Processing Addendum, principally for the limited period necessary to deliver the service and to conduct trust-and-safety review.

This is materially different from consumer chatbot products, where content may be retained and used differently. Illuminate does not route your content through consumer AI products.

You remain responsible, under Section 7 of the Terms and your own professional obligations, for deciding what to submit. See Section 10 below.

6. When We Disclose Information

We disclose information only in these circumstances:

• Service providers and subprocessors. We use a limited set of vendors to host, secure, and operate the platform — including our cloud infrastructure providers, Supabase (database, storage, and authentication, hosted on Amazon Web Services in us-east-2) and Vercel (application hosting), our AI model provider, Anthropic, PBC, and our payment processor, Stripe, Inc.. Each is bound by contract to protect the information, to use it only to provide services to us, and not to use it for its own purposes.
• At your direction. When you export, share, download, or transmit content yourself.
• Legal process and safety. Where required by valid subpoena, court order, warrant, or other lawful legal process, or where we reasonably believe disclosure is necessary to prevent imminent physical harm or to investigate suspected fraud or a security incident. See Section 7.
• Corporate transaction. In connection with a merger, acquisition, financing, reorganization, or sale of assets, subject to the acquirer being bound by commitments no less protective than those in this Policy. We will notify you of any such transfer.

We do not disclose information to any other party.

7. If Someone Subpoenas Your Data

You are a lawyer. You need to know how we behave when a third party comes looking for your files.

• We will not voluntarily produce User Content to any private party, adversary, or litigant.
• If we receive a subpoena, court order, or other compulsory demand seeking your User Content, we will notify you promptly and before producing anything, unless we are legally prohibited from doing so or a genuine emergency involving risk of physical harm exists. Where a legal prohibition is temporary, we will notify you as soon as it lifts.
• We will give you a reasonable opportunity to object, move to quash, or seek a protective order before we respond, to the extent the process and applicable law permit.
• We will object to demands that are facially overbroad, procedurally defective, or that appear directed at obtaining privileged material, and we will produce only what we are legally obligated to produce.
• We will not assert privilege on your behalf — that is yours to assert — but we will not waive it for you either, and we will not treat a demand for your material as our decision to make.

8. Retention and Deletion

We retain User Content for as long as your account is active, so that your matters, uploads, and chat history remain available to you. You may delete individual documents, matters, or conversations at any time from within the Service.

When you delete content, or when you close your account, we delete the associated User Content from active production systems within a commercially reasonable period. Residual copies may persist in encrypted backups for a limited retention cycle before being overwritten in the ordinary course, and we may retain information where we are required to do so by law, or where it is necessary to resolve a dispute, enforce our agreements, or preserve evidence subject to a litigation hold.

Account records, billing records, and security and audit logs are retained separately for the periods required for tax, accounting, security, and legal-compliance purposes.

You should maintain your own copies of anything you need. Illuminate is not a system of record, a document management system, or a backup service, and you should not rely on it as your only copy of anything.

9. Your Rights and Choices

You may, at any time:

• Access and export your User Content and account information;
• Correct inaccurate account information from your profile settings;
• Delete individual documents, matters, and conversations, or request deletion of your account and its contents;
• Manage your two-factor authentication methods and active sessions; and
• Opt out of non-essential email. You cannot opt out of security, billing, and service notices while your account remains active.

To exercise any of these, contact us at the address in Section 15. We will respond within a reasonable period and, where a privacy statute applies to you, within the period that statute requires. We will not discriminate against you for exercising these rights.

Depending on where you reside, additional statutory rights may apply to you. We honor valid requests under applicable state and national privacy laws.

10. Your Responsibilities — Client Confidentiality

This Policy describes what we do. It does not, and cannot, discharge what you must do.

You remain solely responsible for determining what information you submit to Illuminate and whether that submission is consistent with your duty of confidentiality, your engagement agreements, any protective or sealing order, and applicable law — including obtaining informed client consent where your professional obligations require it. Nothing in this Policy is a representation that submitting particular material is ethically permissible in your matter, and nothing in it guarantees the preservation of the attorney–client privilege or the work-product doctrine. See Sections 6 and 7 of the Terms.

11. Location of Data; International Users

Illuminate is operated in the United States and intended for use by legal professionals in the United States. Information is stored and processed in the United States and may be processed in other jurisdictions where our service providers operate. If you access the Service from outside the United States, you do so on your own initiative and are responsible for compliance with local law, including any data-transfer or data-localization requirement applicable to you or your clients.

12. Children

Illuminate is a professional tool intended for adults. It is not directed to children, and we do not knowingly collect personal information from anyone under eighteen. If we learn that we have, we will delete it.