Privacy Policy

Effective 9 October 2026 · Last updated 12 October 2026

This Privacy Policy explains what personal data LegalByte Sdn Bhd (Registration No. 202501044817 (1646225-D)) (“LegalByte”, “we”, “us”, “our”) collects, what we store, where it is stored and processed, who we share it with, how long we keep it, and the rights you have. It covers our website at legalbyte.my and the LegalByte aOS platform (together, the “Services”). We process personal data in accordance with the Personal Data Protection Act 2010 of Malaysia, as amended (the “PDPA”).

1. Who we are and when this Policy applies

LegalByte provides an AI platform for legal professionals. This Policy explains our role in two different situations, because the PDPA treats them differently:
(a) Where we are the data controller. For data about website visitors, people who book a demonstration or contact us, and the account details of the people who use the Services (name, email, role, sign-in and usage records), LegalByte decides how and why the data is used, and this Policy applies in full.
(b) Where we are the data processor. The documents, prompts, conversations and other material a customer firm and its users put into the Services (“Customer Content”) often contain personal data about clients, counterparties and others. For that data, the customer firm is the data controller and we process it only on the firm’s instructions, under our Terms of Service and any data processing agreement with the firm. If you are a client or counterparty of one of our customers, please contact that firm first about your data; we will help the firm respond.

2. What personal data we collect and store

The table below lists every category of personal data the Services store, so that you can see exactly what we hold.

Category	What it includes	Where it comes from
Account and identity	Name, work email address, firm, role and seat status in the firm, sign-in identifier, multi-factor authentication and single sign-on settings, invitation records (invitee email and invite status).	You, your firm's administrator, or your firm's identity provider when single sign-on or SCIM provisioning is used.
Security and access records	IP address and browser user agent at sign-in and on recorded actions, session records, and an audit log of significant actions (who did what, when, and to which record). Audit entries record the names of tool inputs, not their free-text values.	Generated automatically when you use the Services.
Customer Content	Files you upload and their extracted text, search indexes built from them (numerical embeddings), chat conversations and agent activity, generated drafts, reviews and other outputs, firm and project memory notes, saved workflows, and items you import from connected services.	You and other users in your firm. We process this as a data processor (section 1(b)).
Connected accounts	If your firm enables a connector (for example email, calendar or cloud drive), the connected account's email address, encrypted access credentials, and the names, paths and identifiers of items you choose to use.	You, when you connect an account.
Usage and billing	Which AI model was used, token counts and cost for each request, plan, allowance and credit balance, invoice contact email, and payment references. We do not store card numbers.	Generated by the Services, your firm's administrator, and our payment processor.
Technical logs	Request path, response status, firm and user identifiers, and a shortened browser user agent. Request bodies and query strings are not logged.	Generated automatically.
Website analytics	Page path (with query strings and fragments removed), referrer, approximate location (country, region, city), and device and browser type. No cookies and no cross-site identifiers are used.	Collected automatically by our hosting provider (section 9).
Enquiries and demonstrations	Name, email, firm, firm size, phone number and any message you send when you book a demonstration or email us.	You.

We do not ask for, and you should not upload, sensitive personal data (such as health, religious or criminal record data) unless it is necessary for the legal matter and your firm has a lawful basis to process it.
What you must give us. Your name and work email are needed to create and secure your account; without them we cannot provide the Services. Everything else you give us, such as demonstration details or feedback, is voluntary.

3. How we use personal data, and why

Purpose	Data used	Basis
Provide the Services: sign-in, run your requests, store and retrieve your work	Account, Customer Content, connected accounts	Performance of the contract with you or your firm; your firm's instructions for Customer Content
Keep the Services secure: detect misuse, investigate incidents, keep the audit trail	Security and access records, technical logs	Necessary for the contract and to meet our legal obligations
Bill for the Services and enforce plan limits	Usage and billing	Performance of the contract
Support and service messages (invitations, security notices, changes to these terms)	Account	Performance of the contract
Understand how the website and product are used, in aggregate	Website analytics	Consent, which you may withdraw at any time (section 9)
Respond to enquiries and demonstration requests	Enquiries	Consent
Comply with law, court orders and regulatory requests	Any category, only as required	Legal obligation

No training on your data. We do not use Customer Content to train, fine-tune or otherwise develop any artificial intelligence model, and our AI providers are contractually prohibited from doing so or from retaining it. We do not use Customer Content for benchmarking or product analytics without your firm’s written opt-in.
No sale, no advertising. We do not sell personal data, we do not use it for targeted advertising, and we do not make automated decisions with legal or similarly significant effects on you.

4. How AI processing works

When you send a request, the relevant parts of your prompt, the documents or passages needed to answer it, and your firm’s memory notes are sent to an AI model to produce a response. Models are provided through Amazon Bedrock under AWS’s data processing terms. Depending on your firm’s settings, these may include models developed by Anthropic (Claude) and by OpenAI, all of which run on AWS infrastructure; we do not send Customer Content to a consumer AI service at any point. The model provider processes the request in real time to return a response and does not keep it or train on it. AI output can be wrong; see section 5 of our Terms of Service.

5. Where your data is stored and processed

Storage stays in Malaysia. Customer Content at rest, including documents, database records, search indexes, encryption keys and audit logs, is stored in AWS Asia Pacific (Malaysia) region (ap-southeast-5). Sign-in (Amazon Cognito) and outbound service email (Amazon SES) also run in that region.
Some processing happens outside Malaysia, and we say so plainly:

AI responses. AI requests run on Amazon Bedrock global cross-region inference, so a request may be processed in any AWS commercial region worldwide, including outside Asia Pacific. Nothing is stored there.
Search indexing of your documents. Building and querying the search index for your firm’s files also uses Amazon Bedrock global cross-region inference. The resulting index is stored in Malaysia.
Recording transcription, only when you ask for it. If you approve the transcription of an audio or video recording, a temporary copy is processed by Amazon Transcribe in AWS Asia Pacific (Singapore) and deleted automatically within 3 days. The transcript is stored in Malaysia.
Video description, only when you ask for it. If you approve a request to describe what is visible in a video, the video is processed by an Amazon Bedrock model on global cross-region inference, so it may be processed in any AWS commercial region worldwide. Nothing is stored there.
Public legal research. When you search our Malaysian legal corpus, the text of your search query is processed by Google Cloud in the Asia Pacific region. Your documents are not sent.
Website and application delivery. Our website and the application front end are served by Vercel from Singapore.
Only when used: pages the AI opens on approved official legal and government websites, and connectors your firm chooses to enable (section 7).

We transfer personal data outside Malaysia only as permitted by section 129 of the PDPA, including where the transfer is necessary to perform our contract with you or your firm, and only to providers bound by written terms that protect it to a standard at least equivalent to the PDPA.

6. Who we share personal data with

We share personal data only with the service providers (sub-processors) below, each limited to what it needs for its purpose and bound by contract to protect it. We will give customer firms at least 30 days’ notice before adding or replacing a sub-processor that handles Customer Content.

Provider	What it does	Location
Amazon Web Services	Hosting, database, file storage, encryption keys, sign-in, service email, malware scanning, AI models through Amazon Bedrock, and optional recording transcription through Amazon Transcribe	Malaysia for storage; AI processing in AWS regions worldwide; transcription in Singapore (section 5)
Google Cloud	Search of the public Malaysian legal corpus (query text only, no Customer Content)	Asia Pacific
Vercel	Website and application hosting; cookieless page-view and performance statistics	Singapore
Composio	Connects the email, calendar and drive accounts your firm chooses to enable	United States; only when your firm enables a connector
Stripe	Card payments and top-ups, where you pay by card	Global
Cal.com	Demonstration booking on our website	Global
Google Fonts	Typefaces for the website (receives your IP address when the font loads)	Global

We may also disclose personal data: (a) to your firm, if you use the Services as one of its users; (b) to authorities, where required by law or court order, in which case we will tell the affected firm first unless the law forbids it; and (c) to a successor in a merger or sale of our business, which must honour this Policy.

7. Connectors and outside services

Connectors (for example Gmail, Outlook, Google Calendar or Google Drive) are off by default and are enabled by your firm’s administrator. When you use one, the data you choose to read or send passes through Composio and the third-party service, and is then subject to that service’s own terms and privacy policy. Before the AI sends an email, creates a calendar event or writes to an outside service, it is designed to ask you to confirm in the chat, and outgoing requests are checked and blocked if they appear to contain certain sensitive legal personal data. When the AI opens a web page, it can only reach an approved list of official government and legal sources over secure connections; only the address of the page leaves the platform.

8. How long we keep personal data

Data	How long
Customer Content	For the subscription term, until deleted by your firm. Deleting a conversation removes it permanently. Deleting a file archives it first so it can be recovered; it is permanently removed on your firm's request or when the subscription ends.
After the subscription ends	For 30 days, your firm may ask us to return its Customer Content; we then delete it within a further 30 days. Encrypted backups expire on their normal cycle. We will confirm deletion in writing on request.
Account and identity	While your account is active. When your firm removes you, your account is deactivated; your name stays attached to work you created and to the audit log so the firm's records remain complete.
Audit log and security records	For the life of the firm's account and afterwards for as long as needed to establish, exercise or defend legal claims and meet legal obligations. The audit log is tamper-evident and cannot be edited.
Billing records	For at least 7 years, as required by Malaysian tax and company law.
Enquiries and demonstration requests	Up to 24 months after our last contact, unless you become a customer.

9. Cookies and browser storage

We do not use advertising or cross-site tracking cookies. The Services use:

One essential sign-in cookie (legalbyte_session), secure and not readable by scripts, which expires after 12 hours. Our sign-in provider (Amazon Cognito) sets its own essential cookies on its sign-in page.
Browser storage for things such as keeping you signed in between pages, remembering the email you use for single sign-on, whether you have seen the product tour, and unsent chat messages. This stays in your browser and you can clear it at any time.
Cookieless analytics from our hosting provider, Vercel, which counts page views and measures page speed without cookies or identifiers that follow you across sites. Visitors are counted with a short-lived hash that is discarded within 24 hours. You can stop it at any time with a standard content or tracker blocker in your browser; the Services work normally without it.

Our demonstration booking page embeds Cal.com, which may set its own cookies; see Cal.com’s privacy policy.

10. How we protect personal data

We apply technical and organisational measures appropriate to the risk, including: encryption in transit and at rest with a separate encryption key for each firm; strict separation of each firm’s data; role-based access controls inside each firm; multi-factor authentication and single sign-on; malware scanning of uploads; a tamper-evident, hash-chained audit log; and restricted, logged staff access. See our Security page for more detail.
Data breaches. If a personal data breach affects you or your firm, we will notify the affected customer firm without undue delay and in any event within 72 hours of becoming aware of it, and we will notify the Personal Data Protection Commissioner and affected individuals where the PDPA requires.

11. Your rights

Subject to the PDPA and its exceptions, you may:

access the personal data we hold about you;
correct data that is inaccurate, incomplete, misleading or out of date;
receive or transmit your personal data to another data controller in a commonly used format (data portability), where technically feasible;
withdraw consent to processing that relies on consent;
ask us to stop processing that is likely to cause you substantial damage or distress; and
ask us to stop processing for direct marketing.

To exercise a right, email us (section 14). We will respond within 21 days, as the PDPA requires, and may ask you to verify your identity. Where your request concerns Customer Content, we will refer it to your firm, which is the data controller for that content, and help it respond. If you are not satisfied, you may complain to the Personal Data Protection Commissioner of Malaysia (Jabatan Perlindungan Data Peribadi).

12. Children

The Services are designed for legal professionals and are not directed at anyone under 18. We do not knowingly collect personal data from children as users. Customer Content may include data about minors where a legal matter requires it; the customer firm is responsible for having a lawful basis to process it.

13. Changes to this Policy

We will post any update here and change the “Last updated” date. If a change materially affects how we handle personal data, including any new sub-processor for Customer Content, we will notify customer firm administrators by email at least 30 days before it takes effect.

14. Contact us and our Data Protection Officer

For privacy questions, to exercise your rights, or to reach our Data Protection Officer, email support@legalbyte.my (adding “Privacy” to the subject line helps us route it to the right person). We are LegalByte Sdn Bhd (Registration No. 202501044817 (1646225-D)); our registered office address for postal correspondence is available on request. This Policy is also available in Bahasa Malaysia; if the two versions differ, the English version applies.