Terms of Service

The Services are provided only to businesses and professional organisations, not to consumers. Our agreement with the Customer consists of the applicable Order, these Terms, the Privacy Policy, and any data processing agreement we sign with the Customer. If they conflict, the order of priority is: a signed Order or data processing agreement, then these Terms, then the Privacy Policy. Each individual who uses the Services must also follow sections 4 and 5 personally.

“Customer” means the organisation that subscribes to the Services. “Authorised User” means an individual the Customer permits to use the Services under its account. “Customer Content” means documents, data, prompts, instructions and other material submitted to the Services by or for the Customer, including material imported through a connector. “Output” means material the Services generate for the Customer, including answers, research summaries, reviews, drafts and proposed edits. “Order” means the order form, quotation, subscription agreement or online plan selection under which the Customer subscribes. “Preview Feature” means a feature we label as beta, preview, early access or similar. “PDPA” means the Personal Data Protection Act 2010 of Malaysia, as amended, and its subsidiary legislation. “LegalByte Materials” means the Services, our legal corpus and its indexes, templates, prompts and workflows, and any other material we provide that is not Customer Content.

Subject to these Terms and the Order, we grant the Customer a non-exclusive, non-transferable, non-sublicensable right for its Authorised Users to access and use the Services during the subscription term for the Customer’s internal business purposes. Accounts are personal to each Authorised User and must not be shared. The Customer is responsible for choosing its Authorised Users and their roles, for keeping credentials secure (including by using multi-factor authentication or single sign-on where available), for removing users who leave, and for all activity under its account. The Customer must tell us promptly if it becomes aware of any unauthorised access.

The Customer and its Authorised Users must not:

1. use the Services in breach of any law, court order, or professional rule that applies to the user, including the Legal Profession Act 1976 and the rulings of the Bar Council;
2. upload Customer Content they have no right to use, or that breaches a duty of confidence or privilege they owe to someone else;
3. try to access another customer’s data, probe or break our security or tenant isolation, or get around usage limits, policy controls or confirmation steps;
4. attempt to make the AI ignore its safety or policy instructions, or use it to produce malware, spam, unlawful surveillance, or content that deceives a court, tribunal or regulator;
5. present Output to a client, court or third party as verified legal work without the review required by section 5;
6. use Output to make decisions with legal or similarly significant effects on an individual without meaningful human review;
7. copy, reverse engineer, decompile, resell or sublicense the Services, or use the Services to build, test or improve a competing product or service;
8. extract, or try to extract, the prompts, system instructions, workflows, tool definitions, model configuration or any other non-public part of the Services, whether by questioning the AI or by any other means;
9. use the Services, or Output in bulk, to train, fine-tune or distil an AI model that competes with the Services, or to build a dataset for that purpose;
10. access the Services with bots, scrapers, crawlers or other automated tools, other than through features we provide for that purpose, or scrape, bulk-export or redistribute our legal corpus outside normal use of the Services;
11. access the Services on behalf of a competitor, or in order to benchmark, monitor or copy them, or record or capture the Services in order to replicate their design, features or behaviour; or
12. remove or hide any notice, watermark or marker in the Services or the legal corpus.

The Services are an assistive tool for qualified legal professionals. Output is generated by artificial intelligence and may be incomplete, out of date or wrong, including citations, case holdings, statutory references and statements of fact that look authoritative. Accordingly:

• LegalByte is not a law firm and does not practise law within the meaning of the Legal Profession Act 1976. Output is not legal advice and creates no solicitor-client relationship with LegalByte.
• Each Authorised User must check every authority against the primary source and apply their own professional judgment before relying on Output or sharing it with anyone.
• The Customer and the lawyer or other professional responsible for a matter remain professionally responsible for all work product, whether or not the Services helped produce it.
• Output may be similar to output generated for other customers, and we do not guarantee that it is unique.

Ownership. As between the parties, the Customer owns its Customer Content and all Output, and we assign to the Customer any rights we may have in Output. This assignment does not cover LegalByte Materials, or third-party material such as legislation and judgments, that appear in Output; we grant the Customer a perpetual, non-exclusive licence to use any LegalByte Materials included in Output as part of that Output.
Our limited licence. The Customer grants us a limited, non-exclusive licence to host, copy, process and transmit Customer Content only as needed to provide, secure and support the Services, to prevent misuse, and to comply with law. Our staff access Customer Content only where needed to give support the Customer asks for, to investigate a security incident or misuse, or to comply with law; such access is restricted and logged.
No training. We do not use Customer Content or Output to train, fine-tune or otherwise develop any AI model, and we contractually prohibit our AI providers from retaining it or training on it. We may use usage metrics that do not contain Customer Content (such as request counts, model used and response times) to operate, bill for and improve the Services.
Customer responsibilities. The Customer is responsible for the accuracy and legality of its Customer Content, and for having any notices, consents or other lawful basis needed under the PDPA to submit personal data to the Services.

Each party will keep the other’s confidential information confidential, use it only to perform this agreement, and disclose it only to its personnel and contractors who need to know it and are bound by equivalent duties. Customer Content is always the Customer’s confidential information. These duties do not apply to information that is or becomes public without fault, was already lawfully known, is independently developed, or is lawfully received from a third party. A party may disclose confidential information if required by law, after giving the other party prompt notice where lawful. These duties last for five years after the agreement ends, and for Customer Content and trade secrets, for as long as the information remains confidential.

For personal data within Customer Content, the Customer is the data controller and LegalByte is its data processor; we process it only on the Customer’s documented instructions, which are these Terms, the Order and the Customer’s use of the Services. We maintain the security measures described on our Security page and will not materially reduce them during a subscription term. We will notify the Customer of a personal data breach affecting Customer Content without undue delay and in any event within 72 hours of becoming aware of it, and assist it with its obligations under the PDPA. On reasonable request, no more than once a year, we will provide information reasonably necessary to show that we meet this section, such as our security documentation.
Data location. Customer Content at rest is stored in Malaysia (AWS ap-southeast-5). AI processing runs on Amazon Bedrock global cross-region inference and may take place outside Malaysia, including outside Asia Pacific. Section 5 of the Privacy Policy lists every flow and where it goes, and section 6 lists our sub-processors. We will give at least 30 days’ notice before adding or replacing a sub-processor that handles Customer Content; the Customer may object on reasonable data protection grounds and, if we cannot address the objection, terminate the affected Services with effect from the end of the current billing period.

The Services can connect to third-party services such as email, calendar and cloud drive providers. Connectors are off until the Customer enables them. Third-party services are not part of the Services, are governed by their own terms, and are outside our control; we are not responsible for their availability or for how they handle data once it reaches them. When the AI proposes an action in a third-party service, such as sending an email or creating an event, it is designed to ask the user to confirm in the chat first; the user is responsible for reviewing the proposed action before confirming it. This confirmation is a behaviour of the AI, not a guaranteed technical control, so the Customer should enable connectors only for users who need them. Our policy controls may block a request, for example where it appears to send sensitive legal personal data outside the platform.

We choose and may change the AI models used to provide the Services, and may offer the Customer a choice of models, provided that every model is subject to the commitments in sections 6 and 8. Preview Features are offered for evaluation, may change or be withdrawn, and may be less reliable than the rest of the Services; they are provided “as is” without any service commitment. Our confidentiality, security and data protection obligations apply to Preview Features in full.

The Customer will pay the fees in the Order. Unless the Order says otherwise, a subscription renews automatically for the same period until either party cancels it before the end of the current period. We may change fees for a renewal by giving at least 30 days’ notice before that renewal. Each plan includes a monthly AI allowance and may include a short usage window per user and a per-request ceiling, as described in the Order. We warn administrators when usage reaches 80% of an allowance; at 100%, new requests are refused until the allowance resets or the Customer buys prepaid credit, which extends the allowance. A request that has already started is always allowed to finish. Fees are exclusive of taxes, including Sales and Service Tax, which the Customer will pay where applicable. Invoices are due within 30 days unless the Order says otherwise. All fees and prepaid credit are non-refundable, except where Malaysian law requires otherwise, and prepaid credit cannot be exchanged for cash or transferred. Any prepaid credit still unused when the subscription ends is forfeited and is not refunded or carried over. Cancelling a subscription stops future renewals and takes effect at the end of the current billing period; it does not refund that period. We may suspend the Services under section 13 if undisputed fees are more than 30 days overdue after written notice. For a self-serve plan paid by card, we will email the Customer’s administrators when a payment fails, and we may pause AI features if that payment is still unpaid 7 days after that email; everything resumes once it is paid.

Ownership. LegalByte and its licensors own the LegalByte Materials, including the software, prompts, workflows, the curated legal corpus and its indexes, and their design. Nothing in these Terms transfers those rights except the limited right of use in section 3.
Our confidential technology. The non-public parts of the LegalByte Materials, including prompts, system instructions, workflows, tool definitions, the structure and indexes of the legal corpus, and unreleased features, are LegalByte’s trade secrets and confidential information under section 7, whether or not they are marked as confidential and however the Customer comes to see them.
Detecting copying. We may use technical measures to detect and prevent copying, including rate limits, monitoring of usage patterns, and marker entries placed in the legal corpus. This monitoring uses usage records; it does not give us any wider access to Customer Content than section 6 allows.
If our technology is misused. Items (c) and (g) to (l) of section 4 and this section 12 are the “Protection Terms”. The Customer is responsible for any breach of them by its Authorised Users. If they are breached:

1. we may suspend or end access immediately, and no fees or prepaid credit will be refunded;
2. the Customer must stop the breach at once, delete or return everything taken and everything built from it, including any model, dataset or product, not use or commercialise any of it, and confirm this in writing within 7 days;
3. the Customer must pay LegalByte, at LegalByte’s choice, either (i) agreed compensation of Ringgit Malaysia two hundred and fifty thousand (RM250,000) for each breach, which the parties accept is a genuine and reasonable estimate of loss that is difficult to prove, or (ii) LegalByte’s actual loss together with any profit the Customer made from the breach; and in either case LegalByte’s reasonable costs of investigating and enforcing, including legal costs; and
4. because damages alone would not be an adequate remedy, LegalByte may obtain an injunction or other urgent court order to stop the breach, in addition to any other remedy.

The limits in section 17 do not apply to a breach of the Protection Terms. Nothing in this section limits any right or remedy we have under the Copyright Act 1987, the Computer Crimes Act 1997 or any other law. Access obtained in breach of the Protection Terms is access without our authority.
Feedback. If the Customer gives us suggestions or feedback, we may use them freely, but doing so does not give us any right to the Customer’s confidential information or Customer Content.

We may suspend all or part of an account where reasonably necessary: (a) to stop a security threat or misuse that risks harm to the Services, other customers or third parties; (b) to comply with law or a court order; or (c) for overdue fees under section 11. Where practicable and lawful, we will give prior notice, explain the reason, give the Customer a chance to fix the issue, limit the suspension to what is necessary, and restore access promptly once it is resolved. Suspension does not delete Customer Content.

These Terms apply for the subscription term in the Order and any renewal. Either party may terminate for a material breach that is not remedied within 30 days of written notice, or immediately if the other party becomes insolvent or is wound up. When the agreement ends, access ends. For 30 days after that, the Customer may ask us to return its Customer Content in a standard format; we will then delete it within a further 30 days, other than encrypted backups that expire on their normal cycle and records we must keep by law, which stay protected by sections 7 and 8 until deleted. We will confirm deletion in writing on request. Sections 5 to 8, 12, this section 14 and sections 15 to 20, and any unpaid fees, survive termination.

We will provide the Services with reasonable skill and care and in line with these Terms. Except as expressly stated in these Terms, and to the fullest extent permitted by law, the Services and Output are provided “as is” and “as available”, and we disclaim all other warranties and conditions, including merchantability, fitness for a particular purpose, accuracy and non-infringement. We do not warrant that Output is accurate, complete or current, or that the Services will be uninterrupted or error-free.

By LegalByte. We will defend the Customer against any third-party claim that the Services, as provided by us, infringe that third party’s intellectual property rights, and pay the resulting damages and costs finally awarded or agreed in settlement. This does not apply to claims arising from Customer Content, Output, combination with things we did not provide, or use in breach of these Terms. If the Services are, or are likely to be, held to infringe, we may modify them, obtain a licence, or terminate the affected Services, in which case the Customer will not be charged for them after termination.
By the Customer. The Customer will defend LegalByte against any third-party claim arising from its Customer Content, its use of the Services in breach of section 4, or reliance on Output without the review required by section 5, and pay the resulting damages and costs finally awarded or agreed in settlement.
The indemnified party must promptly notify the other of the claim, let it control the defence and settlement (no settlement may admit fault for the indemnified party without its consent), and give reasonable help at the indemnifying party’s cost.

To the fullest extent permitted by law, neither party is liable for any indirect, incidental, special, consequential or punitive loss, or for loss of profits, revenue, goodwill or anticipated savings, arising out of or relating to the Services. Each party’s total aggregate liability arising out of or relating to this agreement will not exceed the greater of (i) the fees paid and payable by the Customer for the Services in the twelve (12) months before the event giving rise to the claim and (ii) Ringgit Malaysia fifty thousand (RM50,000). Each party’s total aggregate liability under its indemnity obligations in section 16 will not exceed the greater of (i) twice those fees and (ii) Ringgit Malaysia two hundred and fifty thousand (RM250,000). These limits do not apply to the Customer’s obligation to pay fees, to a breach of the Protection Terms in section 12, to either party’s deliberate misappropriation of the other’s intellectual property, or to liability for fraud, wilful misconduct or anything else that cannot be limited under Malaysian law.

We may update these Terms from time to time. We will post the update here and, for material changes, notify Customer administrators by email at least 30 days before the change takes effect. Changes will not materially reduce our security, confidentiality or no-training commitments during a paid subscription term. If a material change adversely affects the Customer, it may, before the change takes effect, give notice to end its subscription at the end of the current billing period, and the change will not apply to it until then. Otherwise, continued use after the effective date means acceptance of the updated Terms. Changes required by law may take effect sooner.

These Terms are governed by the laws of Malaysia. The parties will first try in good faith to resolve any dispute through their senior representatives within 30 days of written notice. Failing that, the parties submit to the exclusive jurisdiction of the courts of Kuala Lumpur, Malaysia. Either party may seek urgent injunctive relief at any time to protect its confidential information or intellectual property.

Neither party is liable for delay or failure caused by events beyond its reasonable control, other than payment obligations. Neither party may assign this agreement without the other’s consent, except to a successor in a merger or sale of substantially all of its business. Notices must be in writing and may be sent by email to the addresses in the Order (for LegalByte, support@legalbyte.my). If any provision is unenforceable, the rest remains in force. A failure to enforce a right is not a waiver of it. This agreement is the entire agreement between the parties on its subject matter, and nothing in a Customer purchase order varies it. These Terms and any Order may be accepted and signed electronically. If these Terms are translated, the English version prevails.