42B AI, Inc. Privacy Policy

1. Information We Collect

• (a) Account Data. Name, work email, employer, and other information provided at signup.
• (b) Customer Content. Outside counsel guidelines and invoices you upload (“Customer Data”), which may include personal data about your outside counsel personnel — e.g., timekeeper names, roles, hours, billing rates, and narratives of outside counsel’s work — that you control as between you and 42B.
• (c) Payment Data. Billing name and limited transaction metadata. Full card numbers are collected and processed by our payment processor, Stripe, Inc., not by 42B directly.
• (d) Usage and Device Data. Log data, IP address, browser type, pages viewed, and similar technical information, collected automatically.
• (e) Cookies and Similar Technologies. See Section 6 below.

2. How We Use Information

We use the information above to: provide, operate, and improve the Service; process payments; generate and refine invoice-compliance rule engines and AI-driven review output for the Customer that submitted the data; communicate with you about the Service; secure the Service and prevent abuse; and comply with legal obligations.

3. AI Processing

Customer Data is processed by artificial intelligence and machine learning models — including models operated by third-party AI providers acting as our subprocessors — to generate compliance rules and review invoice line items against those rules. Output is decision-support for the Customer's own review; 42B does not use Customer Data to make final billing decisions on a Customer's behalf, and a Customer's personnel remain responsible for final determinations. AI providers do not train on Customer’s data nor do they retain any of Customer’s data - inputs or outputs.

4. How We Share Information

We do not sell personal information. We share information with:

• (a) Subprocessors who perform services on our behalf, currently including: Stripe (payments), Google Workspace (business email/calendaring), Microsoft Azure (hosting provider), and Google Gemini (AI model provider). The terms governing how these subprocessors may access data, and how we manage changes to this list, are set out in our Data Processing Addendum (“DPA”), available at https://42B.ai/dpa.
• (b) Professional advisors (legal, accounting) as needed.
• (c) Successors in the event of a merger, acquisition, or asset sale, subject to this Policy or a materially similar one.
• (d) Authorities where required by law or to protect rights, safety, or property.

5. Data Retention

We retain Account Data and Customer Data for as long as needed to provide the Service and for a reasonable period after account closure for legal, tax, and legitimate business purposes, after which it is deleted or de-identified, subject to any longer retention period agreed with a Customer under a DPA.

6. Cookies and Similar Technologies

• (a) Strictly Necessary Cookies. Required for login, security, and core site functionality. These cannot be disabled without affecting the Service.
• (b) Analytics Cookies. Help us understand how the site and Service are used, so we can improve them.
• (c) Your Choices. You can manage cookies through your browser settings, including blocking or deleting them. We do not use cookies for third-party advertising or cross-site tracking.

7. Your Rights

Depending on your location, you may have rights to access, correct, delete, or port your personal data; object to or restrict certain processing; and, for California residents, rights under the CCPA/CPRA to know, delete, correct, and opt out of sale or sharing (we do not sell or share personal information as those terms are defined by the CCPA). Other U.S. states may provide similar rights. To exercise a right, contact us at legal@42B.ai. We will respond within the timeframe required by applicable law.

Where 42B acts as a processor on behalf of a Customer with respect to Customer Data (e.g., personal data of a Customer's outside counsel personnel), requests regarding that data should generally be directed to the relevant Customer, and we will assist the Customer as described in our DPA found at https://42B.ai/dpa.

8. Data Security

We use technical and organizational measures designed to protect information against unauthorized access, disclosure, alteration, and destruction. No system is completely secure, and we cannot guarantee absolute security.

9. Children's Privacy

The Service is a business tool intended for business use and is not directed to, and should not be used by, individuals under 18.

10. Changes to This Policy

We may update this Policy from time to time. Material changes will be posted on this page with an updated effective date, and, where required by law, notified directly.

11. Request Data

Fill in this form to request data and 42B will review your request.

12. Contact Us

42B.ai, Inc. — 1403 Saxony Lane, Houston, TX 77058 — legal@42B.ai