Privacy Policy

Effective: 5th August 2026

Jude (referred to in this Privacy Policy as “Jude”, “we”, “our” or “us”) is an artificial intelligence (AI) driven multi-purpose workspace platform for legal professionals (Platform). Jude is owned and operated by Jude Platform Limited.

This Privacy Policy forms part of our Terms of Service. In this Privacy Policy, “you” or “your” refers to the Law Firm that you represent. “Personal information” means information about an identifiable individual, as defined in the Privacy Act 2020 of New Zealand (Privacy Act) or, where applicable, in the equivalent Applicable Data Privacy Laws in the jurisdiction in which you are subject. Terms not otherwise defined in this Privacy Policy have the meaning set out in our Terms of Service.

This Privacy Policy relates to two categories of Personal Information we handle in connection with the Platform:

• Account Data — personal information relating to your relationship with Jude, including the names and contact details of your Users and administrators, billing and payment information, support communications and usage and telemetry data relating to your use of the Platform and/or the Services. We collect and handle Account Data for our own purposes as described in this Privacy Policy; and
• Content Personal Information — personal information contained in Content that you Input to, or generate through, the Platform, which may include information about your clients and their matters. We handle Content Personal Information on your behalf and on your instructions in accordance with our Terms of Service, this Privacy Policy and (where applicable) any DPA between us.

This policy explains how we collect, hold, use, disclose and protect Personal Information in line with our obligations under the Privacy Act and any other Applicable Data Privacy Laws which apply to your use of the Platform. If you have any questions about this policy, please contact us on support@jude.law.

In accordance with our Terms of Service, we require and rely on you to notify your clients about the matters in this Privacy Policy.

What Personal Information we collect

We may collect and hold Personal Information, including through your Inputs and prompts to the Platform, in the following ways:

Account Data: We collect this from you directly (for example, when you register or communicate with us) and generate it through your use of the Platform. It may include:

• names, roles and business contact details of authorised Users;
• authentication and access credentials;
• billing and payment information;
• support and other communications, correspondence and feedback; and
• usage, telemetry, log and diagnostic data relating to your use of the Platform.

Content Personal Information: We handle Content Personal Information as it appears in Content that you Input to, or generate through, the Platform. We do not select or determine what Content Personal Information you provide — that is your responsibility, and we recommend that you exercise professional judgment about the information you Input to the Platform in accordance with our Terms of Service.

How we use Personal Information

We use Account Data to:

• provide, administer, maintain and operate the Platform and our Services to you, and to verify or maintain the quality, security, and integrity of our Services;
• communicate with you about the Platform, including responding to support and other requests;
• manage billing, payment and account administration;
• comply with legal obligations and processes, and to protect our rights, and/or those of our affiliates, you or other third parties; and
• develop, test and improve our Platform and Services (including by introducing new programs and services).

We handle Content Personal Information solely to provide the Platform and the Services to you in accordance with this Privacy Policy and (where applicable) any DPA between us. In particular, we will not use, and will not permit any Service Provider to use, Content Personal Information to train, fine-tune, evaluate or otherwise improve any foundational or other AI model.

Who we disclose your information to

To provide the Platform and our Services to you, we may disclose the information you Input to the Platform, including Personal Information, to the following third parties:

• Our Service Providers who are listed in the section entitled Service Providers at the end of this Privacy Policy. These Service Providers perform tasks on our behalf, including AI services, data hosting, cloud-storage, email communications, web analytics services, and other information technology services.
• Governmental or regulatory bodies (or any relevant third parties) if required by Applicable Laws, to protect and defend our rights, or to enforce our terms and policies. Unless prevented by law, we will notify you of any such disclosure.
• Any affiliate of ours, meaning any entity that controls, is controlled by, or is under common ownership with us. Our affiliates will only collect, use, disclose or retain Personal Information in a manner consistent with this Privacy Policy.
• A purchaser of our business or company, or any company or entity that we merge some or all of our business or assets with.

How our Service Providers use your information

We engage third party Service Providers to provide services to us and perform tasks on our behalf in connection with the Platform.

Our Service Providers’ use of Personal Information is governed by their own terms of service, privacy policies and applicable data processing agreements with us. Links to our Service Providers’ terms and privacy policies are available in the section entitled Service Providers at the end of this Privacy Policy.

Each Service Provider may disclose Personal Information and other data to their authorised sub-processors to carry out processing services (including, for example, storage, indexing, search, and retrieval). Our Service Providers require their sub-processors to be bound by the same or similar data protection obligations as their own obligations to us. Links to the current sub-processors engaged by each Service Provider are available on our website.

We only permit Service Providers to process Content for the purpose of providing services to us in connection with the Platform. Without limiting the foregoing, we will not permit any Service Provider to use Content to train, fine-tune, evaluate or otherwise improve any foundational or other AI model. Where technically feasible for the class of Service Provider concerned (in particular, for foundational AI model providers), we engage Service Providers on terms that provide for zero retention of Content beyond the period necessary to perform the immediate services requested.

Where possible, we use reasonable attempts to:

• aggregate or de-identify Personal Information before we use or share this information; and/or
• move your Content, including Personal Information, into our Virtual Private Cloud. This means that, while some Service Providers may carry out their services on your data (including Personal Information), they are unable to access this data or store it on their systems. When we move your data into our Virtual Private Cloud, the data is stored, processed and saved within our cloud environment only.

You acknowledge and agree that, while we make reasonable attempts to carry out the above activities, we are unable to do so in respect of all Service Providers.

How we store and secure your information

Security of information is very important to us. We take all reasonable precautions to protect your information from misuse, loss, unauthorised access, disclosure or modification. Some of the ways we protect your information include:

• premises security
• storing information in access-controlled systems
• encrypting data in transit and at-rest; and
• providing Privacy Act training to our staff.

We host electronic data, including Personal Information, on cloud infrastructure provided by Amazon Web Services. We select the geographic region in which data is hosted based on your location where reasonably practicable (see next section “Disclosure of your information overseas” below and any regional appendix to this Privacy Policy applicable to you).

Disclosure of your information overseas

Our Service Providers (and their sub-processors) may be located outside the country in which you are domiciled and may process and store Personal Information in various countries. We take reasonable steps to ensure that any transfer of Personal Information to, or processing of Personal Information by, a Service Provider outside your country of domicile is subject to appropriate safeguards under Applicable Data Privacy Laws, including (where required) contractual clauses, adequacy decisions, data bridges or other mechanisms recognised under Applicable Data Privacy Laws.

Where there is a DPA between us, specific transfer mechanisms applicable to Content Personal Information may be set out in that DPA. Additional details on transfers of your Personal Information may be set out in any regional appendix to this Privacy Policy applicable to you.

Despite all of our security measures, we cannot prevent, and are not responsible for, interception or “hacking” of information by unauthorised third parties, or any data breach by our Service Providers. We will comply with our obligations under the Privacy Act if we become aware of any data breach, including notifying you and the Privacy Commissioner as required. If you believe a privacy breach may have occurred, please contact us as soon as possible using the contact details below.

Retention of information

Account Data: We retain Account Data for as long as you maintain an active registration with us, and for a reasonable period thereafter for legal, regulatory and business record-keeping purposes.

Content Personal Information: We retain Content Personal Information in accordance with your instructions as controller of that information. On your request (or a request of an individual, directed to you), we will delete or return Content Personal Information within 30 days, unless we are required to retain it by law or contract or unless there is a DPA between us, in which case the specific retention arrangements applicable to Content Personal Information may be set out in that DPA.

Access to and correction of information

As between you and us, it is your responsibility to ensure that any Personal Information you Input to the Platform or provide to us is accurate, complete and up to date.

Subject to Applicable Data Privacy Laws, you and your Users have the right to request access to, and correction of, any Account Data we hold. Applicable Data Privacy Laws may also grant you additional rights (including rights to erasure, restriction of processing, portability and objection) as more particularly described in any regional appendix to this Privacy Policy applicable to you. To exercise any of these rights, please contact us at support@jude.law.

In respect of Content Personal Information, the rights of the individuals to whom that information relates are exercisable by them against you (as controller of that information) rather than against us. Where we receive a request directly from an individual in respect of Content Personal Information, we will refer the request to you and cooperate with you as required by any DPA between us.

Updates to this policy

We may update this Privacy Policy from time to time. Any changes will apply from the date we post the updated policy on our website. We will notify you of any key changes.

If you do not agree to any updated privacy terms, you must immediately stop using our Platform and Services and notify us. Your continued use of or access to the Platform after any changes to our Privacy Policy indicates your acceptance of the updated terms.

Contact information and Privacy Commissioner

We take your concerns seriously. If you need assistance accessing or updating your personal information, or your clients’ Personal Information, or if you have any concerns about privacy, or the way we use or collect your personal information or your clients’ Personal Information, please email support@jude.law.

If you are not satisfied with our response to any privacy related concern you may have, you can contact the Office of the Privacy Commissioner online at www.privacy.org.nz.

If you are subject to Applicable Data Privacy Laws of a jurisdiction other than New Zealand, you may also have the right to lodge a complaint with the data protection authority of the jurisdiction to which you are subject. Details of complaint routes applicable to your jurisdiction may be set out in any regional appendix to this Privacy Policy.

Service Providers

The following table lists our current Service Providers, what we use them for, and links to their relevant terms and policies.

Schedule - Regional Privacy Terms

This Schedule sets out additional and overriding privacy terms that apply to Law Firms domiciled in the countries specified in each Part below. The application, priority and interpretation of this Schedule are as set out in Part A. Terms defined in the main body of the Privacy Policy have the same meaning when used in this Schedule, unless the context otherwise requires.

Part A — Interpretation

1. Application: This Schedule forms part of the Privacy Policy. Where you are a Law Firm domiciled in a country to which a Part of this Schedule applies, the provisions of that Part apply to our handling of Personal Information relating to you and your Users in addition to (and, in the event of any inconsistency, in priority to) the provisions of the main body of the Privacy Policy.
2. References. In this Schedule, references to a “Part” or “paragraph” are references to a Part or paragraph of this Schedule. References to the “Privacy Policy” are references to the main body of the Privacy Policy.

Part B — United Kingdom

1. Application: This Part B applies to Law Firms domiciled in the United Kingdom.

2. Interpretation: In this Part B:

   DPA 2018 and UK GDPR have the same meanings given to them in the UK Regional Terms;

   ICO means the United Kingdom Information Commissioner’s Office; and

   UK Regional Terms means the Regional Terms (as defined in our Terms of Service) applicable to Law Firms domiciled in the United Kingdom.

3. Applicable Data Privacy Laws applicable to you: For the purposes of the Privacy Policy, “Applicable Data Privacy Laws” include, without limitation, the UK GDPR and the DPA 2018.

4. Our roles under the UK GDPR: For the purposes of the UK GDPR:

   • in respect of Account Data, we act as a controller (as defined in the UK GDPR); and
   • in respect of Content Personal Information, we act as a processor on your behalf, and you act as the controller. The terms on which we process Content Personal Information are set out in the DPA between us.

5. Legal bases for processing Account Data: We rely on the following legal bases under Article 6 of the UK GDPR to process Account Data:

   • performance of a contract, or steps prior to entering into a contract (Article 6(1)(b)) — for account administration, provision of the Platform and Services, billing and payment, and support communications;
   • our legitimate interests, or those of a third party, except where overridden by your interests, rights and freedoms (Article 6(1)(f)) — for security, fraud prevention, quality assurance, product development and improvement, and product analytics;
   • compliance with a legal obligation (Article 6(1)(c)) — for financial, regulatory and legal record-keeping and compliance; and
   • consent (Article 6(1)(a)) — where you have given consent to processing for a specific purpose (for example, marketing communications), which you may withdraw at any time.

6. Hosting of your Content: Content Personal Information provided to the Platform by or on behalf of your Law Firm is hosted at rest by us in Amazon Web Services data centres currently located in Ireland.

7. International transfers: In providing the Services, certain Service Providers may process Personal Information (including Content Personal Information) outside the European Union. Where this occurs:

   • we implement an appropriate transfer mechanism for each such transfer in accordance with the UK GDPR, including (as applicable) the UK International Data Transfer Agreement, the UK Addendum to the EU standard contractual clauses, or reliance on an adequacy decision or data bridge; and
   • the specific transfer mechanisms applicable to Content Personal Information are set out in the DPA between us.

8. Your rights under the UK GDPR: Under the UK GDPR, you have the following rights in respect of Account Data we hold about you and your Users:

   • the right of access (Article 15);
   • the right to rectification of inaccurate personal data (Article 16);
   • the right to erasure (Article 17), subject to the exceptions in that Article;
   • the right to restriction of processing (Article 18);
   • the right to data portability (Article 20), where processing is based on consent or contract and carried out by automated means;
   • the right to object to processing based on legitimate interests (Article 21);
   • the right not to be subject to a decision based solely on automated processing that produces legal or similarly significant effects (Article 22); and
   • where processing is based on consent, the right to withdraw that consent at any time without affecting the lawfulness of processing based on it before withdrawal.

   To exercise any of these rights, please contact us at support@jude.law.

9. Rights in respect of Content Personal Information: Rights in respect of Content Personal Information (including Personal Information of your clients) are exercisable by the relevant individual against you (as controller) rather than against us. Where we receive a request directly from an individual in respect of Content Personal Information, we will refer the request to you and cooperate with you as required by the DPA between us.

10. Complaints: If you have concerns about our handling of your Account Data, we encourage you to contact us first at support@jude.law. You also have the right to lodge a complaint with the ICO at ico.org.uk, or by post to Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF.

11. Our UK GDPR representative: As we are not established in the United Kingdom, we have appointed VeraSafe as our representative in the United Kingdom under Article 27 of the UK GDPR. VeraSafe can be contacted in addition to or instead of support@jude.law, in respect of matters relating to our processing of Personal Information under the UK GDPR.

    To make such an inquiry, please contact VeraSafe using this contact form: https://verasafe.com/public-resources/contact-data-protection-representative or via telephone at: +44 (20) 4532 2003.

    Alternatively, VeraSafe can be contacted at:

    VeraSafe United Kingdom Ltd.
    37 Albert Embankment
    London SE1 7TL
    United Kingdom