Version 1 October 2026
CASE BY CASE SOFTWARE DESIGN CO. L.L.C (realLaw AI, we, us) operates reallaw.ai, app.reallaw.ai, the realLaw software platform and integrations (Service). This Policy explains how we use personal data and how to exercise your rights.
We are a Dubai company, trade licence 1319985, at Office 2105-E-23, Citadel Tower, Business Bay, Dubai, United Arab Emirates. Contact us about privacy at [email protected] or this address.
We are the controller for account administration, billing, support, security, marketing and our own product analysis. Where we process personal data on an organisation's documented instructions, we act as its processor or subprocessor under the applicable Data Processing Agreement (DPA). Our own use for product improvement requires a separate lawful basis.
For records an organisation controls, contact that organisation or ask us for assistance. Mandatory rights under applicable UAE, DIFC or ADGM data protection law remain unaffected.
| Category | Information and sources |
|---|---|
| Account and organisation | Names, contact details, account type, organisation, role and authentication information from you or an authorised organisation contact. A sign-in provider supplies the identifiers and profile details permitted by your settings, not your external password. |
| Service content | Questions, conversation history, files, tasks, feedback and resulting answers and materials. Content may include personal, confidential or sensitive information about you or others. |
| Transactions | Subscriptions, billing details, invoices, payment status, transaction references and limited payment-method information. Our payment provider processes card details entered in its payment form. |
| Technical activity | IP address, device and browser information, approximate location, timestamps, identifiers, feature activity, document requests, errors and plan usage. Identifiers may reveal multiple accounts and suspected abuse of free access. |
| Session recordings | Activity and visible page content, including chat text, linked to a user or session. Recordings are not necessarily anonymous or fully masked. |
| Communications | Enquiries, support correspondence, requested materials and communication preferences provided through our contact channels. |
Some account, content and payment information is needed for requested functions; without it, those functions may be unavailable.
External AI integrations send us tool arguments, such as keywords, document references and filters, with relevant account and technical information. We log document requests and tool operations. Arguments may contain personal data or part of a question; connecting an integration does not give us the full external conversation history.
We use personal data to provide searches, AI and document functions; manage accounts and subscriptions; answer enquiries; prevent misuse; meet legal, accounting and tax obligations; and establish, exercise or defend legal rights.
We also review identifiable realLaw chat questions and answers to assess quality and improve prompts and retrieval, including unrated answers. Session recordings help us understand usage and investigate problems. We do not use private chats, submitted files or information derived from them, including through recordings, to target advertising, build marketing profiles or generate sales leads, or disclose them to others for those purposes. Contact and usage information may be used for marketing and advertising.
We rely on contractual necessity where the individual is a party to the relevant contract, legal obligations for required records, and the protection of legal claims where applicable. Where no applicable exception permits processing without consent, we require consent. For proportionate fraud prevention and network security, we rely on legitimate interests only where applicable law permits and the required assessment supports that ground. Where we act as a processor, the controller determines the lawful basis.
Product improvement, optional analytics, recording and marketing require separate consent where required by law. Accepting the User Agreement or rating an answer does not provide that consent or consent for others mentioned in a chat. Requesting materials or support does not subscribe you to unrelated promotions. We may use anonymous statistics.
Requested AI operations may send questions, conversation context and document extracts to our AI providers. For realLaw chat, model fine-tuning and voluntary sharing of chat data for our AI provider's model training or improvement programmes are disabled. This does not prevent the human review described above or necessary provider processing and retention for delivery, security or legal compliance.
Our personnel with administration-panel access can read identifiable chats for delivery, support, security and quality analysis. We can identify which administrator viewed a conversation.
An external AI platform you choose controls its own conversation storage, training choices and settings. Our realLaw chat commitments do not govern that platform. Disconnecting an integration or closing a realLaw account does not delete its independently held copies.
We use providers for hosting, storage, AI, payments, authentication, communications, customer administration, website delivery, diagnostics, analytics and advertising. Their access depends on their function; they may act as processors or independent controllers for their own payment, platform, security or legal purposes. Customer-administration and mailing providers receive contact information, not chats or files, under our current workflow.
We may disclose necessary data to confidential professional advisers, competent authorities where required, and a prospective or actual business successor under appropriate safeguards. We do not sell private chats or files or make them public because they are submitted to the Service.
Personal data may be processed outside the UAE or, where applicable, outside the DIFC or ADGM. For restricted transfers, we rely on an adequacy decision recognised under applicable law or, where none applies, appropriate contractual safeguards, including approved standard data protection clauses where required. Contact us for details or a copy of the safeguards relevant to your data, subject to lawful confidentiality restrictions.
We retain personal data only as long as needed for its purpose. Account, chat and file retention depends on continued account use and requested history or functions; recordings and technical records on their quality, troubleshooting, security or abuse-prevention purpose; correspondence on the enquiry and necessary follow-up. Marketing retention is subject to section 8.
Required financial and tax records are kept for statutory periods, including at least seven years after the relevant tax period where UAE corporate-tax requirements apply. Necessary consent and agreement records and evidence for claims are kept while needed for those purposes. Such retention does not justify keeping unrelated content.
We delete or anonymise personal data when it is no longer needed and apply retention and deletion requirements to copies held for us, including backups. Cancellation of paid access alone does not close the account or erase its history. Request account closure or erasure at [email protected]. Applicable legal deadlines and DPA requirements take priority.
Safeguards include encrypted transmission between client and server, backups and the ability to identify administrators who access chats. We respond to personal data breaches as required by law. No service can guarantee absolute security. Report suspected unauthorised access to [email protected].
Depending on applicable law, you may request information, access, correction, erasure, a copy or transfer of your data, restriction or cessation of processing, objection and review of qualifying automated decisions. You may withdraw consent without affecting prior lawful processing. You may also complain to the UAE Data Office or, where applicable, the DIFC Commissioner of Data Protection or the ADGM Commissioner of Data Protection.
Send requests to [email protected] with enough information to identify the relevant account or record and requested action. We may seek necessary identity verification and will respond within the applicable period, explaining any lawful restriction. Where we act as a processor, we assist the responsible controller as required.
You can unsubscribe from promotions. Necessary service, billing or security messages may continue on a separate lawful basis.
We publish the current version of this Policy, notify you of material changes and obtain any required consent before changed processing begins. Updates do not override an applicable DPA or mandatory rights.