Privacy Policy

Mike-1 is an AI lawyer web app run by ASI Labs, Inc., doing business as Index Law, a Delaware corporation and a Y Combinator company ("Index Law", "we", "us").

We are the controller of the personal data described here. For business customers who upload documents about other people, we process that content on your behalf and under your instructions.

Mike-1 is a technical research preview. Some features are simulated, and we say so below where it matters.

Questions about privacy? Email q@indexlaw.com.

We collect only what we need to run Mike-1.

• Account details: your name, email address and password (stored hashed by our authentication provider).
• Company profile: your company name and the details you add about your business, such as jurisdiction, house style and playbooks.
• Vault documents: files and text you upload, and the drafts, redlines and memos Mike-1 creates for you.
• Chat questions: what you ask Mike-1 and the answers it gives.
• Signing records: names, email addresses and roles of the people on a signing envelope, and the steps they take.
• Audit logs: what happened and when, including IP address and browser user agent for signing events.
• Technical data: basic logs and usage counts needed to run, secure and debug the service.

We do not use advertising cookies or third party analytics. Your browser stores a sign-in session and some unsent drafts locally so the app works.

We use your data to provide Mike-1 and keep it safe. Under UK and EU GDPR our lawful bases are:

• Contract: to create your account, store your Vault, answer your questions and run signing flows.
• Legitimate interests: to secure the service, prevent abuse, fix bugs and improve Mike-1 in ways you would expect.
• Legal obligation: to keep records we must keep and to answer lawful requests.
• Consent: where we ask for it. You can withdraw consent at any time.

Do not upload special category data (such as health data) or criminal records data unless you need to for your legal matter and have a lawful basis to share it.

To answer you, Mike-1 sends your question and the relevant parts of your documents and company profile to AI model providers. Their models generate the response, which we return to you.

• We do not use your documents or questions to train our own models.
• We only use AI providers whose terms do not permit them to train their models on your content.
• We send only what is needed for the task you asked for.
• AI output can be wrong. Check it before you rely on it.

Mike-1 does not make decisions about you that have legal or similarly significant effects. It drafts and advises; you decide.

We do not sell or rent your personal data, and we do not share it for cross-context behavioural advertising.

We share data only with service providers who help us run Mike-1, under contracts that limit their use of it:

• Database, authentication and file storage: Supabase.
• Hosting and transactional email: our hosting provider.
• AI model providers, reached through OpenRouter first, with a backup AI gateway.
• Legal research web search, when enabled: OpenRouter, using the Exa search engine. Only search queries are sent, not your documents.

We may also share data if the law requires it, to protect rights and safety, or as part of a merger or sale of our business, with notice to you.

When you start a signing flow, the people you add will see the document and the names and emails on it.

We are based in the United States and our providers may process data in the US and other countries.

Where UK or EU data leaves those regions, we rely on safeguards such as the EU Standard Contractual Clauses, the UK Addendum or IDTA, or the EU-US Data Privacy Framework and its UK extension where the provider is certified.

• Account data: while your account is open.
• Vault documents and chats: until you delete them or close your account.
• Backups: deleted data is purged from backups within 30 days.
• Audit logs and agreement records: 6 years, so we can show what happened and what you agreed to.

We use encryption in transit and access controls so your company's Vault is private to your company. Only people who need access to run the service can reach your data.

No system is perfectly secure. If you think your account has been compromised, email q@indexlaw.com straight away.

Depending on where you live, you can ask us to:

• Access or get a copy of your personal data.
• Correct it.
• Delete it.
• Restrict or object to how we use it.
• Move it to another service (portability).
• Withdraw consent where we rely on it.

California residents also have the right to know, delete and correct, and to opt out of sale or sharing. We do not sell or share personal data, and we will not treat you differently for using your rights.

To use your rights, email q@indexlaw.com from your account email. We may need to verify who you are, and we reply within one month (45 days under California law). An authorised agent can ask for you with your written permission.

If you are in the UK or EU, you can complain to your data protection authority, such as the UK ICO. We would like the chance to help first.

Mike-1 is not for anyone under 18. We do not knowingly collect children's data. If you think a child has given us data, email q@indexlaw.com and we will delete it.

We will update this policy as Mike-1 changes. We will change the version number and date at the top, and tell you in the app or by email before material changes take effect.

ASI Labs, Inc., doing business as Index Law. Email: q@indexlaw.com.