Privacy Policy
Your legal matters are sensitive. Here is, plainly, what we do with them.
Last updated: October 23, 2026
In short
- We sell no data and run no targeted advertising.
- Only you, the lawyer you are matched with and the reviewer assigned to your case can see it. The Legitym team does not open your cases.
- Legitym trains no AI model on your data.
- You can export your data or delete your account yourself, at any time.
Data controller — ICRAFT SAS, 58 rue de Monceau, 75008 Paris, France (RCS Paris 992 314 237), publisher of Legitym. For any question or request: privacy@legitym.com.
Our providers
Each one receives only what its task requires and acts on our instructions. We also disclose data when the law requires it.
| Provider | Role | Location |
|---|---|---|
| Google Cloud | Website hosting | Belgium (EU) |
| Neon | Database | Germany (EU) |
| Cloudflare | Document storage, domain name | EU (documents) |
| Upstash | Technical cache, abuse protection | Possibly outside the EU |
| Mistral AI | Assistant and case analysis | France (EU) |
| Google Gemini | Assistant, when Mistral AI is unavailable | Possibly outside the EU |
| Stripe | Payments | Possibly outside the EU |
| Resend | E-mail delivery | Possibly outside the EU |
| PostHog | Audience measurement | EU |
| Sentry | Error tracking | Germany (EU) |
| Google Cloud | Introductory messages to lawyers (ICRAFT in-house tool) | United States |
| Google Calendar | Availability, for lawyers who connect it | Possibly outside the EU |
| Google Cloud, Cloudflare | Visit attribution, with your consent (ICRAFT in-house tools) | Possibly outside the EU |
Professional secrecy
- A case is visible only to its author, the matched lawyer and the reviewer assigned to it. Legitym administrators have no access to case documents.
- Data is encrypted in transit and on our servers.
- The documents a lawyer uploads to have their profile verified are seen only by them and by the team that verifies the profile.
- Access to the administration area requires a verification code at every session.
Your rights
Write to privacy@legitym.com: we reply within one month.
Access and portability
Get a copy of your data, in a reusable file.
Rectification
Correct inaccurate data.
Erasure
Have your account and your data deleted.
Restriction and objection
Freeze a processing, or object to those based on our legitimate interest.
Withdrawing consent
Withdraw your consent at any time, without affecting what came before.
After your death
Tell us what should happen to your data.
If our answer does not satisfy you, you can lodge a complaint with the CNIL (www.cnil.fr).
In detail
Data we collect
• Account: name, e-mail, language, password (stored in irreversible form). • Cases: the facts, documents and messages you submit. They may contain sensitive data, which you choose to entrust to us. • Lawyers: bar, specialities, verification documents, availability. • Payment: handled by our provider, we never see your card. • Technical: IP address, browser, pages viewed.
Why, and on what basis
• Providing the service (account, assistant, case analysis, matching, appointments, payments): performance of the contract. • The sensitive data in your cases: you entrust it to us to assert your rights (art. 9.2.f GDPR). • Security, abuse prevention, audience measurement, improving the assistant: our legitimate interest. • Visit attribution, posts and alerts by e-mail: your consent. • Invoicing: legal obligation.
Artificial intelligence
The assistant and case analysis rely on Mistral AI, and on Google Gemini when Mistral AI is unavailable. The text sent is used to produce the answer. Legitym trains no model on your data. No decision with legal effects on you is made automatically: answers are an aid, the decision is yours or your lawyer's.
Transfers outside the European Union
When a provider marked “possibly outside the EU” processes data outside the Union, the transfer is covered by the EU–US Data Privacy Framework if the provider has joined it, or otherwise by the European Commission's standard contractual clauses.
How long we keep data
• Account, cases, documents and assistant conversations: as long as the account exists. They are erased as soon as you delete it; only a record of the deletion is kept. An account unused for 3 years may be deleted the same way, after a notice e-mail 30 days before: signing in is enough to keep it. • Security and activity logs (sign-ins, IP address): 12 months. • Appointment requests that were never accepted: 90 days. • Invoices: 10 years, as French commercial law requires. • E-mail unsubscriptions: the record of your refusal, so we never write again. • Your tracker choices: 6 months. Details on the Cookies page.
Conversations with the assistant
When signed in, your exchanges with the assistant are kept with your account to check and improve its answers; you can ask for them to be erased at any time. Without an account, their content is not kept: only an anonymous counter is.
Reports on court decisions
When you report an anonymization defect in a decision shown on our case-law pages, we collect your email address, your capacity (party, lawyer, person named, other), your details and, where applicable, the reported first or last name. This data is used solely to handle the request under the terms of use of the Cour de cassation open data base: provisional masking of the content and transmission of the request to the Cour de cassation (anonymisation.sder.courdecassation@justice.fr), without your email address. The reported name is erased once the decision has been corrected; the request is kept as long as needed to follow it up. You can also write to the Cour de cassation directly.
Blog articles by email
If you subscribe to our articles — by ticking the box at sign-up, through the form under an article or from your settings — we keep your email address, your language and the date of your request. The subscription only becomes active once your address is confirmed. We use this address only to send you our articles and share it with no one other than our email delivery provider. Every email contains a one-click unsubscribe link; after you unsubscribe, we only keep a record of your refusal so that we no longer write to you.
Case-law alerts by email
If you create an alert on a code article from a decision page, we keep your email address, the article you follow and the date of your request. The alert only becomes active once your address is confirmed. We use this address solely to notify you of new decisions citing that article and share it with no one other than our email delivery provider. Every email contains a link that stops your alerts in one click; after that, we only keep a record of your refusal so that we no longer write to you.
Lawyer directory
If you are a lawyer, your profile in our directory may have been created without you giving us your data: we took it from the national lawyer directory published by the Conseil national des barreaux (CNB) and, for your contact details, from your firm's public website. This covers your name, your bar, your specialisations, your business address and, where listed there, your professional contact details. We use them so that the public can find a lawyer and, where relevant, to introduce Legitym to you in a professional message. This processing is based on our legitimate interest (Article 6(1)(f) GDPR); this notice is given under Article 14. The data is kept for as long as you appear in the CNB directory and refreshed with each new publication. You can claim your profile at any time to correct it, or object to the processing by writing to privacy@legitym.com: your profile is then removed from the directory, search, the sitemap and any outreach, all your contact details are erased, and only your CNB identifier is kept so that the profile is never recreated by an update. You may also lodge a complaint with the CNIL (www.cnil.fr).
Minors
Legitym is not intended for people under 15.
Changes
If we make a significant change, we notify you by e-mail at least 30 days before it takes effect.