Apply for Private Beta Private Beta

Privacy Policy

Privacy Policy

Referent - referent.law
Last updated: July 4, 2026

This Privacy Policy explains how AI Lawtech Sp. z O.O., Henryka Sienkiewicza 36 / 5, 26-600 Radom, Poland (“Referent”, “we”, “us”) collects, uses, stores, and protects information when you visit our websites at referent.law, use the Referent platform at app.referent.law, and related services (together, the “Service”). Referent is a practice-management and AI-assistant platform for legal professionals.

If you do not agree with this policy, please do not use the Service.

  1. Who we are

Data controller: AI Lawtech Sp. z O.O.
Contact: contact@referent.law
Website: https://referent.law

AI Lawtech Sp. z O.O. also operates AI Lawyer (ailawyer.pro). Where this policy refers to our “related products”, it means products operated by the same company.

  1. Information we collect

Account information. Name, email address, password hash, organization name, and role - provided when you create an account or accept an invitation.

Workspace content. Clients, matters, notes, tasks, documents, time entries, and other records you or your team create in the Service.

Connected Google account data (only if you choose to connect a Google account - see Section 3).

Usage and device data. Log data, IP address, browser type, pages viewed, and product analytics events. We use this to operate, secure, and improve the Service.

Website visit and marketing data. When you visit our websites, we and the providers listed in Section 7 collect information about your visit (pages viewed, referral source, campaign parameters, approximate location derived from IP, and cookie identifiers), subject to your cookie choices described in Section 7.

Communications. Messages you send to support.

  1. Google user data

If you connect your Google account, Referent requests access to the following Google services. We only request scopes needed for features you enable:

Google data: Gmail
What we access: Email messages and attachments in the connected mailbox
Why: To display your correspondence inside Referent, link emails to the relevant clients and matters, surface unread/important items, and let our AI assistant summarize and search your correspondence at your request

Google data: Google Calendar
What we access: Calendar events
Why: To display your schedule, sync events both ways, and let the assistant create and find events

Google data: Google Drive
What we access: File metadata and the content of Google-native documents
Why: To show and search your files, link them to matters, and let the assistant find documents at your request

How we handle Google user data:

  • Google user data is displayed to you in the Service, processed to link items to your clients and matters, and indexed (including via vector embeddings) so that you and the AI assistant can search it.
  • Google user data is stored encrypted at rest in our database hosted on Google Cloud (region: europe-west1, EU).
  • We retain Google user data only while the relevant Google account connection is active. When you disconnect an account or delete your Referent account, the associated synced data is deleted from our systems.
  • We do not sell Google user data. We do not share it with third parties except the subprocessors listed in Section 6, acting on our instructions. We do not use it for advertising. Google user data is never used for the marketing and advertising measurement described in Section 7.
  • AI/ML disclosure: we do not use Google user data to develop, improve, or train generalized artificial intelligence or machine-learning models. Google user data is processed by AI models only at your request, to provide features of the Service to you (for example, summarizing an email thread you opened or answering your question about your own correspondence).
  • Human access to Google user data is not permitted except (a) with your explicit consent for a specific support case, (b) where necessary for security purposes (e.g., investigating abuse), or (c) where required by applicable law.

Limited Use disclosure: Referent’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

You can disconnect a Google account at any time in Settings → Integrations, and additionally revoke Referent’s access at myaccount.google.com/permissions.

  1. How we use information
  • Provide, operate, and maintain the Service;
  • Link correspondence, events, and files to your clients and matters;
  • Provide AI-assisted features you invoke (summaries, drafting, search, suggestions);
  • Secure the Service, prevent abuse, and debug issues;
  • Communicate with you about the Service (transactional emails);
  • Send marketing communications about our products, where permitted (see Section 8), with an opt-out in every message;
  • Measure the performance of our websites and marketing campaigns (see Section 7);
  • Comply with legal obligations.

We do not sell personal data. We do not display third-party advertising inside the Service, and workspace content is never used for advertising.

  1. Legal bases (EEA/UK users)

Where the GDPR applies, we process personal data on the following bases: performance of a contract (operating the Service for you), legitimate interests (security, product improvement, and direct marketing of our own products to existing users of our products, with the right to object at any time), consent (connecting Google accounts, and non-essential cookies for visitors in the EEA/UK/Switzerland; you may withdraw consent at any time), and compliance with legal obligations.

Note for legal professionals: for the content of your workspace (including synced correspondence), you and your firm act as the data controller of your clients’ personal data; Referent acts as a processor on your documented instructions. A separate Data Processing Agreement is available on request at contact@referent.law.

  1. Subprocessors and service providers

We use a small number of service providers to operate the Service, each bound by data-protection obligations:

Google Cloud Platform — Hosting and database (EU region)
Nango (nango.dev) — OAuth connection management for integrations (SOC 2 Type II)
AI model providers (via OpenRouter) — Processing of content you submit to AI features; not used to train their models
PostHog — Product and website analytics and error monitoring
Resend — Transactional email delivery
Brevo — Marketing email delivery and contact management
Google (Tag Manager, Analytics, Ads) — Website analytics and advertising measurement (see Section 7)
Meta Platforms — Advertising measurement and audiences (see Section 7)

  1. Cookies, analytics and advertising

Our websites use cookies and similar technologies for three purposes:

  • Essential. Required for the sites and the Service to function (for example, authentication and security). These are always active.
  • Analytics. We use PostHog and Google Analytics 4 (loaded via Google Tag Manager) to understand how our websites are used - pages viewed, traffic sources, and how visitors move through our application form. Product analytics inside the Service masks form input in session recordings.
  • Advertising measurement. We use advertising tools from Google and Meta (the Meta Pixel) on our marketing websites to measure the performance of our campaigns and to build audiences for advertising our own products (for example, showing our ads to people who visited referent.law). These tools may set cookies and receive your IP address, pages visited, and event data such as starting or completing our beta application. They do not receive the content of your workspace, your clients’ data, or any Google user data - ever.

Your choices:

  • Visitors in the EEA, the United Kingdom, and Switzerland: analytics and advertising cookies are off by default and are only activated if you accept them in our cookie banner. You can change your choice at any time by clearing this site’s data in your browser, after which the banner will be shown again.
  • All visitors: you can opt out of Google Analytics with the browser add-on at tools.google.com/dlpage/gaoptout; manage Google ad personalization at myadcenter.google.com; and manage Meta ad preferences at facebook.com/adpreferences. Your browser’s tracking-protection settings and “Do Not Track”-style controls also apply.
  1. Marketing communications

We may send marketing emails about our products:

  • to people who have requested information or applied for access to Referent;
  • to registered users of our products, including our related product AI Lawyer, about products of ours that are relevant to them (for example, informing legal professionals who use AI Lawyer about Referent). We do this as the same data controller, on the basis described in Section 5.

Every marketing email contains an unsubscribe link, and unsubscribing is honored immediately for all future marketing messages. Unsubscribing does not affect transactional emails (such as security or billing notices) for services you use. To be removed from all marketing lists across our products, you can also write to contact@referent.law.

  1. Data retention and deletion
  • Workspace content is retained while your account is active.
  • Synced Google data is deleted when you disconnect the relevant Google account.
  • On account deletion, we delete your personal data and workspace content within 30 days, except where retention is required by law.
  • Marketing contact records are retained until you unsubscribe or ask us to delete them.
  • You can request deletion at any time at contact@referent.law.
  1. Security

We protect data with encryption in transit (TLS) and at rest, network isolation, least-privilege access controls, secrets management, and audit logging. No method of transmission or storage is 100% secure, but we work to protect your information consistent with industry practice. Given the sensitivity of legal correspondence, access to production systems is restricted to authorized personnel only.

  1. Your rights

Depending on your jurisdiction, you may have the right to access, correct, export, restrict, object to processing of, or delete your personal data, and to lodge a complaint with a supervisory authority. This includes the right to object to direct marketing at any time. Contact us at contact@referent.law - we respond within 30 days.

  1. International transfers

Data is hosted in the EU. Where data is transferred outside the EEA (e.g., to subprocessors or the advertising and analytics providers listed above), we rely on adequacy decisions or Standard Contractual Clauses.

  1. Children

The Service is intended for professional use and not directed to individuals under 18.

  1. Changes to this policy

We may update this policy from time to time. We will post the updated version on this page and, for material changes, notify you via the Service or email. The “Last updated” date reflects the latest revision.

  1. Contact

Questions or requests: contact@referent.law
AI Lawtech Sp. z O.O., Henryka Sienkiewicza 36 / 5, 26-600 Radom, Poland