Privacy Policy

How JuriPro collects, uses, shares and protects personal data — and the rights you have in relation to it.

Last updated: 1 September 2026 · Effective: 1 September 2026

1. Who we are

JuriPro is a legal technology company operating through three entities: JuriPro SARL (Paris, France), JuriPro Inc. (New York, United States) and JuriPro UK Ltd. (London, United Kingdom). In this policy, “JuriPro”, “we” and “us” mean the entity that contracts with you; where you have no contract with us, they mean JuriPro SARL.

For the purposes of the EU General Data Protection Regulation (Regulation (EU) 2016/679) and the UK GDPR, JuriPro SARL is the controller of personal data collected through juripro.net and in connection with our marketing, sales and support activities. Where we process personal data contained in documents that customers upload to the platform, we act as a processor on the customer’s instructions; that processing is governed by our Data Processing Agreement rather than by this policy.

Our data protection officer can be reached at [email protected].

2. Personal data we collect

Information you give us. Name, business email address, telephone number, employer or firm name, job title, country, and the content of any message you send through our contact form, by email or during a demonstration.

Account information. Where you hold an account: username, authentication credentials (stored only as salted hashes), account settings, and records of your use of the platform.

Technical information. IP address, browser type and version, operating system, device type, referring page, pages viewed, and time and duration of visit. Where analytics cookies are used, this information is collected in the manner described in our Cookie Policy.

Billing information. Billing address, VAT number and payment records. Card details are collected and stored by our payment processor and are not retained by JuriPro.

Customer content. Documents you upload for analysis may contain personal data. We process that data only as a processor, on your documented instructions, as described in the DPA. It is not used for our own purposes and is never used to train shared models.

3. How and why we use it

We process personal data for the following purposes and on the following legal bases:

To respond to enquiries and provide requested information — performance of a contract, or steps taken at your request prior to entering into one (Article 6(1)(b)).
To provide, maintain and support the platform — performance of a contract (Article 6(1)(b)).
To secure our services, prevent abuse and investigate incidents — our legitimate interests in operating a secure service (Article 6(1)(f)).
To improve our website and understand how it is used — consent, where analytics cookies are used (Article 6(1)(a)).
To send marketing communications about our products — consent, or our legitimate interests in marketing to existing business customers, in each case with an unsubscribe link in every message (Article 6(1)(a) or (f)).
To comply with legal obligations, including accounting, tax and sanctions screening — legal obligation (Article 6(1)(c)).

We do not sell personal data, and we do not share it with third parties for their own marketing purposes.

4. Where we rely on legitimate interests

Where we rely on legitimate interests we have carried out a balancing assessment. In summary: the processing is limited to business contact information; it is carried out in a business-to-business context in which the individual would reasonably expect to be contacted about professional services; we provide a clear and immediate opt-out; and we do not use the data for profiling that produces legal or similarly significant effects. You may request a summary of the relevant assessment by writing to [email protected].

We share personal data with the following categories of recipient, in each case under a written contract containing the protections required by data protection law:

Cloud infrastructure providers hosting the platform in the EU (Frankfurt and Paris) or the United States (Northern Virginia and Oregon), according to the region you select.
Communications and support tooling used to operate our helpdesk and send transactional email.
Payment processing and accounting providers.
Professional advisers — lawyers, auditors and insurers — where necessary.
Public authorities, where we are required by law to disclose. We will notify you of any such request unless legally prohibited from doing so.

A current list of sub-processors used in the provision of the platform is maintained in the DPA.

6. International transfers

Where personal data is transferred outside the European Economic Area or the United Kingdom, we rely on an adequacy decision where one covers the destination, and otherwise on the European Commission’s Standard Contractual Clauses (and, for UK transfers, the UK International Data Transfer Addendum), supported by a transfer impact assessment and technical measures including encryption in transit and at rest with keys held in the exporting region.

Customers who select EU data residency have their customer content processed exclusively within the EEA, including for support access.

7. How long we keep it

Enquiry and marketing data — 24 months from the last interaction, then deleted.
Account data — for the duration of the account and 12 months thereafter, unless a longer period is required by law.
Customer content — according to the retention period configured by the customer; deleted from live systems on request and from backups within 35 days.
Billing and accounting records — 10 years, as required by French commercial and tax law.
Security logs — 12 months.

8. Your rights

Subject to the conditions and exemptions in applicable law, you have the right to: request access to the personal data we hold about you; request rectification of inaccurate data; request erasure; request restriction of processing; object to processing carried out on the basis of legitimate interests; receive your data in a portable format; and withdraw consent at any time where consent is the basis for processing.

To exercise any of these rights, write to [email protected]. We will respond within one month, extendable by two further months for complex requests, and we will tell you if an extension applies. We do not charge a fee unless a request is manifestly unfounded or excessive.

If you are unhappy with how we have handled your personal data you may complain to a supervisory authority — in France, the Commission Nationale de l’Informatique et des Libertés (CNIL); in the United Kingdom, the Information Commissioner’s Office (ICO); or to the authority in your country of residence or place of work.

9. Notice for California residents

In the twelve months preceding the date of this policy we have collected the categories of personal information described in section 2, for the business purposes described in section 3, from the sources described in section 2. We have not sold personal information and we have not shared personal information for cross-context behavioural advertising.

California residents have the right to know what personal information we collect and how we use and disclose it; to request deletion; to request correction; to limit the use of sensitive personal information (we do not collect sensitive personal information for the purposes covered by this right); and not to be discriminated against for exercising these rights. Requests may be submitted to [email protected] and will be verified by reference to information already held in your account.

10. Security

We maintain technical and organisational measures appropriate to the risk, described in detail in our Security Overview. These include encryption in transit (TLS 1.3) and at rest (AES-256), role-based access control, mandatory multi-factor authentication for all staff, tenant isolation, annual penetration testing by an independent firm, and a documented incident response process with defined notification timelines.

11. Children

Our services are intended for legal professionals and are not directed at children. We do not knowingly collect personal data from anyone under 16. If you believe we have done so, contact [email protected] and we will delete it.

12. Changes to this policy

We may update this policy from time to time. Where a change is material, we will notify account holders by email at least 30 days before it takes effect, and we will update the “last updated” date at the top of this page. Previous versions are available on request.

Questions about this document? Write to [email protected], or to JuriPro SARL, 18 Rue de la Paix, 75002 Paris, France.