Singularity Privacy Notice

Last updated 2 November 2026

This notice explains what personal data Legal Machines processes when an organisation creates a Singularity account, invites its members and signs in, and what Singularity sends from the Organisation’s own computers. The Organisation’s matters, documents and work stay on its computers and are outside this notice, because Singularity is designed so that Legal Machines does not receive them (Section 6). This notice informs about how we handle personal data; it is not a contract and creates no contractual rights or obligations.

1. Who is responsible

Legal Machines (“Legal Machines”, “we”, “us”) is the controller of the personal data this notice describes. You can reach us about anything in it at inbox@legalmachines.org.

2. When an Organisation is created

• The Organisation’s legal name, country of incorporation and registration number, as entered.
• The Organisation ID, as chosen, or formed by us from the legal name where none is chosen.
• The Organisation Contact Email, a shared mailbox the Organisation controls (Terms of Use, Section 4).
• The administrator seat’s password, which we store only in hashed form and cannot recover; the secret of the authenticator app set up for that seat, which we store encrypted; and the seat’s recovery codes, which we store only in hashed form.
• Which version of each legal document the Organisation accepted and when, its confirmation that the Organisation Contact Email is a shared mailbox, and whether it opted in to Product Updates email.

We may review an Organisation using these details at any time. A decision to close an Organisation is made by a person at Legal Machines, not by automated means alone.

3. When a member is invited and joins

• The member’s name and work email, as the administrator seat enters them, and the name the member later gives in Singularity.
• A Seat ID we generate for the member’s seat.
• An invitation code sent to the member’s work email, stored only in hashed form and valid for a limited time.
• The password the member chooses, stored only in hashed form.

We use the member’s name in the emails we send on the Organisation’s behalf, such as an invitation that says who sent it, and return it to Singularity when the member signs in on another computer.

4. When a seat signs in

• Sign-in codes sent to the address the seat signs in with, stored only in hashed form, valid for a short time and limited in attempts; and, where a seat uses an authenticator app, the time of the last code accepted, so that no code is used twice.
• A session for each computer the seat signs in on: an identifier of that computer, a token stored only in hashed form, and when the session began and ends. A session ends after a set period, at sign-out, or when the seat’s sign-in details change.
• When a seat signs in to its account on the legalmachines.org website: one cookie, __Host-lm_account, which the signed-in pages strictly need and which expires after a limited time, sooner if unused, and a label of the browser and system, such as “Safari on iPhone”, so the seat can recognise its sessions.
• Standard web request logs, such as IP address, time and requested address, and counts of attempts per network address and email address, kept to operate, secure and troubleshoot the service and to limit abuse.

5. reCAPTCHA

Creating an Organisation on the legalmachines.org website is protected by Google reCAPTCHA, which processes limited technical signals, such as IP address and browser characteristics, to tell people from automated submissions. Google processes them under its own Privacy Policy and terms, including in the United States. Creating an Organisation in Singularity does not use reCAPTCHA; limits on attempts from one network address apply instead.

6. What Singularity sends from the Organisation’s computers

Singularity is designed to send only the following:

• To Legal Machines: the account requests above; requests for the catalog of models and for the Papinian models behind Papinian Guard; and, when Singularity starts, regularly while it runs and whenever a person asks, a check for updates, which says only the version of Singularity and the kind of system and processor it runs on, followed by the download of an update only when a person chooses it. Like every request to us, these are recorded in the web request logs Section 4 describes. Singularity sends us no matter, document, thread or other work of the Organisation, and no usage analytics.
• Between the Organisation’s computers: a shared Matter, sealed end to end on the computer it leaves and opened only on the Organisation’s computers that hold its key, sent directly or through a folder the Organisation chooses to share. Our servers take no part in this exchange and do not receive the Matter, sealed or not.
• To a public STUN server, Google’s or Cloudflare’s: a request that tells a computer its own public network address, so that the Organisation’s computers can reach each other. The server sees that address, not the Organisation’s work.
• To the AI model providers the Organisation connects: the work its members and AI colleagues give to those models, and the web searches the models make for that work, with the protected values Papinian Guard detects masked as the Organisation’s protection settings require. Papinian Guard may not detect every protected value. These requests go from the Organisation’s computer to the provider under the Organisation’s own agreement with it. We do not receive them, and Singularity keeps the Organisation’s provider credentials on its own computers.
• To Microsoft, when the Organisation connects Singularity to Microsoft Office: Office loads its add-in library from Microsoft, under Microsoft’s terms.

For the information in its work, the Organisation is the controller, and the providers it connects process that information under the Organisation’s agreements with them.

7. Why we process this data, and on what basis

• To create, review, secure and operate the Organisation’s account and its seats, verify addresses, let seats sign in and recover access, and name members to their colleagues: our and the Organisation’s legitimate interest in providing the account the Organisation asked for and keeping it secure, and, where you are yourself a party to our agreement, its performance.
• To offer updates of Singularity: our and the Organisation’s legitimate interest in Singularity working and staying secure.
• To prevent abuse, protect the service and keep logs: our legitimate interest in keeping the service and its users safe.
• To send Product Updates email: your Organisation’s consent, which can be withdrawn at any time.
• To keep records of which documents were accepted, and to keep or disclose data where the law requires: our legal obligations, and our legitimate interest in being able to show what was agreed.
• Where the law of your country requires consent to process personal data, or to transfer it to another country, also the consent described in the Consent to Personal Data Processing.

We do not make decisions about you based solely on automated processing.

The details asked for when an Organisation is created, a member joins or a seat signs in are needed to provide the account: without them we cannot create it or let a seat sign in. Opting in to Product Updates email is never required.

8. Emails we send

Some emails are required and cannot be turned off, because they keep the account working and secure: verification of the Organisation Contact Email; a member’s invitation; sign-in codes, sent to the address each seat signs in with; account recovery; security notices, such as confirmation of a change to the Organisation Contact Email; and service notices, such as operational changes, required migrations, compatibility changes and changes to our legal documents.

One category is optional: occasional emails about important new Legal Machines products, major releases and significant company news, sent only to an Organisation that has separately and affirmatively opted in. Accepting any of our documents is never treated as that opt-in, and leaving it unselected does not affect the account. An Organisation that has opted in can withdraw at any time through the one-click unsubscribe link in every such email, or by writing to us; withdrawing never affects the required emails.

9. Where the data is kept

Our account service runs on servers in the Netherlands, provided by our cloud hosting provider, and our emails are sent from our own mail server on those servers. The people who work for Legal Machines may reach the data from other countries, and Google processes reCAPTCHA signals in the United States and elsewhere. Where data protection law requires safeguards for data that leaves the European Economic Area, the United Kingdom or Switzerland, we rely on an adequacy decision or put appropriate safeguards in place, such as the European Commission’s Standard Contractual Clauses, and you can ask us about them.

10. Who receives the data

We do not sell personal data. We disclose it only as needed to run and protect the service: to service providers that process it for us, such as our cloud hosting provider, which runs our servers, and Google, for reCAPTCHA on the website; to our professional advisers; to courts, authorities or others where the law requires it, or where it is needed to establish, exercise or defend legal claims or to protect our rights or someone’s safety; and to a successor if Legal Machines’ business is transferred, for example to a company it forms, in which case the data remains covered by this notice.

11. How long we keep it

• Organisation, seat and member records: while the account exists, and afterwards only as long as needed for security, to resolve disputes or to meet legal obligations.
• Records of which documents were accepted: while the account exists and for the period in which a claim about them could be brought.
• Codes: they expire shortly after they are issued, and are kept only as long as needed to detect abuse.
• Sessions: as Section 4 describes.
• Web request logs: only as long as needed to operate, secure and troubleshoot the service, after which they are deleted as the logs rotate.

12. Security

We use measures designed to protect the data, such as storing passwords, codes and session tokens only in hashed form, storing authenticator secrets encrypted, and encrypting traffic to the account service in transit. No system is perfectly secure, and we cannot guarantee the security of the data. Where the law requires, we tell you and the authorities of a breach that affects your data.

13. Your rights

Depending on where you live, you may have the right to access the personal data we hold about you, to correct it, to have it deleted, to restrict or object to its processing, to receive it in a portable form, and to withdraw consent at any time without affecting processing before the withdrawal. You also have the right to complain to a data protection authority, for example in the country where you live or work. Residents of US states with privacy laws, such as California, have the rights their laws give, and we do not sell or share personal information as those laws define it.

To use a right, write to inbox@legalmachines.org. We may need to confirm who you are, and we answer within the time the law sets. Where your data is part of an Organisation’s account, such as a member’s seat, we may involve the Organisation’s administrator.

14. Information submitted contrary to our requirements

We ask Organisations not to submit personal contact details where an organisation-controlled contact is required: the Organisation Contact Email must not be an individual’s personal address, and a member’s seat must use the member’s work email (Terms of Use, Section 4). If such information is submitted anyway, we may restrict its use, ask the Organisation to replace it, and delete or isolate it in line with the law, our security requirements and our retention obligations. It remains personal data, and the individual’s rights are unaffected.

15. Children

Singularity and the account service are for professional use and are not directed at children. We do not knowingly collect personal data from anyone under 18.

16. Changes to this notice

We may update this notice at any time. The date at the top shows when it last changed, and we tell Organisations of material changes as the Terms of Use, Section 14, describes.

17. Contact

Questions about this notice, or about your data, can be sent to inbox@legalmachines.org.