Privacy policy
Last updated 15 September 2026
AI Legal Toolbox is operated by Elysia Partners Pty Ltd, ABN 78 685 100 930 ("we", "us"). This policy explains what the product does with the information it can see, where that information is processed, and what choices you have.
Our customers are legal practices, which carry obligations about client information that most businesses do not. We have tried to write this so an adviser can read it once and know the position.
Who controls the information
Your practice is responsible for the client information in its mailbox and its practice management system. We process that information on your instructions so the product can do what you have asked it to do. We do not use it for our own purposes.
What the product can see
When you grant access through Microsoft, the product can read the mail, calendar entries and contacts in the account you signed in with. It reads them to carry out the tasks you ask for. Specifically:
- Email. Subject lines, senders, recipients, dates and message bodies of messages it is asked to work on, and of messages it triages into your Docket.
- Calendar. Existing entries when you ask what is coming up, and new entries it creates once you approve them.
- Practice management data. If you connect a practice management system, the matters, contacts and related records that system exposes to us.
- Your instructions. What you type to Nova, and what she replies.
What we store, and what we do not
We keep as little as the product can function on. We store:
- Your account details and the encrypted tokens that let the product reach your mailbox on your behalf.
- A summary of each triaged email: sender, subject, the assessment of what it needs, and the suggested actions. For some messages this includes a short extract of the content.
- Your conversations with Nova, so a thread can be reopened later.
- A cached copy of matter and contact records from your practice management system, so the product does not have to re-query it constantly.
- An activity log of every action you approved: what was done, against which matter, and when.
- Records of documents the product generated for you.
We do not store a copy of your whole mailbox. We do not store payment card details; card payments are handled by Stripe and we never see the card number.
Where your information is processed
This section is the one your IT adviser will ask about, so it is stated plainly rather than summarised.
The application servers and database that run AI Legal Toolbox are currently hosted in the United States. The artificial intelligence models the product uses are also operated from the United States. This means correspondence processed by the product leaves Australia.
We are moving this infrastructure to an Australian region. Until that move is complete, the position above is the accurate one. If your practice has a requirement that client information not be processed offshore, speak to us before you sign up rather than after.
Who else is involved
The product depends on a small number of third parties. Each one is listed here with what it does and where it operates:
- Microsoft. Provides your mailbox and the sign-in. Access is granted by you and can be withdrawn by you.
- Amazon Web Services. Hosts the application. Currently in the United States.
- Supabase. Hosts the database.
- OpenAI. Provides the language models that read correspondence and prepare drafts. Operated from the United States.
- Stripe. Handles subscription payments.
- Your practice management provider, if you choose to connect one.
Your correspondence is not used to train models
We do not use your client correspondence to train or improve any general purpose artificial intelligence model, and our agreements with our model provider are on terms that exclude this.
Security
- Connections to the product are encrypted in transit.
- Authorisation tokens are encrypted at rest, and no long-lived credential is left sitting in your browser.
- Access to your data is limited to your own account. Staff access to production systems is limited to what is needed to operate and support the product.
- Actions that change something are logged.
No system is perfect. If we become aware of a breach affecting your information we will tell you, and we will meet our obligations under the Privacy Act 1988 (Cth) notifiable data breaches scheme.
How long we keep things
We keep the information above for as long as your practice has an account with us. When an account is closed we delete the stored data within 90 days, other than records we are required to keep for tax or legal reasons.
You can clear your conversation history with Nova from inside the product at any time.
Your rights
You can ask us for a copy of the information we hold about you, ask us to correct it, or ask us to delete it. Write to privacy@ailegaltoolbox.com.au and we will respond within 30 days.
You can withdraw the product's access to your mailbox at any time through your Microsoft account, without affecting anything else.
Complaints
If you are not satisfied with how we have handled your information, write to us at privacy@ailegaltoolbox.com.au. If we cannot resolve it, you may complain to the Office of the Australian Information Commissioner at oaic.gov.au.
Changes
If we change this policy in a way that materially affects you, we will tell you before the change takes effect. The date at the top shows when it was last revised.
Contact
Elysia Partners Pty Ltd
ABN 78 685 100 930
Apartment 402, 131 Sir Fred Schonell Drive
St Lucia QLD 4067
Australia
privacy@ailegaltoolbox.com.au