Privacy Policy

Effective November 9, 2026

This policy explains what Validitas ("Validitas", "we") collects, why, and the choices you have. We built Validitas for confidential legal work, so we collect as little as we can and keep it for as short a time as we can.

What we collect

• Account information: your email address, a securely hashed password (we can't see your password), firm name, and team membership.
• Evidence files you upload and the details you enter for a report (exhibit label, matter name, case caption).
• Reports, file fingerprints and audit logs: the results we generate, the SHA-256 hash of each file, and a tamper-evident log of actions on each report (for example, uploaded, analyzed, downloaded). Audit logs never contain file contents, file names or matter names.
• Billing records: Stripe processes payments. We receive your plan, purchase history and a Stripe customer reference, never your full card number.
• Usage events: limited records of actions in the Service (such as "check completed" or "report downloaded"), tied to your account ID, used to operate and improve the Service. They never include file contents, file names, matter names or findings.
• Waitlist and examiner applications: the information you submit on those forms.

What we don't do

• We do not sell or rent personal information or your files, and we don't share them for advertising.
• We do not use your files or reports to train AI models, and we use only detection providers that commit in writing not to use them for training or to retain them beyond processing.
• We do not use third-party analytics, advertising pixels or tracking cookies.

How we use information

To provide the Service (analyze files, generate and verify reports, manage accounts and billing), to secure it and prevent abuse, to communicate with you about your account, and, where you asked, about Case Watch or the examiner network.

Who we share it with

Only service providers we need to run Validitas, under contracts that limit their use of the data: our cloud hosting provider (where encrypted files and our database are stored); AI-detection providers, which receive individual files only to score them; Stripe for payments; and our email provider for account emails, which never contain evidence or findings. We share files with a forensic examiner only after you approve that examiner. We may disclose information if required by law or valid legal process, and we will notify you where we lawfully can so you can seek protection.

How long we keep it

• Evidence files: permanently deleted 30 days after upload unless you place a litigation hold; deleted immediately if analysis fails.
• Reports, hashes and audit logs: kept until you delete the report or close your account.
• Verification records: report ID, issue time, the report's hash, file count and engine version, kept so issued reports stay verifiable. They contain no file contents or case information.
• Account and billing records: kept while your account is open and afterward as required for tax, accounting and legal purposes.

Security

Evidence files, results and reports are encrypted at rest with AES-256 and in transit with TLS. Each file is fingerprinted with SHA-256 on upload. Passwords are hashed with Argon2. Access to customer reports is limited to members of the customer's firm account; Validitas administrators cannot open customer reports from the admin tools.

Cookies

We use only essential cookies: one to keep you signed in and one to protect forms against cross-site request forgery. We don't use analytics or advertising cookies.

Your choices and rights

You can delete any report and its files at any time, and delete your account from the account page; an owner's deletion removes the firm's reports, files and team logins immediately. You can also ask us to access, correct or export your personal information by emailing hello@validitas.io from your account's address. Depending on where you live, you may have additional rights under state privacy laws; we honor them as required, and we won't discriminate against you for using them.

Children

The Service is for professional use and is not directed to anyone under 18.

Changes and contact

If we make material changes, we'll notify account owners before they take effect. Questions or requests: hello@validitas.io.