Last Updated: April 14, 2026
Gosai Law Pty Ltd ACN 660 864 264 and its affiliated entities (“we,” “us,” or “our”) operate the GOSAI OS platform (the “Platform”). This Privacy Policy explains how we collect, use, store, disclose, and protect personal information when you access or use the Platform, our website, our AI-powered features (including the Contract Review Feature), our legal services, or any related services (collectively, the “Services”).
This Privacy Policy applies to all users of the Platform, including users of free features, paid subscribers, and users of Lawyer Services. It does not apply to third-party products or services, or to the practices of companies we do not own or control.
By creating an account, accessing the Platform, or using any Service, you acknowledge that you have read and understood this Privacy Policy. If you do not agree with this Privacy Policy, you should not access or use the Platform.
We are a regulated law firm. This Privacy Policy addresses how we handle personal information in our capacity as a technology platform operator. Where Lawyer Services have been accepted and an attorney-client relationship has been established through separate Engagement Terms, additional confidentiality obligations under applicable professional conduct rules and law also apply to information you provide in connection with those services.
The specific information we collect depends on how you interact with the Platform. We may collect the following categories of personal information:
Account Information: name, email address, phone number, company name, job title, and login credentials when you create an account.
Company and Entity Data: company formation details, director and officer information, shareholder records, entity structure, registered agent details, and jurisdiction-specific identifiers.
Documents and Content: contracts, agreements, legal documents, and other files you upload to the Platform for storage, review, or analysis, including documents submitted through the Contract Review Feature.
Communications: messages, requests, instructions, feedback, survey responses, and other communications you send through the Platform or to us directly.
Payment Information: billing address, payment method details, and transaction history. We do not store credit or debit card numbers directly; payment card data is processed by our third-party payment processor.
Identity Verification: government-issued identification, proof of address, or other documentation provided for identity verification, sanctions screening, or compliance purposes.
Professional Information: information related to your business, industry, role, legal needs, and service preferences.
Device and Technical Information: IP address, browser type and version, operating system, device identifiers, screen resolution, and language settings.
Usage Information: pages visited, features used, actions taken, time spent on pages, referring and exit pages, clickstream data, and search queries within the Platform.
Location Information: approximate geographic location derived from your IP address.
Cookies and Similar Technologies: we use cookies, local storage, web beacons, and similar technologies to collect information about your interactions with the Platform. See Section 10 (Cookies) for details.
We may receive information about you from third-party service providers (such as identity verification services, analytics providers, or payment processors), publicly available sources (such as government registries or business directories), or other users of the Platform (such as when another user adds you as an Authorized User or lists you as a director or officer of a company).
We use the personal information we collect for the following purposes:
3.1 Providing and Operating the Platform: to create and manage your account, operate the Platform, provide the Services, process transactions, respond to your requests, and communicate with you about your account and the Services.
3.2 AI Features and Contract Review: to process documents and other inputs you submit through AI Features (including the Contract Review Feature) and to generate AI Outputs. When you submit a document for AI review, the document content is processed by our systems and may be sent to our third-party AI service providers solely to generate the analysis. See Section 4 (AI Data Processing) for details on how this works.
3.3 Improving the Platform and AI Features: to analyze usage patterns, diagnose technical issues, develop new features, and improve existing features, including by using anonymized, de-identified, or aggregated data derived from your use of the Platform to train and improve our proprietary AI models. See Section 4 for details and your opt-out rights.
3.4 Security and Fraud Prevention: to detect, prevent, and respond to fraud, unauthorized access, security incidents, and other harmful activity.
3.5 Legal and Compliance: to comply with applicable laws, regulations, professional obligations, court orders, and government requests; to enforce our Terms of Use; and to protect our rights, privacy, safety, or property.
3.6 Communications and Marketing: to send you service-related notifications, updates, and transactional messages; and, where you have opted in or where permitted by law, to send you marketing communications about our Services. You can opt out of marketing communications at any time.
3.7 Analytics: to understand how users interact with the Platform, to measure the effectiveness of our features, and to generate aggregated, non-identifying insights about usage trends.
3.8 Business Transactions: in connection with any merger, acquisition, reorganization, sale of assets, or similar transaction, your information may be transferred as part of that transaction. We will notify you of any such transfer and any choices you may have regarding your information.
This section describes how documents and other data are processed when you use AI Features, including the Contract Review Feature. Please read it carefully.
When you submit a document or other input to an AI Feature, the content may be transmitted to our third-party AI service providers via their application programming interfaces (APIs) solely for the purpose of generating the AI Output you requested. Our current AI service provider is Anthropic. We may add additional AI service providers (such as OpenAI) in the future and will update this Privacy Policy accordingly. Our API agreements with these providers include the following protections:
We may use anonymized, de-identified, or aggregated data derived from documents and other inputs submitted through the Platform to train, improve, and develop our own proprietary AI models and features. This training data is processed to remove identifying information about you, your organization, counterparties, and specific deal terms before it is used for training purposes.
Examples of the types of derived data we may use for training include: clause patterns and structures, risk classification patterns, contract formatting and organization patterns, and aggregated industry benchmarks. We do not use your raw, unprocessed documents to train our models.
You may opt out of having your data used for our model training at any time by:
If you opt out: (i) we will exclude your data from future model training within a reasonable period after receiving your request; (ii) data that has already been anonymized and incorporated into our models prior to your opt-out cannot be extracted or deleted, because it is no longer identifiable as your data; and (iii) opting out will not affect your ability to use the Platform or any AI Feature.
We do not sell your documents or personal information to third parties. We do not share your raw documents with our foundation model providers for their own training purposes. We do not use your documents to provide services to other users in a way that would identify you or your organization. We do not permit our AI service providers to use your data for any purpose other than generating the AI Output you requested.
We may disclose your personal information to the following categories of recipients:
5.1 Service Providers and Sub-Processors: we share personal information with third-party service providers who help us operate the Platform and deliver the Services, including cloud hosting providers, AI service providers, payment processors, analytics providers, email service providers, identity verification services, and customer support tools. These providers are contractually required to use your information only for the purposes we specify and to maintain appropriate security measures.
5.2 AI Service Providers: as described in Section 4, document content submitted to AI Features may be transmitted to our AI service providers (currently Anthropic; additional providers may be added in the future) for processing. These providers operate under API agreements that prohibit them from using your data for their own model training.
5.3 Legal Services Entities: if you engage Lawyer Services, we may share your information with the relevant legal services entity or lawyer connected with the Platform to deliver those services, subject to applicable professional obligations.
5.4 Partner Services: if you access Partner Services through the Platform, we may share limited information with the relevant partner to facilitate the introduction or referral, with your consent or as disclosed at the time of the introduction.
5.5 Government and Regulatory Bodies: we may disclose information as required by law, regulation, court order, subpoena, or government request, or as necessary to comply with professional obligations or regulatory requirements.
5.6 Business Transfers: in connection with a merger, acquisition, reorganization, or sale of assets, your information may be transferred to the acquiring entity.
5.7 With Your Consent: we may disclose your information to other parties with your consent or at your direction.
5.8 Sub-Processor List. A current list of our sub-processors is maintained separately and is available upon request by emailing us at privacy@gosai.law with the subject line “Sub-Processor List.” We may add, remove, or replace sub-processors from time to time. If you would like to be notified of changes to our sub-processor list, you may email us at privacy@gosai.law with the subject line “Sub-Processor Updates.”
6.1 Account Data: we retain your account information and associated data for as long as your account remains active and for a reasonable period thereafter to comply with legal obligations, resolve disputes, and enforce our agreements.
6.2 Documents in Your Workspace: documents you upload to the Platform (including documents submitted through the Contract Review Feature) are retained in your Workspace document vault for as long as your account is active, unless you delete them. When you delete a document from your vault, we will remove it from our active systems within a reasonable period, but backup copies may persist in our backup systems for a limited period consistent with our backup cycle.
6.3 After Account Closure: when you close your account, we will delete or de-identify your personal information and documents within a reasonable period consistent with our backup cycles and applicable law, except to the extent that retention is required by law, professional obligations, regulatory requirements, fraud prevention, or dispute resolution. Anonymized or aggregated data that has been incorporated into our AI models or analytics and that no longer identifies you will not be deleted.
6.4 Lawyer Services Records: if you engaged Lawyer Services, records related to those services may be retained for the period required by applicable professional conduct rules and law, which may exceed the retention periods described above.
We maintain commercially reasonable administrative, technical, and organizational security measures designed to protect your personal information against unauthorized access, loss, misuse, alteration, and destruction. These measures include encryption of data in transit and at rest, access controls, regular security assessments, and employee training.
We do not store credit or debit card numbers directly. Payment card data is processed by our third-party payment processor and is subject to that processor’s security standards.
No method of transmission over the internet or method of electronic storage is completely secure. While we strive to protect your personal information, we cannot guarantee its absolute security. You are responsible for maintaining the confidentiality of your account credentials.
Your personal information may be stored and processed in Australia, the United States, or other countries where our service providers operate. By using the Platform, you consent to the transfer of your personal information to countries that may have different data protection laws than your country of residence.
Where we transfer personal information from the United Kingdom or the European Economic Area to countries that have not been deemed to provide an adequate level of data protection, we rely on appropriate safeguards such as standard contractual clauses approved by the relevant authority, or other lawful transfer mechanisms.
Where we transfer personal information from Australia to overseas recipients, we take reasonable steps to ensure that the overseas recipient does not breach the Australian Privacy Principles in relation to that information.
Depending on your jurisdiction, you may have some or all of the following rights regarding your personal information:
Access: you may request a copy of the personal information we hold about you.
Correction: you may request that we correct inaccurate or incomplete personal information.
Deletion: you may request that we delete your personal information, subject to certain exceptions (such as legal retention requirements or ongoing service delivery).
Opt-Out of Model Training: you may opt out of having your data used for our proprietary AI model training as described in Section 4.2.
Marketing Opt-Out: you may opt out of receiving marketing communications at any time by following the unsubscribe instructions in any marketing email or by contacting us.
Account Closure: you may close your account at any time through the Platform or by contacting us.
If you are located in the United Kingdom, you have rights under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, including:
Lawful Basis for Processing: where UK GDPR applies, we process your personal data on the following lawful bases: (a) performance of a contract (to provide the Services you have requested); (b) legitimate interests (to improve the Platform, prevent fraud, and ensure security), where those interests are not overridden by your rights; (c) consent (where you have provided specific consent, such as for marketing communications or opt-in data uses); and (d) legal obligation (where processing is required by law or professional rules).
Certain U.S. states, including California (CCPA/CPRA), Virginia, Colorado, Connecticut, and others, provide residents with specific privacy rights. If you are a resident of a state with an applicable privacy law, you may have additional rights, including:
To exercise any of these rights, contact us at privacy@gosai.law or use the privacy request form on our website.
We use cookies and similar technologies (such as web beacons, pixels, and local storage) to collect information about your interactions with the Platform. The types of cookies we use include:
Essential Cookies: required for the Platform to function, including authentication, security, and session management. These cannot be disabled.
Analytics Cookies: used to understand how users interact with the Platform, measure feature effectiveness, and identify areas for improvement. We may use third-party analytics services such as Google Analytics.
Functionality Cookies: used to remember your preferences, settings, and customizations.
Advertising and Retargeting Cookies: used to deliver relevant advertising and measure the effectiveness of our marketing campaigns. These cookies may be set by third-party advertising partners.
You can manage your cookie preferences through your browser settings or through any cookie consent mechanism provided on the Platform. Disabling certain cookies may affect the functionality of the Platform. For UK users, we obtain consent before placing non-essential cookies in compliance with the Privacy and Electronic Communications Regulations 2003 (PECR).
The Platform is intended for users who are at least 18 years of age. We do not knowingly collect personal information from anyone under 18. If we learn that we have collected personal information from a person under 18, we will take steps to delete that information as soon as practicable. If you believe we have collected information from a minor, please contact us at privacy@gosai.law.
In the event of a data breach that is likely to result in serious harm to you, we will notify you and the relevant regulatory authorities in accordance with applicable law. For Australian users, this includes notification to the Office of the Australian Information Commissioner (OAIC) under the Notifiable Data Breaches scheme (Part IIIC of the Privacy Act 1988 (Cth)). For UK users, this includes notification to the Information Commissioner’s Office (ICO) within 72 hours where required under UK GDPR. For U.S. users, we will comply with applicable state data breach notification laws.
The Platform may contain links to third-party websites, services, or applications. This Privacy Policy does not apply to those third-party services. We are not responsible for the privacy practices of third parties, and we encourage you to review their privacy policies before providing any personal information.
Some browsers transmit “Do Not Track” (DNT) signals to websites. We do not currently respond to DNT signals. We do honor Global Privacy Control (GPC) signals where required by applicable law. You can learn more about GPC at globalprivacycontrol.org.
Information you provide through the Platform before an attorney-client relationship is established is handled in accordance with this Privacy Policy and our security practices, but is not protected by attorney-client privilege or a professional duty to act. See Section 6 of the Terms of Use.
Once Lawyer Services have been accepted through separate Engagement Terms, information provided in connection with those services is also subject to the confidentiality obligations imposed by applicable professional conduct rules, legal professional privilege, and law. Those obligations are in addition to (and may be more protective than) the obligations in this Privacy Policy.
We do not use information that is subject to attorney-client privilege to train our AI models. Information subject to attorney-client privilege is handled separately from Platform data and is governed by the applicable Engagement Terms and professional rules.
We may update this Privacy Policy from time to time. If we make material changes, we will notify you by email or through a prominent notice on the Platform before the change becomes effective. We encourage you to review this Privacy Policy periodically. Your continued use of the Platform after any changes constitutes your acceptance of the updated Privacy Policy.
If you have questions about this Privacy Policy, want to exercise any of your privacy rights, or want to make a complaint about how we handle your personal information, please contact us:
Privacy Officer
Gosai Law Pty Ltd
Email: privacy@gosai.law
Address: Level 5, 33 Elkhorn Avenue | Surfers Paradise QLD 4217
If you are not satisfied with our response to a complaint, you may lodge a complaint with the Office of the Australian Information Commissioner (OAIC) at www.oaic.gov.au.