Privacy Policy
RoboLawyer, Inc., doing business as Redwell (“Company,” “Redwell,” “we,” “us,” or “our”), is committed to protecting your privacy. This Privacy Policy explains how we collect, use, store, and disclose Personal Data when you interact with our websites, platform, and services. It also describes your rights regarding your Personal Data and how to exercise them.
Redwell provides an AI-powered legal technology platform (the “Services”) that captures live case context from email and documents, assembles working files, and generates first-pass legal work product for attorney review. The platform is designed for use by law firms and legal professionals.
By accessing or using our Websites or Services, you acknowledge that you have read, understood, and agree to be bound by this Privacy Policy. If you do not agree, please do not use our Websites or Services.
1. Scope and Applicability
This Privacy Policy applies to Personal Data we collect through our websites (including redwell.ai), the Services, and any other interactions you have with Redwell. “Personal Data” means information that identifies, relates to, describes, or could reasonably be linked to a particular individual.
Redwell offers its Services to law firms, attorneys, and other legal professionals (“Customers”). We enter into agreements with our Customers (such as platform agreements, founding firm agreements, or terms of service) that govern the delivery and use of the Services (each, a “Customer Agreement”).
1.1 Customer Data: A Separate Category
This Privacy Policy does not govern email content, documents, attachments, matter files, AI-generated outputs, or other data processed through the Services on behalf of a Customer. We refer to this information as “Customer Data.” Redwell processes Customer Data strictly as a data processor acting on the Customer’s instructions, subject to the Customer Agreement and our Data Processing Addendum. For information about how Customer Data is handled, please refer to those agreements and to Section 2 below.
2. Google User Data and Limited Use
Some Redwell features connect to your Google account with your explicit consent. This section describes exactly what Google data we access, why, and the strict limits we place on its use. It applies in addition to the rest of this Privacy Policy, and it controls in the event of any conflict regarding Google user data.
2.1 Google APIs and scopes we access
Redwell connects to your Google account (Gmail, Google Calendar, and basic sign-in) only after you explicitly grant access, and only for the account you connect. The specific scopes we request and the feature each one powers are listed in Section 2.3.
2.2 Limited Use commitment
Redwell’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Google user data is used solely to provide and improve the features below; it is never sold, used for advertising, or used to train generalized AI/ML models.
2.3 What each scope is used for
For each Google scope we request, the feature it powers is:
Gmail access
https://www.googleapis.com/auth/gmail.modify — Redwell reads the email in your connected Gmail mailbox to file it into the correct matter, and drafts, sends, and organizes messages on your behalf (applying labels, archiving, and moving to trash) from the Redwell inbox.
https://mail.google.com/ — Redwell maintains a secure real-time (IMAP) connection to your mailbox so newly received email is detected and filed into the right matter immediately, rather than waiting for a periodic sync.
Google Calendar access
https://www.googleapis.com/auth/calendar.readonly — Redwell reads your Google Calendar to display your existing events and deadlines alongside the related matter.
https://www.googleapis.com/auth/calendar.events — Redwell creates and updates calendar events on your behalf, for example, adding matter deadlines and appointments to your Google Calendar.
Sign-in (basic profile)
openid, https://www.googleapis.com/auth/userinfo.email, https://www.googleapis.com/auth/userinfo.profile — Used only to sign you into Redwell and identify your account by your Google name and email address.
2.4 How Redwell accesses, uses, stores, and shares Google user data
Access. Redwell accesses your Google data only after you explicitly connect your Google account and grant the scopes above, and only for that connected account. You can disconnect at any time from Settings, which stops all further access.
Use. Your Google data is used only to provide the features described above: filing email into the correct matter, drafting, sending, and organizing mail at your direction, and showing and updating matter deadlines on your calendar.
AI processing. To power these features, email and calendar content is processed by Redwell’s AI service provider (currently OpenAI) solely to deliver the features above. This data is not used to train generalized or non-personalized AI/ML models. OpenAI processing runs under Zero Data Retention.
Storage and security. Data is hosted on Amazon Web Services and encrypted in transit (TLS) and at rest. Access is restricted to the systems that provide the features.
Sharing. Redwell does not sell your Google data and does not use it for advertising. It is shared only with the service providers above (AWS hosting; OpenAI processing), strictly as needed to operate the features.
Retention and deletion. Disconnecting stops all further access to your Google account. Deleting your Redwell account or requesting deletion removes the associated Google-derived data, subject to your firm’s continuing control of its Customer Data (see Sections 2.6 and 9).
2.5 Human access to your Google data
Redwell engineers do not read your email content. Production access to Customer Data is restricted to break-glass scenarios (specific user-consented support requests, security incidents, or legal obligations), is time-boxed and reason-required, and is logged.
2.6 How to revoke access and delete your data
You can revoke Redwell’s access to your Google account at any time at https://myaccount.google.com/permissions. You can also disconnect from Settings, which stops all further access. You can delete your Redwell account from Settings → Account → Delete. If you are your firm’s sole account owner, deleting your account deletes the firm and wipes all its data (matters, emails, and documents) immediately. If you are a member of a firm with other owners, deleting your account disconnects your Google account and removes your personal access and account data; emails already ingested from your mailbox remain part of your firm’s Customer Data under the firm’s control, as described in Section 1.1 and the Customer Agreement. See Section 9.
3. How Our AI Platform Handles Data
Because Redwell is an AI-powered platform, we want to be transparent about how data flows through our system.
3.1 We do not train on your data
Redwell does not use Customer Data to train, fine-tune, or improve general-purpose AI models. Your emails, documents, matter files, and any AI-generated outputs are not fed into model training pipelines and are not used to benefit other customers or third parties.
3.2 Inputs and outputs are Customer Data
Information you provide as input (queries, instructions, contextual data from your matter files) and the outputs the platform generates (drafts, summaries, timelines, analysis) are both classified as Customer Data and receive the same protections.
3.3 Service providers that process data
To deliver the features described above, Redwell shares limited data with the following service providers, each under a data processing agreement:
OpenAI OpCo, LLC (San Francisco, CA, USA) — language-model processing for matter classification, party extraction, and document analysis. Google user data and Customer Data sent to OpenAI is processed under an active Zero Data Retention agreement: it is not used to train OpenAI’s models, is not logged for abuse monitoring or human review, and is not retained beyond the immediate processing request on eligible endpoints.
Amazon Web Services, Inc. (Seattle, WA, USA) — application hosting and database storage in the United States.
Supabase, Inc. — authentication and user-account records. Does not receive Gmail or Calendar content.
Resend — outbound transactional email (such as invitations and notifications). Does not receive Gmail or Calendar content.
3.4 Third-party model providers
Where Redwell routes processing requests through a third-party AI model provider, that provider is contractually prohibited from using Customer Data to train its models and is subject to our data processing and security requirements. Where a provider offers a zero- or limited-data-retention option, Redwell uses it; OpenAI processing runs under Zero Data Retention. Image and file inputs are not transmitted to model providers in original form; Redwell sends only extracted text for processing.
3.5 AI outputs are not legal advice
All AI-generated content is designed to assist legal professionals, not to replace professional judgment. Outputs may contain errors, omissions, or inaccuracies. Attorneys are responsible for reviewing and verifying all outputs before reliance, filing, or transmission.
4. Information We Collect
We collect the following categories of Personal Data:
Information you provide to us:
Account registration information (name, email address, firm name, role, phone number);
Billing and payment information (processed through third-party payment processors);
Correspondence and communications you send to us (support requests, feedback, inquiries); and
Any other information you voluntarily submit through the Websites or Services.
Information we collect automatically:
Device information (browser type, operating system, device identifiers);
Log data (IP address, access times, pages viewed, referring URLs);
Usage data (features used, frequency of use, session duration, interaction patterns); and
Cookie and tracking data (as described in Section 6).
Information from third-party sources:
Identity verification and fraud prevention services; marketing and analytics partners; publicly available professional directories; and referral and integration partners you choose to connect.
5. How We Use Your Information
We use Personal Data to provide, maintain, and improve the Services; create and manage your account; process payments and billing; communicate with you about the Services; personalize your experience; conduct research and analytics; market and advertise our Services to you, subject to your opt-out rights; detect and prevent fraud and abuse; enforce our agreements; and comply with legal obligations.
The marketing, advertising, and analytics uses above apply only to information about website visitors and account contacts. They never involve Google user data or Customer Data, which are handled solely as described in Sections 2 and 3.
6. Cookies and Tracking Technologies
We use cookies, pixels, web beacons, and similar tracking technologies to collect information about your interactions with our Websites and Services. You can manage your cookie preferences through your browser settings. We use essential cookies (required for operation), analytics cookies, functional cookies, and marketing cookies. Disabling essential cookies may impair the functionality of the Websites or Services.
7. When We Disclose Your Information
We may disclose Personal Data to service providers who perform functions on our behalf (under contractual confidentiality and use restrictions); to comply with applicable law, legal process, or governmental request, or to protect rights, property, or safety; in connection with a merger, acquisition, reorganization, asset sale, or bankruptcy (with notice before Personal Data becomes subject to a different privacy policy); and with your consent or at your direction.
Redwell does not sell Personal Data for monetary payment. See Section 10 for more information about our practices under state privacy laws.
8. Security
We implement technical, administrative, and organizational security measures designed to protect Personal Data against unauthorized access, alteration, disclosure, or destruction. These include encryption of Customer Data and Content at rest and in transit, strict per-firm tenant isolation enforced at the database layer, access controls, monitoring, and incident response procedures. No method of transmission or storage is completely secure, and we cannot guarantee absolute security. Additional detail is provided in our Security Addendum.
9. Retention and Deletion of Your Data
We retain Personal Data for as long as necessary to fulfill the purposes described in this Privacy Policy and as required by the applicable Customer Agreement, with the following concrete commitments:
Account and contact data: retained for the life of your account and for up to twelve (12) months afterward where needed to meet legal, tax, and accounting obligations.
Customer Data and Google-derived content, including ingested email: retained in the system for as long as your firm exists on Redwell. Deleting an individual member’s account disconnects that member’s Google account and removes their personal access and account data, but emails and other Customer Data already ingested remain under the firm’s control. All of the firm’s Customer Data, including ingested emails, is deleted when the firm itself is deleted. If you are your firm’s sole account owner, deleting your Redwell account deletes the firm and wipes all its data (matters, emails, and documents) immediately.
Disconnecting Google: disconnecting your Google account from Redwell (in Settings) stops all further access and ingestion. Email and calendar data already ingested remains part of your firm’s Customer Data and is deleted when the firm is deleted.
10. Your Privacy Rights
Depending on your state of residence, you may have rights under applicable U.S. privacy laws, including the California Consumer Privacy Act as amended (“CCPA”) and similar state laws: to access the Personal Data we hold about you; to know the categories collected, the sources, the purposes, and the categories of third parties with whom we share it; to delete your Personal Data, subject to legal exceptions; to correct inaccurate Personal Data; to opt out of the sale or sharing of Personal Data for targeted advertising; and to non-discrimination for exercising these rights.
To submit a privacy request, contact us at privacy@redwell.ai. We will verify your identity before processing your request. You may designate an authorized agent to act on your behalf. If we deny a request, you may appeal by contacting the same address.
Redwell does not sell Personal Data for monetary payment. We may share limited Personal Data of website visitors with advertising and analytics partners; under the CCPA and similar laws, this may qualify as a “sale” or “sharing.” To our knowledge, we do not sell or share the personal information of minors under 16. You may opt out of marketing communications at any time using the unsubscribe link in our emails or by contacting us; opting out will not affect transactional or account-related communications.
11. Children
Our Websites and Services are intended for use by legal professionals and are not directed to individuals under 18 years of age. We do not knowingly collect Personal Data from anyone under 18. If you believe a minor has provided us with Personal Data, please contact us at privacy@redwell.ai and we will take steps to delete it.
12. Third-Party Links and Integrations
Our Websites and Services may contain links to, or integrations with, third-party websites, tools, or services. We are not responsible for the privacy practices of those third parties. When you choose to connect a third-party application (for example, an email provider or calendar), that integration is governed by the applicable third party’s own terms and privacy policies in addition to this Privacy Policy and your Customer Agreement.
13. Changes to This Policy
We may update this Privacy Policy periodically to reflect changes in our practices, technologies, legal requirements, or business operations. When we make material changes, we will update the effective date at the top of this page and, where appropriate, provide additional notice. Your continued use of the Websites or Services after the effective date of a revised Privacy Policy constitutes acceptance of the updated terms.
14. Contact Us
If you have questions about this Privacy Policy, our data practices, or wish to exercise your privacy rights, you may reach us at:
RoboLawyer, Inc. dba Redwell
Email: privacy@redwell.ai
Web: redwell.ai
Change Log
v2.1 (June 23, 2026): Added Google User Data and Limited Use section (API and scope disclosure across all Gmail, Calendar, and sign-in scopes; Limited Use commitment; per-scope purposes; how Google data is accessed, used, stored, and shared; no-ads and no-training commitments; human-access disclosure; revoke and delete mechanism); named service providers including OpenAI under an active Zero Data Retention agreement (confirmed Active at the organization level on June 23, 2026); replaced general retention language with concrete windows; set privacy contact to privacy@redwell.ai; added this change log.
v2.0 (April 14, 2026): Prior version.