Privacy Notice

Last updated: 19 July 2026

1. Who we are

Plato (“the platform”) is operated by Plato Legal AI Limited (“we”, “us”). For anything in this notice, contact us at intake@plato-legal.ai. Where a matter is handed over to Yiasemis LLC for legal work, Yiasemis LLC handles that matter under its own professional and confidentiality obligations as a Cyprus law firm.

2. What we collect

Account data — name, email, password (stored only as a cryptographic hash), role, sign-in timestamps, terms acceptance.
Registration of interest — name, email, organisation, role, and any message you send us.
Platform content — the questions you ask, the answers you receive, the documents you draft, upload or edit, and saved company details you enter for document drafting.
Matter intake — when you ask for a lawyer, the description and documents you choose to send.
Technical data — IP address, browser user-agent and timestamps for each session and query, kept for security and abuse prevention.
Billing — during the free pilot, nothing: there are no payments and no payment provider.

We use essential cookies only (your sign-in session and a drafting profile reference). There are no analytics or advertising trackers.

3. Why we process it

Providing the platform — answering questions, drafting and storing your documents — performance of a contract (the terms you accept).
Reviewing interest registrations and inviting pilot users — steps prior to entering a contract, at your request.
Security, abuse prevention and rate limiting — IP and user-agent logs — our legitimate interest in keeping the service secure.
Service emails — invitations, confirmations, intake notifications — performance of a contract.
Compliance — legal obligations that apply to us.

4. AI processing

Plato’s answers and document features are powered by third-party AI models. The text of your questions, conversations and documents is sent to our AI model providers to generate answers, search embeddings and reviews. Under our agreements, this content is not used to train their models and is retained by them only for bounded operational periods.

5. Who receives your data

Our hosting provider — hosting and encrypted backups — EU.
Our AI model providers — answers, search embeddings and document reviews — USA.
Our email delivery provider — transactional email — EU sending region.
Yiasemis LLC — legal work on matters you hand over — Cyprus.

Transfers to providers outside the EEA rely on appropriate safeguards (the EU–U.S. Data Privacy Framework and/or the European Commission’s standard contractual clauses). We do not sell personal data, and no one else receives it unless the law requires it. Details of our specific providers are available on request at intake@plato-legal.ai.

6. How long we keep it

Account and platform content — while your account exists. Deleting your account removes your conversations, drafts and documents.
Interest registrations — until reviewed, and for up to 12 months after our last contact with you.
Security logs (IP/user-agent) — 90 days.
Encrypted backups — deleted personal data persists in encrypted off-site backups for up to approximately two months before ageing out.

7. Your rights

You can ask us for access to, correction, erasure, restriction or a portable copy of your personal data, and object to processing based on legitimate interests — write to intake@plato-legal.ai. You can also complain to the Cyprus supervisory authority, the Commissioner for Personal Data Protection (dataprotection.gov.cy).

8. Changes

We will post any changes to this notice here and update the date above. Material changes will be flagged to signed-in users.

See also our Terms & Conditions and Fair Usage Policy.