Privacy Policy — Mudbug Legal Assistant
Parties: MUDBUG SOFTWARE, LLC, a Louisiana limited liability company ("Mudbug," "we," "us," or "our"); and Subscribing law firms, legal organizations, licensed attorneys, paralegals, law-firm staff, and other authorized users of the Services
1. Introduction and Scope
1.1 Who operates Mudbug Legal Assistant. Mudbug Legal Assistant ("Assistant") is a set of software Services operated by Mudbug. The Services are available through https://assistant.mudbugsoftware.com.
1.2 What this Policy covers. This Policy applies to personal information processed through Assistant's hosted legal-drafting, document-generation, and legal-research services, related account and billing functions, and communications concerning those services (collectively, the "Services"). It does not govern the independent privacy practices of a customer's law firm or other organization.
1.3 Professional users only. The Services are intended for people who are at least 18 years old and who are licensed attorneys or act under the supervision of a licensed attorney. The Services are not intended for consumers seeking legal representation or legal advice.
1.4 No attorney-client relationship. Mudbug provides software, not legal representation. Using the Services, contacting Mudbug about privacy, or receiving a generated output does not create an attorney-client relationship with Mudbug. Every output is a draft that must be reviewed by an attorney. Citation checks and links to public sources are safeguards, not substitutes for professional judgment of a licensed attorney.
1.5 Customer responsibility for client information. Customers must not upload or otherwise provide personal information, confidential information, or client material unless they have authority to process that information through the Services and through the service providers described in this Policy. Each customer is responsible for assessing its professional duties of competence, confidentiality, communication, and supervision.
1.6 Defined terms. For this Policy, "Personal Information" means information that identifies, relates to, or can reasonably be associated with a person. "Workspace Data" means chats, uploaded documents, extracted text, generated artifacts, and research records within an Assistant workspace. These plain-language definitions do not replace definitions imposed by applicable law.
2. Information We Collect
2.1 Account Data. We collect a user's name, work email address, password hash, organization, role, and sign-in times. We store a password hash rather than the user's readable password.
2.2 Workspace Data. We collect and store chat messages; uploaded documents and extracted text; generated DOCX, PDF, XLSX, and CSV artifacts; and research records such as citations, URLs, and excerpts from public sources. Workspace Data may contain client confidential information and any other information a customer chooses to include.
2.3 Usage Data. For each service call, we record token counts, the selected skill and model, timestamps, and organization and user identifiers. We use these records for metering, billing, quotas, and abuse prevention. Usage records do not contain prompts or document contents.
2.4 Audit Data. We record audit events such as event type, actor, organization, chat identifier, filenames, and artifact kinds.
2.5 Billing Data. We collect plan, seat, and subscription-status information; usage-credit purchase records and credit balances; Stripe customer and subscription identifiers; and Stripe webhook event payloads. Stripe processes payment-card information. Mudbug does not see or store payment-card numbers.
2.6 Potentially sensitive information. Account authentication information and Workspace Data may include information treated as sensitive under applicable law. Because customers control Workspace Data, Mudbug cannot identify every type of sensitive information that may be uploaded. Customers should provide sensitive information only when they have authority to do so and only when it is reasonably necessary for the requested work.
2.7 Sources of information. We receive information directly from users and organization owners; automatically from sign-ins and use of the Services; from Stripe in connection with subscriptions and payment events; and from public legal sources when the Services conduct research. Generated artifacts and research records are also produced through the user's interaction with the Services.
2.8 Technical log data. When a device connects to the Services, it transmits an Internet Protocol (IP) address, browser type (user agent), and request timestamps. We use this information only to operate and secure the Services — for example, to rate-limit repeated sign-in attempts. The application holds it transiently in memory and does not write it to the records described in Sections 2.3 and 2.4; the infrastructure provider records it in short-lived access logs kept under that provider's standard log-retention practices. We do not use technical log data to profile users or to track them across other websites.
3. How We Use Information
3.1 Provide requested services. We use Account Data and Workspace Data to authenticate users, maintain workspaces, process prompts and documents, conduct requested research, and generate drafts and other artifacts.
3.2 Operate subscriptions. We use Account, Usage, and Billing Data to administer plans and seats, measure token use, enforce monthly allowances and quotas, support checkout and billing, and manage subscription status.
3.3 Secure and maintain the Services. We use Account, Usage, and Audit Data to maintain tenant isolation, investigate errors or suspected misuse, apply rate limits, verify billing events, maintain backups, and protect users and the Services.
3.4 Communicate with users. We use work email addresses to send sign-in links, invitations, and service-related communications.
3.5 No model training. Under the OpenAI API terms and configuration used for the Services, the inputs Assistant sends to OpenAI are not used to train OpenAI models.
3.6 No unrelated advertising use. We do not use Personal Information or Workspace Data for targeted advertising, and no analytics software development kits run in the product.
4. How We Disclose Information
4.1 Limited service-provider disclosures. We disclose information only as needed to operate the Services through the providers described below. We do not allow those disclosures for third-party targeted advertising.
4.2 OpenAI. OpenAI is Mudbug's artificial-intelligence model provider. OpenAI receives the text needed to perform requested work, including user messages, extracted document text, and research results. Under the API terms and configuration used for Mudbug, those inputs are not used to train OpenAI models. Under those same terms, OpenAI may retain API inputs and outputs for a limited period (currently up to thirty (30) days) solely to monitor for abuse and misuse, after which they are deleted.
4.3 Public legal and research sources. CourtListener, GovInfo, eCFR, the Federal Register, Justia, the Legal Information Institute, court websites, SEC EDGAR, the United States Patent and Trademark Office, and native web-search services may receive legal questions, citation searches, and similar research queries. Assistant does not send uploaded documents to those sources. The Services are instructed not to include client names or private facts in search terms.
4.4 Stripe. Stripe receives the subscribing owner's email address, organization identifier, selected plan, seat count, and usage-credit pack purchases to provide checkout and subscription services. Stripe, not Mudbug, receives and processes payment-card information.
4.5 MailerSend email transport. Mudbug's configured SMTP provider receives the information needed to deliver sign-in links and invitations. The provider's identity is MailerSend.
4.6 Hosting, storage, and database providers. Working files are stored on the service volume and mirrored to a configured object-storage bucket for durability and backup. Metadata is stored in Postgres. The applicable infrastructure provider is Railway.
4.7 Legally required disclosures and organizational changes. We may disclose information that we collect or maintain, including Personal Information, in the circumstances described below. Where appropriate and permitted by law, we will seek to limit any disclosure to the information reasonably necessary for the applicable purpose.
*Legal Process and Compliance with Law.* We may disclose information if we reasonably believe that disclosure is required by applicable law or valid legal process, including in response to a subpoena, court order, search warrant, governmental demand, regulatory inquiry, or other legally enforceable request. Where applicable, we may review a request for legal sufficiency and may object to, challenge, or seek to narrow a request that we believe is unlawful, overbroad, or otherwise improper. Unless prohibited by law, court order, or other legal restriction, we may provide notice to the affected customer before disclosing information in response to legal process when we determine that such notice is appropriate.
*No Voluntary Disclosure to Governmental Authorities* Because the Services are designed for use by attorneys and legal professionals, information submitted to the Services may include confidential, privileged, work-product, or otherwise legally protected information. Nothing in this Privacy Policy is intended to waive, diminish, or alter any attorney-client privilege, work-product protection, duty of confidentiality, or other legal protection that may apply to such information. We will not voluntarily disclose the contents of customer communications or Customer Content to governmental authorities except with appropriate authorization, as required or permitted by applicable law, or in circumstances involving an emergency or other situation for which applicable law expressly permits such disclosure.
*Protection of the Services, Our Users, and Others.* We may disclose information when we reasonably believe disclosure is necessary to detect, investigate, prevent, or address fraud, security incidents, malicious or unlawful activity, violations of our agreements or policies, threats to the integrity or availability of the Services, or threats to the rights, property, or safety of Mudbug, our customers, our service providers, or others. Any disclosure under this paragraph will be limited, where reasonably practicable, to information relevant to the applicable investigation, threat, or protective purpose and will be made subject to applicable law and any legal protections governing the information.
*Business Transactions.* If Mudbug is involved in or evaluating a merger, acquisition, financing, reorganization, bankruptcy, sale of assets, change of control, or similar corporate transaction, information may be disclosed to or transferred to prospective or actual purchasers, investors, lenders, professional advisers, transaction participants, or successor entities as reasonably necessary to evaluate, negotiate, complete, or administer the transaction. Where appropriate, we will require recipients of nonpublic information to protect that information through confidentiality obligations or other reasonable safeguards. If such a transaction results in another entity acquiring or assuming control of information governed by this Privacy Policy, that entity may use and process the information subject to applicable law and the privacy commitments applicable to the information. If the transaction results in a material change to the manner in which Personal Information is used or disclosed, we will provide any notice or obtain any consent required by applicable law.
*Preservation Requests.* We may preserve information in response to a legally valid preservation request, litigation hold, governmental request, or when we reasonably believe preservation is necessary to comply with applicable law, protect legal rights, or establish, exercise, or defend legal claims. Preservation of information does not, by itself, constitute disclosure of that information to the requesting party or any other third party.
4.8 No sale or advertising sharing. Mudbug does not sell Personal Information and does not share Personal Information for cross-context behavioral advertising. We do not run advertising or analytics SDKs in the product.
5. Cookies and Tracking Technologies
5.1 Service technologies. The Services use a single first-party cookie, named `mudbug_unified_chat_session`. It is a cryptographically signed session cookie that keeps you signed in and associates your requests with your user account and active organization. It is marked HttpOnly (not readable by page scripts), Secure (sent only over HTTPS), and SameSite=Lax, and it expires no later than 72 hours after your last activity; signing out deletes it immediately. The Services set no other cookies and do not use browser local storage, session storage, or similar client-side storage; sign-in links sent by email are single-use tokens that expire within 20 minutes and are stored only in hashed form. Mudbug does not use advertising cookies or third-party analytics SDKs.
5.2 Security technologies. The Services apply transport encryption (TLS with HTTP Strict Transport Security), a content security policy, request-origin checks, and rate limiting. These protect your session; they do not track you across other websites.
5.3 Third-party pages. If your organization's owner uses the billing checkout or billing portal, those pages are operated by Stripe on Stripe's own domains and are governed by Stripe's cookie and privacy practices, not this Policy.
5.4 Your controls. You may sign out at any time (which deletes the session cookie), and you may delete or block cookies in your browser settings. Because the session cookie is the only mechanism that keeps you signed in, blocking it will prevent you from using the Services while signed in; there is no loss of functionality from blocking any other cookie, as there are none.
6. Your Choices and Privacy Requests
6.1 Workspace controls. Organization owners can delete an individual chat, all chats associated with a user, or the organization's entire workspace from the Account page. Owners can also configure an organization retention window.
6.2 Submitting a request. To ask about, access, correct, obtain a copy of, or request deletion of Personal Information, contact us at admin@mudbugsoftware.com. Describe the account and information involved and the action requested. Any right is subject to applicable law and relevant exceptions.
6.3 Verification. We may need to authenticate the account or request information reasonably necessary to verify the requester and protect client confidential information. We will use verification information only to process and document the request.
6.4 Organization-managed accounts. If an organization provides or manages an account, we may need to coordinate a request with the organization owner. Organization owners control workspace membership, retention settings, and workspace deletion.
6.5 Authorized agents. Where applicable law permits, you may submit a privacy request through an authorized agent. The agent should submit the request to admin@mudbugsoftware.com, identify the person on whose behalf the request is made and the action requested, and include proof of authority: either (a) the requester's signed, written permission designating the agent for the request, or (b) a copy of a power of attorney or evidence of legal authority (such as guardianship or authority under a court order) covering the request. Unless the agent holds a power of attorney or equivalent legal authority, we may also require the person on whose behalf the request is made to verify their own identity with us directly or to confirm to us directly that they gave the agent permission, and we may deny a request from an agent who does not provide sufficient proof of authorization. Verification materials are used only to process and document the request, consistent with Section 6.3.
6.6 Appeals. If Mudbug declines to act on a privacy request, the response will explain why and how to appeal. To appeal, reply to the response (or write to admin@mudbugsoftware.com with the subject “Privacy Appeal”) within sixty (60) days of the decision, identifying the original request and the reason you believe the decision was wrong. Appeals receive a fresh review, and we will respond in writing within sixty (60) days with the outcome and the reasons. If the appeal is denied and a state privacy law applies, the written response will include a way to contact that state's Attorney General to submit a complaint.
6.7 Opt-out signals. Because Mudbug does not sell Personal Information or use it for targeted advertising, there is no sale or targeted-advertising processing to opt out of, and we do not act on browser-based opt-out preference signals such as Global Privacy Control. For the same reason, the Services do not engage in cross-site tracking and do not respond to browser "Do Not Track" signals. If our practices ever change, we will update this Policy and implement the required opt-out mechanisms and signal handling before the change takes effect.
7. Data Retention and Deletion
7.1 Workspace Data. Chats and related Workspace Data remain until an organization owner deletes them or an organization retention window removes them. By default, there is no automatic retention deadline unless an organization configures one.
7.2 Deletion from active storage. When an organization owner deletes a chat, a user's chats, or an organization workspace, we immediately remove the associated local files and mirrored object-storage files and record the deletion event.
7.3 Backups. Backups are snapshots of the service volume and age out under a 35-day backup schedule. Information deleted from active file storage may therefore remain in backup snapshots until the applicable snapshot ages out, no later than 35 days after deletion.
7.4 Account deletion. Deleting an account disables the user and removes the user's workspace memberships. The account's name, email address, and sign-in credentials are removed immediately and permanently at deletion and replaced with a pseudonymous placeholder. The remaining pseudonymous account record is retained only as long as the Usage and Audit Data described in Section 7.5, and is deleted with it.
7.5 Usage and Audit Data. After account deletion, Mudbug retains Usage and Audit Data under pseudonymous identifiers for billing and security records. Usage and Audit Data is retained for three (3) years from the date it is recorded and is then deleted automatically, unless a longer period is required to comply with law, resolve a dispute, or investigate a security incident, in which case only the records needed for that purpose are kept for as long as that purpose requires.
7.6 Billing Data. We retain subscription records, Stripe identifiers, and webhook payloads for seven (7) years from the date of the associated transaction or the end of the subscription, whichever is later, consistent with tax and accounting record-keeping requirements, and then delete them automatically. Stripe applies its own retention practices to information it processes.
8. Security and Confidentiality
8.1 Security measures. Mudbug uses first-party accounts, hardened sessions, cross-site request-forgery origin checks, security headers, per-tenant isolation, rate limits, Stripe signature verification, audit logging, and backups.
8.2 Encryption. Infrastructure providers encrypt stored data at rest. Data is transmitted using HTTPS or TLS.
8.3 Tenant and user separation. Each organization's files are stored under an organization-specific prefix, and each request is bound to one organization. Users can access their own chats; organization-wide matter access is not currently available.
8.4 No absolute security guarantee. No storage or transmission system can be guaranteed to be completely secure. Customers should apply their own access controls, supervision, and professional judgment when deciding what to upload.
8.5 Security incidents and breach notification. If we determine that a security incident has resulted in unauthorized access to or acquisition of Personal Information, we will investigate, take reasonable steps to contain and remediate the incident, and notify affected customers and any regulators or individuals entitled to notice in the manner and within the time required by applicable law. Notice to an affected organization will be sent to its owner's registered email address and will describe, to the extent known, the nature of the incident, the information involved, and the measures taken in response.
8.6 Security reports. Report a suspected security issue to admin@mudbugsoftware.com.
9. Children's Privacy
9.1 Users must be adults. We do not permit people under 18 to create or use an account. The Services are designed for licensed attorneys and people acting under an attorney's supervision.
9.2 Information concerning minors in legal matters. Workspace Data may include information about a minor if an authorized legal professional includes that information in a document, chat, or research request. Customers must have authority to process that information and must use appropriate safeguards.
9.3 Children's privacy compliance. The Services are not directed to children, and Mudbug does not knowingly collect personal information from anyone under 18, or permit anyone under 18 to hold an account. Because the Services are restricted to adult professional users, the parental-notice and parental-consent procedures of the Children's Online Privacy Protection Act (COPPA) do not apply to account holders. Information about a minor that a customer includes in Workspace Data (Section 9.2) is processed on the customer's instructions as part of the customer's legal work, is protected by the same confidentiality, deletion, and retention controls as all other Workspace Data, and is never used for marketing, profiling, or any purpose beyond providing the Services. If we learn that an account was created by someone under 18, we will disable the account and delete its personal information. Parents or guardians who believe a minor has provided personal information to us directly may contact admin@mudbugsoftware.com and we will delete it.
10. International Processing
10.1 United States audience. The Services are offered to licensed attorneys and law-firm personnel in the United States.
10.2 Processing locations and foreign law. Assistant's hosting, database, and object storage are provisioned in United States regions, and OpenAI and Stripe process information in the United States; the email delivery provider may process message metadata in the European Union as well as the United States. The Services are offered only to United States legal professionals, and we do not offer the Services in, or direct them to, the European Economic Area, the United Kingdom, or any other jurisdiction. If a customer's Workspace Data includes information about people located outside the United States, the customer is responsible for having a lawful basis to process that information and to transfer it to the United States; we process it solely on the customer's instructions as described in this Policy and do not offer separate international-transfer mechanisms.
11. State-Specific Disclosures
11.1 General application. The disclosures in this Article apply only when the relevant state law applies to Mudbug's processing and the requester qualifies for protection under that law. We do not use this Policy to state or imply that a particular statutory coverage threshold has been met.
11.2 California collection disclosures. For California notice purposes, Mudbug collects the categories described below. These disclosures describe our practices during the twelve (12) months preceding this Policy's last-updated date and its current practices; the Services launched in 2026 and these categories have applied since launch.
• Account and identifier information: name, work email, password hash, organization, role, and sign-in times. Sources are users, organization owners, and service interactions. Uses include authentication, account administration, communications, security, and subscription management. Recipient categories may include email, infrastructure, and payment providers as applicable. Retention is described in Article 7 and remains subject to the periods in Sections 7.4 and 7.5 (immediate anonymization at deletion; pseudonymous records for three years).
• Workspace and professional-content information: chats, uploaded files, extracted text, generated artifacts, citations, URLs, and public-source excerpts. Sources are users, uploaded materials, generated results, and public research sources. Uses include performing requested drafting and research, storing work product, security, and backup. Recipient categories include OpenAI and infrastructure providers. Public-law services receive only search queries, not uploaded documents. Retention follows Clauses 7.1 through 7.3.
• Usage and activity information: token counts, skill, model, timestamps, organization and user identifiers, sign-in times, and audit events. Sources are interactions with the Services. Uses include metering, billing, quotas, abuse prevention, security, and audit logging. Recipient categories include infrastructure providers. Retention is three (3) years, as described in Section 7.5.
• Internet or network activity information: IP address, browser type, and request timestamps, as described in Section 2.8. The source is the connecting device. Uses are limited to security and operating the Services. Recipient categories include infrastructure providers, whose access logs retain this information briefly under their standard practices; the application itself holds it only transiently.
• Commercial and billing information: plan, seat count, subscription status, usage-credit purchases and balances, Stripe identifiers, and webhook payloads. Sources are subscribing organizations, Stripe, and service transactions. Uses include checkout, billing, subscription administration, and fraud or webhook verification. Recipient categories include Stripe and infrastructure providers. Retention is seven (7) years, as described in Section 7.6.
• Potentially sensitive information: account authentication data and any sensitive material a customer includes in Workspace Data. Sources, uses, recipients, and retention follow the corresponding category above. We use sensitive information only to provide the requested Services and to maintain security — purposes for which California law does not require a right-to-limit mechanism — and do not use it to infer characteristics about anyone.
11.3 California privacy requests. Where the California Consumer Privacy Act (as amended) applies to Mudbug's processing and the requester qualifies as a consumer, California residents may submit requests using the methods in Clause 6.2 to: (a) know and access the Personal Information we have collected about them, including the categories collected, the sources, the purposes, and the categories of recipients; (b) correct inaccurate Personal Information; (c) delete Personal Information, subject to statutory exceptions (including completing the requested Services, security, legal compliance, and internal uses reasonably aligned with expectations); and (d) receive the information in a portable and, to the extent technically feasible, readily usable format. We verify requests as described in Clause 6.3, accept authorized-agent requests as described in Clause 6.5, confirm receipt within ten (10) business days, and respond within forty-five (45) days, extendable once by a further forty-five (45) days with notice. We do not discriminate against anyone for exercising privacy rights — exercising them will not change price, service level, or availability. Denied requests may be appealed under Clause 6.6.
11.4 California sale, sharing, and sensitive-information choices. Mudbug does not sell Personal Information or share it for cross-context behavioral advertising. We therefore do not currently provide a "Do Not Sell or Share" link. Workspace Data is used to provide the requested Services and related security, billing, storage, and backup functions. Because we use sensitive information only for the service and security purposes described in Clause 11.2, California's right-to-limit mechanism is not required. We do not respond to opt-out preference signals (such as Global Privacy Control) because there is no sale or sharing to opt out of; if our practices ever change, we will update this Policy and provide the required links and signal handling before the change takes effect.
11.5 Texas rights. If applicable Texas law covers Mudbug's processing and the requester qualifies as a consumer, the consumer may submit an authenticated request to: confirm whether we process the consumer's Personal Information and obtain access; correct inaccuracies; delete Personal Information provided by or obtained about the consumer; obtain qualifying Personal Information in a portable and readily usable digital format; and opt out of targeted advertising, sale of Personal Information, or profiling that produces legal or similarly significant effects. A parent or guardian may exercise these rights for a known child. We do not sell Personal Information, use it for targeted advertising, or use it for profiling that produces legal or similarly significant effects.
11.6 Texas requests and appeals. Submit a Texas request using Clause 6.2. We authenticate requests as described in Clause 6.3 (using the account and information already held; if a request cannot be authenticated, we will say so and may ask for additional information reasonably necessary to authenticate it). We respond within forty-five (45) days, extendable once by a further forty-five (45) days with notice when reasonably necessary. Declined requests may be appealed under Clause 6.6; a denied appeal will include instructions for submitting a complaint to the Texas Attorney General.
11.7 Louisiana. Louisiana residents may submit privacy questions and requests using Clause 6.2, and Mudbug will honor the rights described in this Policy for them. We are monitoring Louisiana's data-privacy legislation; if a Louisiana comprehensive privacy law takes effect and applies to our processing, we will update this Policy with the required disclosures, rights, and procedures before that law's effective date.
11.8 New York. New York residents may submit privacy questions and requests using Clause 6.2. New York has not enacted a comprehensive consumer privacy statute of the California or Texas type; Mudbug maintains the administrative, technical, and physical safeguards described in this Policy and its security documentation consistent with New York's reasonable-safeguards requirements, and will provide any legally required notice in the event of a security breach affecting New York residents.
11.9 Other states. Residents of other states with comprehensive privacy laws (for example, Virginia, Colorado, Connecticut, and Oregon) may submit requests using Clause 6.2. Where such a law applies to our processing and the requester qualifies for its protections, we will honor the rights that law provides using the verification, response, and appeal procedures in Clauses 6.3 through 6.6, and a denied appeal will include a way to contact that state's Attorney General where the law requires it. Many of these laws exempt information processed in a business-to-business or employment context and apply only above certain processing volumes; Clause 11.1 governs whether a given law applies.
12. Changes to This Policy
12.1 Policy updates. We may update this Policy to reflect changes to the Services, providers, or legal requirements. We will post the updated Policy at https://assistant.mudbugsoftware.com/privacy and revise the last-updated date. Notice of a material change will be provided through an alert displayed in the Services upon sign-in for thirty (30) days following the change. Continued use of the Services after the notice period constitutes acceptance of the updated Policy.
12.2 Review cycle. We will review the California portions of this Policy at least annually while those requirements apply.
13. Contact Us
13.1 Privacy requests and questions. Email us at admin@mudbugsoftware.com, or write to MUDBUG SOFTWARE, LLC, 19061 Turnberry Court, Baton Rouge, LA 70809.
13.2 Security reports. Security reports may be sent to admin@mudbugsoftware.com. Please do not include unnecessary confidential information in an initial report.
14. Effective Date
14.1 Dates. Effective date: August 25, 2026. Last updated: August 26, 2026
Mudbug Legal Assistant is software for use by licensed attorneys and their staff. Every output is a draft for attorney review, not legal advice, and does not create an attorney-client relationship with the operator of this service. Citations are verified against public sources where possible; anything not verified is flagged and must be checked before use.