Effective date: 2 November 2026 · Last updated: 1 November 2026 · Version: 2.4

This is a translation. The Russian-language version is the master version and shall prevail in the event of any discrepancy between the language versions.

This Privacy Policy explains how SELLAI LLC (the "SafeLaw", "we", "us" or "our") collects, uses, transfers, stores and protects your personal data when you use the SafeLaw Service (safelaw.ai).

SELLAI LLC is a limited liability company registered in the Republic of Uzbekistan (TIN (STIR): 312530703), with its registered address at 91/7 A. S. Pushkin St., Nukus, Republic of Karakalpakstan, Republic of Uzbekistan. We are the owner and operator of the personal data database within the meaning of the Law “On Personal Data”.

By using the Service, you confirm that you have read, understood and agree to the data processing practices described in this Privacy Policy. If you do not agree, you must not use the Service.

1. Summary

• What we collect: Account information, payment information (processed by the payment provider), content you submit to the Service (including documents and AI queries) and technical data.
• Why we collect it: To provide and improve the Service, process payments, communicate with you, ensure security and comply with legal obligations.
• Who we share it with: The service providers named individually in section 5.1 — FreedomPay (Uzbekistan), Click (Uzbekistan), Payme (Uzbekistan), Netcup GmbH (Germany), OpenAI OpCo, LLC (USA), Anthropic PBC (USA), Voyage AI (USA), Google LLC (USA), Meta Platforms, Inc. (USA), Microsoft Corporation (USA), Yandex LLC (Russia), PostHog Inc. (data in the EU, Germany), Namecheap, Inc. (USA), Telegram FZ-LLC (UAE). Analytics and advertising providers receive data only after you consent to the relevant cookies; the exception is information about sign-up and payment, which is passed to Meta in hashed form from our server (section 6.4).
• Where data is stored and processed: data is stored on servers in Germany (Netcup GmbH); AI queries are processed by AI providers in global regions, including Europe and the USA. See section 6 for details.
• Your rights: Access, correction, deletion, withdrawal of consent — in accordance with applicable personal data protection law.
• Contact for personal data matters: privacy@safelaw.ai, phone: +998 90 590 59 00

2. Personal Data We Collect

2.1 Account Information

When you create a SafeLaw account, we collect:

• Your first and last name
• Your email address
• Your password (stored as an irreversible hash — we never see your password in plain text)
• Your phone number (where necessary)
• Your preferred language

2.2 Payment Information

When you pay for a paid plan, the payment provider through which you pay collects:

• Your Uzcard or Humo card data (card number, expiry date) — collected directly by the payment provider (FreedomPay, Click or Payme) and not stored by SafeLaw
• Transaction history (amount, date, status)

SafeLaw itself does not store full payment card data. Payment card details are entered on the payment provider's side: the card number and sensitive authentication data are not transmitted to, or stored on, SafeLaw's servers.

2.3 Content You Submit

When using the Service, you may submit content, including:

• Text queries and questions you ask the AI
• Documents you upload for analysis
• Information you enter into document templates
• Files attached to support requests

This content may contain personal data about you or third parties. You are responsible for ensuring that you have the right to submit any third-party personal data to the Service.

2.4 AI-Generated Content

We store the outputs the Service generates in response to your queries, linked to your account, so that you can access them later.

2.5 Technical Data

When you access the Service, we automatically collect:

• IP address
• Browser type, version and language
• Operating system and device type
• Pages viewed and actions taken
• Date and time of access
• Performance and error logs

2.6 Communications

When you contact us, we collect the contents of your message, your contact information and any attachments provided.

Enquiries and requests may also reach us via Telegram: @safelaw_support_bot — the support bot, @safelawaibot — the Telegram version of the SafeLaw Service. In that case we process your Telegram user identifier, your Telegram username and the text of your message.

2.7 Sensitive Categories of Information in the Content You Submit

Please note: the documents you upload and the descriptions of your situation that you enter into the Service may contain sensitive information — in particular, about court and other disputes, health, being held legally liable, and family and property circumstances.

You submit such information to the Service on your own initiative and to the extent you consider appropriate. We do not require you to provide it and do not request it separately.

Such information is processed solely to provide the service to you — preparing an answer, analysing a document or generating a document at your request — and is not used by us for any other purpose.

3. Purposes of Processing Personal Data

We process your personal data for the following purposes:

3.1 Providing the Service

• Creating and managing your account
• Authentication at sign-in
• Processing AI queries and generating documents
• Storing your documents and history
• Personalising your experience

3.2 Processing Payments

• Accepting payment for plans via payment providers (FreedomPay — Uzcard and Humo cards, Click, Payme) and, for organisations, also by invoice via bank transfer
• Processing refunds
• Sending invoices and receipts
• Complying with tax obligations under applicable tax law

3.3 Communication

• Sending transactional notifications (confirmations, receipts, subscription notices)
• Responding to your support requests
• Sending Service-related notifications

3.4 Improving the Service

• Analysing usage to identify errors and improvements
• Conducting internal analytics
• Developing new features

User data (questions, conversations, uploaded documents) is not used to train artificial intelligence models — neither ours nor third-party ones. This also applies to the AI responses generated for you.

3.5 Security

• Detecting and preventing fraud and unauthorised access
• Monitoring security incidents
• Enforcing the Terms of Use

3.6 Legal Obligations

• Complying with tax, accounting and regulatory requirements
• Responding to lawful requests from government authorities
• Establishing, exercising or defending legal claims

4. Legal Bases for Processing

We process your personal data on the following bases provided for by applicable personal data protection law:

• Consent of the data subject: By creating an account and using the Service, you give your consent to the processing of personal data for the purposes described in this Policy.
• Performance of a contract: Processing necessary to provide you with the Service in accordance with the Terms of Use.
• Compliance with legal obligations: Processing necessary to comply with applicable tax, accounting and other legal requirements.
• Legitimate interests: Processing necessary to ensure security, prevent fraud and improve the Service, subject to respect for your rights and interests.

5. With Whom We Share Personal Data

We do not sell your personal data. We share data with third parties only in the following cases:

5.1 Service Providers

We share data with the following service providers, which process it for the purposes stated:

• FreedomPay (Uzbekistan) — accepting payments by Uzcard and Humo cards;
• Click (Uzbekistan) — accepting payments through the Click payment service;
• Payme (Uzbekistan) — accepting payments through the Payme payment service;
• Netcup GmbH (Germany) — hosting the production servers of the Service;
• OpenAI OpCo, LLC (USA) — processing AI queries;
• Anthropic PBC (USA) — processing AI queries;
• Voyage AI (USA) — ranking of search results in the database of legal acts;
• Google LLC (USA) — corporate email, and also web analytics (Google Analytics 4) and measurement of the effectiveness of our advertising;
• Meta Platforms, Inc. (USA) — measurement of conversion and of the effectiveness of our advertising (Meta Pixel and Meta Conversions API; email address, phone number, name and account identifier are passed only in hashed form);
• Microsoft Corporation (USA) — analytics of behaviour on the site's pages, heatmaps and session recordings (Microsoft Clarity) — only after consent to analytics cookies;
• Yandex LLC (Russia) — web analytics, click map and session recordings (Yandex Metrica with Webvisor) — only after consent to analytics cookies;
• PostHog Inc. (data is stored and processed in the EU — Frankfurt, Germany) — product analytics and session recordings (PostHog) — only after consent to analytics cookies;
• Namecheap, Inc. (USA) — domain name registrar;
• Telegram FZ-LLC (UAE) — the support bot @safelaw_support_bot and the Telegram version of the Service @safelawaibot (for users who use them).

Each provider receives only the volume of data necessary to perform its function. Your queries and AI responses are not used by the AI providers to train their models. The same list of providers is published at safelaw.ai/security/third-party-providers.

This list constitutes notice of the transfer of personal data to the named recipients (Article 23 of the Law “On Personal Data”); we notify you by email of any change or addition of a recipient no later than three days.

5.2 Government Authorities

We may disclose personal data upon a lawful request from authorised government authorities in accordance with applicable law.

5.3 With Your Consent

We may share your personal data with third parties where you have given us your explicit consent to do so.

5.4 Aggregated Data

We may share aggregated or anonymised data that does not allow you to be identified, for analytical purposes.

6. Storage and Cross-Border Transfer of Personal Data

6.1 Legal requirements

Article 27¹ of the Law of the Republic of Uzbekistan “On Personal Data” (as amended by Law No. ZRU-1125 of 26 March 2026, in force since 27 March 2026) provides (unofficial translation):

“The following personal data are subject to mandatory storage in the territory of the Republic of Uzbekistan: biometric data of individuals; genetic data of individuals; data of individuals who are users of the services of telecommunications operators operating in the territory of the Republic of Uzbekistan. […] Personal data not provided for in part two of this article may be stored and processed outside the territory of the Republic of Uzbekistan if one of the following conditions is met: recognition of a foreign state as a state ensuring adequate protection of personal data; adoption and observance by the operator of standard contractual clauses or binding corporate rules meeting the requirements approved by the authorised state body; observance by the operator of international standards in the field of personal data management and storage, the list of which is approved by the authorised state body.”

6.2 Where data is stored

SafeLaw does not collect biometric or genetic data and is not a telecommunications operator; therefore, the personal data we process are not subject to mandatory storage in the territory of the Republic of Uzbekistan. The SafeLaw personal data database is not subject to mandatory registration in the State Register of Personal Data Databases (part one of Article 20 of the Law as amended by ZRU-1125), as it does not contain the data listed in part two of Article 27¹.

The Service's data is stored on servers of Netcup GmbH in Germany. Germany is included in the list of foreign states ensuring adequate protection of personal data (Resolution of the Cabinet of Ministers of the Republic of Uzbekistan No. 415 of 29 July 2026).

6.3 Processing of AI queries and other recipients

To generate answers, the text of the query and uploaded documents are transferred to providers of artificial intelligence models — OpenAI and Anthropic — and are processed on their infrastructure in global regions, including Europe and the USA. The providers do not use this data to train models. To rank search results in the database of legal acts, the text of the query is transferred to Voyage AI (USA).

A number of other providers listed in section 5.1 are also located in the USA (Google LLC, Meta Platforms, Inc., Microsoft Corporation, Namecheap, Inc.). If you have consented to analytics and marketing cookies, information about your actions on the site is also transferred to Google LLC, Meta Platforms, Inc. and Microsoft Corporation (USA).

If you have consented to analytics cookies, information about your actions on the site and session recordings are also transferred to Yandex LLC (Russia) and to PostHog Inc. — into the PostHog EU cloud (Frankfurt, Germany). Germany and Russia are included in the list of Resolution No. 415 (items 10 and 34). The text you type into the chat field and the texts of questions and answers are masked in session recordings and are not transferred to these providers.

If you link Telegram or contact us through our Telegram bots, your Telegram user ID and username and the text of your request are processed by Telegram FZ-LLC (UAE). The UAE is not included in the list of Resolution No. 415; therefore, such transfer is based on your consent, which you give by linking Telegram or contacting us through the bot.

The USA is included in the list of Resolution No. 415 with a reservation; transfer to AI providers and other recipients in the USA is carried out in accordance with that Resolution (taking into account the reservation to the list) and, in addition, on the basis of your consent (section 6.4).

6.4 Consent and grounds for transfer

By accepting the Terms of Use and this Privacy Policy at registration (the tick box in the registration form) or by paying for the services, you consent to the processing of your personal data and its cross-border transfer (to the USA — OpenAI, Anthropic, Voyage AI, and Meta Platforms, Inc. — sign-up and payment information in hashed form to measure advertising effectiveness; to the UAE — Telegram) for the purposes and to the extent described in this Policy (Article 15(3) of the Law “On Personal Data”); the fact and date of consent are recorded in your account.

The grounds for cross-border transfer are:

• for recipients in Germany, Russia and the USA — the inclusion of these states in the list under Cabinet of Ministers Resolution No. 415 of 29 July 2026 (for the USA — taking into account the reservation to the list);
• for recipients in states not included in the list (the UAE), and additionally for recipients in the USA — your consent to the processing and cross-border transfer of personal data (Article 15(3) of the Law “On Personal Data”);
• the necessity of performing the contract with you (the Terms of Use) to which you are a party.

In addition, information is transferred to the providers of analytics and marketing tools (Google LLC, Meta Platforms, Inc., Microsoft Corporation, Yandex LLC, PostHog Inc.) only after you consent to the relevant cookie category, which you give in the consent banner and may withdraw (Cookie Policy, section 4). The exception is information about the fact of sign-up and payment (the event, amount and plan, and your email address, phone number and account identifier in hashed form only): it is passed to Meta Platforms, Inc. from our server to measure advertising effectiveness on the basis of the consent given at registration or payment (paragraph above), regardless of your choice in the cookie banner. You can withdraw this consent by writing to privacy@safelaw.ai.

Each recipient receives only the volume of data necessary for the relevant purpose. If you do not agree to such transfer, you must not use the Service: without transferring data to these providers, the service cannot technically be provided. This does not apply to analytics and marketing tools: refusing them does not restrict your use of the Service.

7. Cookies

The Service uses cookies and similar technologies. Which categories of cookies are used, what they are used for and how you can manage your choices are described in a separate Cookie Policy (safelaw.ai/cookies), which forms an integral part of this Privacy Policy. Analytics and marketing tools are set only after you have given your consent and send information about your actions on the site to their providers:

• analytics — Google LLC (Google Analytics 4), Microsoft Corporation (Microsoft Clarity), Yandex LLC (Yandex Metrica with Webvisor and click map), PostHog Inc. (PostHog, EU cloud — Germany);
• marketing — Meta Platforms, Inc. (Meta Pixel).

Microsoft Clarity, Yandex Metrica Webvisor and PostHog make session recordings; the text typed into the chat field and the texts of questions and answers are masked and are not recorded.

8. Retention of Personal Data

We retain your personal data only for as long as necessary for the purposes described in this Policy or as required by law.

After these periods, we will delete or irreversibly anonymise your personal data.

9. Your Rights

In accordance with applicable personal data protection law, you have the following rights:

• Right of access: You may obtain information about the processing of your personal data and obtain a copy of such data.
• Right to rectification: You may request correction of incomplete or inaccurate personal data.
• Right to erasure: You may request the destruction of personal data that is processed in breach of the law or is no longer necessary.
• Right to withdraw consent: You may withdraw your consent to the processing of personal data at any time by written request.
• Right to object and restrict: You may object to certain types of processing or request its restriction to the extent provided for by applicable law.
• Right to complain: You may appeal the actions (inaction) of the personal data controller to the competent supervisory authority for personal data protection or to a court.

To exercise your rights, contact us at privacy@safelaw.ai. We respond within 10 (ten) calendar days of receipt. If additional verification is required to prepare the response, we notify you of the extension of the review period. We confirm receipt of your request and inform you of the outcome of its consideration at the email address specified in your account.

10. Person Responsible for Personal Data Processing

The processing of personal data at SELLAI LLC is supervised by the Person Responsible for Personal Data Processing, appointed by order of the director of the Company.

The channel for contacting this person is the email address privacy@safelaw.ai.

11. Security of Personal Data

We take organisational and technical measures to protect your personal data from unauthorised access, alteration, disclosure or destruction in accordance with applicable law. These measures include:

• Encryption of data in transit (TLS)
• Storage of passwords as irreversible hashes
• Access controls for systems and data
• Regular data backups
• Monitoring of and response to security incidents

If a leak of personal data is detected in the course of cross-border transfer, we notify the authorised state body — the Department of Migration and Personalisation under the Ministry of Internal Affairs of the Republic of Uzbekistan — within 24 hours of its detection, and within 72 hours provide it with detailed information on the causes of the leak and the measures taken to eliminate it (paragraph 4 of Resolution of the Cabinet of Ministers No. 415 of 29 July 2026).

However, no method of transmitting data over the Internet is 100% secure. We strive to protect your data but cannot guarantee its absolute security. You are responsible for keeping your account credentials confidential.

12. Children's Privacy

The Service is not intended for persons under 18 years of age, and we do not knowingly collect personal data from persons under 18. If we become aware of such collection, we will take steps to delete the data.

13. Changes to This Privacy Policy

We may update this Policy from time to time. If we make material changes, we will notify you by email and/or in-app notification at least 15 days before the changes take effect. Continued use of the Service constitutes your acceptance of the revised Policy.

14. Contact Us

If you have any questions about this Privacy Policy, contact us:

SELLAI LLC 91/7 A. S. Pushkin St., Nukus, Republic of Karakalpakstan, Republic of Uzbekistan TIN (STIR): 312530703

Personal data and privacy: privacy@safelaw.ai

Legal enquiries and claims: legal@safelaw.ai

General enquiries: info@safelaw.ai

Phone: +998 90 590 59 00

Telegram: @safelaw_support_bot (support bot), @safelawaibot (the Telegram version of the Service)

You also have the right to lodge a complaint with the competent supervisory authority for personal data protection.

Document language. This document is provided in Russian, English and Uzbek. In the event of any discrepancy between the versions, the Russian-language version shall prevail.

By using SafeLaw, you confirm that you have read, understood and agree to this Privacy Policy.