LegalTax Privacy Policy

Version: 2026-11-07

Last updated: November 7, 2026.

This policy explains how LegalTax handles personal data and confidential content when you visit the website, create an account or use the platform and any of its products. It is read together with the Terms and Conditions and the Cookies Policy.

1. Who is responsible

The provider entity named in the Terms and Conditions and the LegalTax Consortium, which develops and operates the platform, process the data described in this policy. For privacy inquiries and to exercise your rights, write to info@legaltax.com.py.

2. Our rule for private legal work

Your investigations, cases, notes and private documents do not become public content or shared LegalTax knowledge by being uploaded.

• We do not publish them or incorporate them into the general legal corpus.
• We do not mix them with the workspace of other organizations.
• Access is decided on the server according to the organization, the visibility of the resource and the permissions granted; linking a document to an investigation or case does not by itself widen who can read it.
• We do not use them to train artificial intelligence models.

3. What data we process, for what purpose and on what basis

| Data | Purpose | Basis | Who is involved | Retention | | -------------------------------------------------------------------------- | ---------------------------------------------------- | ---------------------------------------------- | ------------------- | ---------------------------------------------------------------------------------- | | Contact details sent from the website (name, email, organization, message) | Answer inquiries | Your request; legitimate interest | Email | The time necessary to answer your inquiry | | Account, authentication, organization, roles and invitations | Create and protect the account, provide the service | Performance of the contract | Hosting | The time necessary for that purpose and as the regulations require | | Orders, payments, receipts, plan, seats | Charge, invoice, comply with accounting obligations | Contract; legal obligation | Payment processor | As required by accounting and tax rules | | Usage (activity to measure hours), security and operational logs | Measure contracted usage, prevent abuse and diagnose | Contract; legitimate interest | Hosting | The time necessary for that purpose and as the regulations require | | Acceptances of terms (version, hash, date and time, IP and browser) | Prove what you accepted and when | Legal obligation; legitimate interest | Hosting | The time necessary for that purpose and as the regulations require | | Investigations, cases, notes and documents you save | Provide the functions you use | Performance of the contract; your instructions | Hosting and storage | Until you delete them or close the account, plus the technical backup cycle | | Queries to He’i, sources used and answers | Answer and let you resume the conversation | Performance of the contract; your instructions | AI provider | Until whoever created the conversation deletes it, plus the technical backup cycle | | Commercial communications (only if you accept them) | Inform you of news | Your consent, revocable | Email | Until you revoke it |

The IP address we store when recording your acceptance is personal data. Full card data is processed by the payment processor, not by LegalTax. You do not need to include personal data or a client’s secrets in a query if they are not necessary. Whoever adds third-party information must have a legitimate basis and respect their professional duties.

4. Private documents

They are stored in storage separate from the public corpus. The file path is generated by the server, the upload is verified and scanned for malware before becoming available, and each download re-checks authorization and uses a temporary link. Initial visibility is private and LegalTax does not create public links for these files.

Deleting a document starts its removal from active storage. Some copies may temporarily remain in technical backups, security logs or retry states until the operational cycle is completed, or be kept if there is a legal obligation or a valid preservation order. We do not present a pending deletion as completed.

5. Personal data in court rulings

That a document comes from a public source does not authorize republishing without judgment all the personal data it contains. We assess each source, keep its provenance and limit what we show to what is necessary and proportionate for legal research. Sensitive data, information about children and adolescents and other content with reinforced protection are excluded, hidden or kept under review. The case title is reserved in Family and Childhood matters, where there are initials of minors and, in Criminal matters, where it carries markers of sensitive offences; the text hides the names of children and adolescents and ID numbers.

Because it is a preserved document, «Ver PDF original» («View original PDF») may show the original without those safeguards, read-only and without download. If you are an affected person, you may request the rectification, reservation or removal of a piece of data by writing to info@legaltax.com.py; we acknowledge receipt within 3 business days and resolve within 15 business days, with priority for minors and victims, and we inform you what we decided and why.

Acordada No. 855/2013 of the Supreme Court (Corte Suprema de Justicia) is not treated as a general authorization to disseminate all jurisdictional information: its article 1 refers to specific categories of proceedings and its article 3 requires safeguarding intimacy and privacy. A new source is not published until its scope and its protection measures have been reviewed.

6. Artificial intelligence

He’i retrieves enabled sources from the corpus before answering. When you use it, the following are sent to the AI provider: your query, the limited history necessary, the source fragments the server selects and, solely, the private documents you have expressly chosen for that action; the interface warns you that only excerpts of the documents you ticked are sent to the AI provider, only for that query. Uploading, saving or linking a file never by itself activates its analysis by AI.

LegalTax does not use this content to train its own models, and our operational logs store quantities, times and states, not the text of the question, the answer or the document.

We store He’i’s visible history (questions, verified answers and references) in your organization’s private database so that you can resume it. It is private to whoever creates it, and belonging to the organization or administering it does not give access. Archiving keeps the conversation; deleting it removes it from the active history and it remains subject to the backup cycle and to any valid preservation obligation. Only a limited window of the history travels to the provider with each query. Answers may contain errors and do not create a lawyer-client relationship with LegalTax.

7. Providers and international transfers

We use providers for hosting and storage, encrypted backups, email, authentication, payments and artificial intelligence and, when enabled, electronic invoicing. They receive only what is necessary for each function.

Some providers, including the AI provider, may process data outside Paraguay, and in the case of AI we cannot today fix the country of processing. If you want to know which providers are involved in your case and where they process data, ask us by email. We will notify you in advance of a change that materially expands the use of private legal content, so that you can assess it before it applies to your documents.

8. Retention

We keep data while the account or the contractual relationship is active and then for the time necessary to allow recovery, resolve claims, maintain security, comply with accounting or legal obligations and complete backups, according to the table in section 3. An expired subscription does not automatically delete your investigations, cases, documents or He’i conversations: we keep them for at least 3 months from the suspension and, when you pay again, you regain access to them.

9. Your rights and how to exercise them

You may request access, rectification, updating or deletion of your data and, where applicable, object to processing or request portability; you may also revoke permissions, delete documents, close your account and manage members according to your role. Write to info@legaltax.com.py from your account email; we may ask you for reasonable information to verify your identity and protect the other members. We acknowledge receipt within 3 business days and respond within 15 business days. If you are not satisfied, you may go to habeas data (hábeas data) and, once the data protection agency is operating, to it.

10. Security and incidents

We apply technical and organizational controls proportionate to the risk: isolation by organization, server-side authorization, temporary links, file verification, anti-malware protection and logs of critical actions. No system connected to the Internet promises zero risk. If an incident compromises information and notification is required, we inform the affected persons or organizations and the competent authority without undue delay.

11. Paraguayan framework and changes

This policy is interpreted together with the National Constitution, Law No. 4868/2013 on Electronic Commerce, Law No. 6534/2020 and the other rules in force on private information, professional secrecy and consumer protection. Law No. 7593/2025 on Personal Data Protection was promulgated and published on 27 November 2025 and enters into force twenty-four months after its publication; we are preparing to apply it from that moment.

We publish changes on this page with their version and date. If a change materially affects the use of private content or of AI, we communicate it to you through an additional channel before applying it.