Privacy Policy

Effective: October 8, 2026

This Privacy Policy explains how Supreme Mind AI, Inc. ("Supreme Mind," "we," "us," or "our") collects, uses, and protects information in connection with the Supreme Mind platform and websites (the "Service"). Supreme Mind provides the Service to law firms and legal professionals. For matter content processed on behalf of a Firm, the Firm is the controller and Supreme Mind acts as its processor/service provider, handling that content only to provide the Service.

1. Information we collect

• Account information: name, email address, job title, firm affiliation, role (for example, firm administrator), and sign-in and session records.
• Matter content: the case information and documents you submit, and the outputs generated for you (collectively, "Matter Content").
• Usage and device data: in the application, metadata about how the Service is used, such as feature and model-call events (who, when, which task, which model and region), credit usage, log and security data, and standard technical data, such as IP address and browser type, used for security, sign-in rate limits and troubleshooting. What we keep on this website is described below, feature by feature.
• Website enquiries: if you send a message through the “Ask Richard” panel on this website, we receive the name, firm, email address and message you provide, together with the page you sent it from. We ask you not to include client confidences, and the panel says so. If you request a demo through the form on this website, we receive your name, work email, firm and, if you give them, your direct line, title, team size, practice area and a note about your matter. The form is delivered to us by Formspree. Booking a call takes you to Calendly, which handles the booking under its own privacy policy.
• Developer API and connected agents: if your firm uses the developer API (api.suprememind.ai) or connects an agent through the MCP server (mcp.suprememind.ai), we keep the API keys and connector grants your firm creates (stored only as one-way hashes, with their name, scopes, the user who created or approved them, and when they were last used), the details of the agent applications that register with us (name and return addresses), metadata-only audit records of each call (which key or agent, which operation, when, and the result), and any webhook address your firm sets. Content sent through the API or an agent is Matter Content and is handled exactly as in the application. Webhook notifications carry identifiers and status, not Matter Content.
• Expert class previews: if you use “Ask this expert” on a page of the expert class library on this website, we collect your name, firm email address, role, practice area and any matter description you choose to give; that you agreed to this Policy and when; whether and when you confirmed your email with the code we send you; the page and class you started from and the classes you asked; each question you ask and the answer it received; how many of your questions you have used; and the country your connection comes from, as reported by our hosting provider. The preview record does not include your IP address; to limit abuse we use a scrambled form of it that cannot be turned back into the address. If searches from the same browser were recorded with an IP address (see Expert searches below), they can be linked to your sign-up. Previews are separate from the application. What you type into a preview is not Matter Content: unlike prompts in the application, it is stored with its answer, and it is not treated as confidential or privileged. Do not enter confidential or privileged information in a preview. When you confirm your email, we receive a notice by email and Slack with your name, firm, role, practice area, first class and the start of any matter description.
• Cookies and local storage: we use minimal cookies and browser local storage necessary to keep you signed in and to remember workspace preferences. Demo sessions store matters only in your browser's local storage; nothing from a demo session is stored on our servers.
  • This public website uses no advertising cookies. It uses Google Analytics to count visits and see which pages are read and which links are clicked, with advertising features and Google signals switched off. Google Analytics sets its own cookies (_ga and _ga_*). If your browser is set to a European time zone, standing in for the EU, the UK and Switzerland, we ask first, in a cookie card with two categories: Necessary (signing in, preferences and security, always on) and Statistics (Google Analytics and the visitor ID on the expert search records described below, off until you turn it on or accept all). Until you do, Google Analytics is not loaded and sets no cookies. You can change your answer at any time under “Privacy choices” at the bottom of every page; declining switches Google Analytics off and deletes its cookies. Browsers that send Global Privacy Control or Do Not Track get no Google Analytics and no question. The website also keeps a visitor ID in your browser’s local storage for the expert search records described below.
  • Expert searches. When you search the expert library on this website, we record the words you searched for, the page you searched from, how many classes matched and which one you opened, the website that sent you here (its domain only), your device and browser, your browser’s language, your IP address, and the country, region and city that Vercel derives from your connection. Each search also carries a random visitor ID kept in your browser’s local storage (sm_vid), so searches from the same browser can be seen together and, if you later sign up for an expert class preview, linked to that sign-up. We use these records to improve the library and the website and to understand who is interested in it, and we delete them after 12 months.
    If your browser is set to a European time zone, we ask first. Until you accept, and if you decline, no visitor ID is created and we keep only the search itself, the page, the country, region and city, and a code that changes every day so we can count searches without following anyone; the same applies to any connection Vercel places in the EU, the UK or Switzerland. Your answer is kept in local storage (sm_consent_v2); “Privacy choices” at the bottom of the page asks you again. Nothing is recorded if your browser sends Global Privacy Control or Do Not Track.
  • Inside the application, Google Analytics records three events only: that a sign-in link was requested at signup, that a matter was created, and that credits were bought. It records no page views, and every event is sent with a fixed page address and title rather than the real ones, so no case name, party, document or other Matter Content ever reaches it. It is not used for browsers with a European time zone or a Global Privacy Control or Do Not Track signal.
  • Vercel Web Analytics counts page views on this site without cookies and without identifying you.
  • Cloudflare delivers this public website and protects it from abuse. It may set a short-lived security cookie (for example cf_clearance) and records aggregate traffic statistics without cookies. The application at app.suprememind.ai does not run through Cloudflare.

2. How we use information

• To provide the Service, including generating outputs by sending the necessary content to our super intelligence (“SI”, the technology also referred to as artificial intelligence or “AI”) model provider (Anthropic, under zero data retention, with Amazon Web Services through Amazon Bedrock as a backup route) for processing;
• To authenticate users, secure the Service, prevent abuse, and enforce rate limits;
• To bill and administer accounts;
• To maintain metadata-only audit records of model calls (privileged content is not written to these logs);
• To evaluate and improve the Service using aggregated or de-identified data (usage and operational metadata, public-record material, and de-identified records of outputs, their settings, and how they compare to public outcomes), excluding the confidential content of matters and any privileged material;
• To run expert class previews, keep them within their limits, understand how they are used and, using the email address you gave, follow up with you about Supreme Mind (you can ask us to stop at any time);
• To support you and communicate about the Service; and
• To comply with law and protect rights and safety.

We do not sell personal information, and we do not use Matter Content to train any model, ours or anyone else’s.

3. How the Service processes content (confidentiality posture)

• The SI model runs server-side. The browser never holds an API key.
• Model calls go to Anthropic’s API under a zero data retention agreement, with inference pinned to the US. Prompts and completions are not stored after the response is returned and are not used to train any model. Amazon Bedrock, in our own Amazon Web Services account in US regions, is held as a backup route on the same no-retention terms, with model-invocation logging not enabled on Matter Content.
• Firm Matter Content (matters, generated briefs, and grounding results) is stored in a US-region PostgreSQL database with per-firm isolation; uploaded documents are stored in a US-region file store. Serverless compute is pinned to a US region.
• Each model call writes a metadata-only audit record. Privileged content is not written to logs.
• The developer API and the MCP server run on the same infrastructure as the application and follow the same rules: US regions, per-firm isolation, no logging of prompts, completions or Matter Content, and no training on it. Access is enabled per firm, and a firm can revoke any key or connected agent at any time.
• Expert class previews are the one place where questions and answers are stored, as described in section 1. A preview answers only from the public court rulings on its class page; it has no access to any firm’s Matter Content, and its records are kept apart from it. Preview answers are generated through the same model route and on the same terms as the application, and nothing from a preview is used to train any model.

4. Subprocessors

We use the following subprocessors to provide the Service:

• Anthropic (SI model processing through the Anthropic API, under zero data retention, with US inference)
• Amazon Web Services (backup SI model processing through Amazon Bedrock, in US regions, used only when the primary route is unavailable)
• Vercel (application hosting and serverless compute, and cookieless page-view counts on this website)
• Google (Analytics: visits and link clicks on this website, and three content-free events in the application, as described in section 1; it does not process Matter Content)
• Neon (PostgreSQL database hosting)
• Cloudflare (delivery and protection of the public marketing website; the application does not run through it, and it does not process Matter Content)
• Formspree (delivery of demo requests sent through the form on this website; it does not process Matter Content)
• Stripe (payment processing; card details go to Stripe directly and never reach our servers)
• Resend (transactional email, such as sign-in links, and the text of feedback or requests you send us)
• Slack (our internal alerts, such as a new signup and the text of feedback or a product request you send from the application, and delivery of messages sent through the “Ask Richard” panel on this website; it receives no documents or case facts)

We may update this list; where required, we will provide notice of changes. Under a pilot or enterprise agreement, a signed data processing addendum (DPA) recording the no-retention and no-training commitments in section 3 is available.

5. Data retention and deletion

• Deleting a matter hides it immediately and permanently deletes it (database rows and stored documents) after a 30-day recovery window. Individual documents delete immediately.
• Demo-session data lives only in your browser and is not retained by us.
• Expert searches on this website are kept for 12 months and then deleted.
• Expert class preview records (your sign-up details, questions and answers) are kept for up to 24 months and then deleted. To have them deleted sooner, write to richard@suprememind.ai.
• We retain account and limited metadata for as long as needed to provide the Service and for legitimate business, legal, and security purposes, after which it is deleted or de-identified.
• On termination, Firm Matter Content is deleted as described above or per your agreement with us.

6. Security

We use administrative, technical, and physical safeguards designed to protect information, including US-region storage, per-firm data isolation, encryption in transit, restricted access, and audit logging. No system is perfectly secure, and we cannot guarantee absolute security.

7. Your rights and choices

Because Matter Content is processed on behalf of the Firm, requests concerning Matter Content should be directed to the Firm; we will assist the Firm as its processor. Depending on your jurisdiction, you may have rights to access, correct, delete, or port certain personal information, or to object to or restrict certain processing. To exercise rights regarding personal information we control, contact richard@suprememind.ai. Firm administrators can manage users and can delete matters and documents directly in the Service.

8. International users

The Service is operated from and stores data in the United States. If you access the Service from outside the United States, you understand that information will be processed in the United States.

9. Children

The Service is intended for professional use by adults and is not directed to children under 16, and we do not knowingly collect information from them.

10. Changes to this Policy

We may update this Policy; material changes will be notified through the Service or by email, and the effective date above will change.

Revision of 8 October 2026. Google Analytics is back on the public website, counting visits and link clicks. Browsers with a European time zone are asked first, in the same card that asks about expert search records, and can change their answer under “Privacy choices”; browsers sending Global Privacy Control or Do Not Track get none of it. Sections 1 and 4 say so, and a plain-English summary was added at the top. Section 1 now also says, feature by feature, where an IP address is kept: in the application for security, with expert-library searches, and not in an expert class preview record.

Revision of 7 October 2026. Section 4 now says that Resend and Slack also carry the text of feedback or product requests you send from the application, and that Slack carries our internal signup alerts. Neither receives documents or case facts.

Revision of 6 October 2026. Model processing moved back to Anthropic, now under a zero data retention agreement with inference pinned to the US. Sections 2, 3 and 4 were updated to say so: Anthropic is named as the model subprocessor, and Amazon Web Services, through Amazon Bedrock, is kept as a backup route on the same no-retention terms.

Revision of 3 October 2026. Sections 1, 2, 3 and 5 now describe the expert class previews on the website: what we collect when you sign up and ask questions, that preview questions and answers are stored and are not Matter Content, how we use them, and that they are kept for up to 24 months.

Revision of 4 October 2026. Sections 1 and 5 now describe the record of searches in the website’s expert library: what is kept, including the IP address and a visitor ID kept in local storage, the consent asked of visitors in a European time zone, and that searches are deleted after 12 months.

Second revision of 2 October 2026. Sections 1 and 3 now describe the developer API and the MCP server for connected agents: what we keep about keys, connector grants and agent applications, and that content sent through them is Matter Content, handled as in the application.

Revision of 2 October 2026. Section 1 now describes the demo request form, Calendly, Vercel Web Analytics and Cloudflare, and how Google Analytics asks for consent from browsers with a European time zone and stays off for browsers that send Global Privacy Control or Do Not Track. Later the same day, Google Analytics was removed from the public website entirely; it remains only for the three content-free events inside the application described in section 1. Section 4 adds Cloudflare and Formspree, which were in use but not listed, and notes Vercel’s page-view counts.

Revision of 1 October 2026. Google Analytics, previously limited to the marketing site, now also records three content-free events in the application: a signup link requested, a matter created and credits bought. Sections 1 and 4 were updated to say so. It still records no page views in the application and receives no Matter Content.

Revision of 29 September 2026. Model processing moved from Anthropic to Amazon Web Services, through Amazon Bedrock, on 16 September 2026. Sections 2, 3 and 4 were updated on 29 September 2026 to name Amazon Web Services as the model subprocessor and to set out what Amazon Bedrock does and does not do with prompts and completions. The commitment not to train on Matter Content was widened at the same time, from third-party foundation models to every model, ours included.

11. Contact

Supreme Mind AI, Inc. Privacy questions: richard@suprememind.ai.

This Policy is provided for general information and does not constitute legal advice.