Last Updated: October 15, 2026
This Privacy Policy describes how Paxton AI, Inc. ("Paxton," "we," "us," or "our") collects, uses, discloses, and protects personal information in connection with paxton.ai and other websites that link to this Privacy Policy (the "Site"), account registration, demos, trials, subscriptions, billing, support, marketing, and Paxton's hosted software platform and related services (collectively, the "Services"). For purposes of this Privacy Policy, "personal information" includes "personal data" and similar terms under applicable law.
Relationship to Terms, DPA, and BAA. Capitalized terms not defined in this Privacy Policy have the meanings given in our Terms of Service (the “Terms”). “Customer Personal Data” means personal information in Customer Data, Output, and related content-bearing derivatives (such as extracted text, prompts, chats, embeddings, indexes, and content-bearing logs) that Paxton processes on a Customer’s behalf, as described in our Data Processing Addendum (the “DPA”). Ordinary account, billing, or service-usage information processed by Paxton independently and not containing Customer content may be subject to this Privacy Policy instead. The DPA is available at DATA PROCESSING ADDENDUM and is incorporated automatically into the Terms to the extent specified there. If a Customer submits Protected Health Information (“PHI”) on behalf of a HIPAA covered entity or business associate, the Customer and Paxton must enter into a separate Business Associate Agreement (“BAA”) before submitting it. Where agreements conflict, the DPA controls Customer Personal Data processing and the BAA controls PHI processing.
This Privacy Policy applies to personal information Paxton processes for its own business purposes, including account administration, billing, sales, marketing, Site analytics, support, security, fraud prevention, legal compliance, and business operations. In those contexts, Paxton generally acts as a business or controller under applicable privacy law.
When Paxton processes Customer Personal Data to provide the Services, Paxton generally acts as a service provider or processor on behalf of the Customer. The Customer determines why Customer Personal Data is submitted and used and is generally responsible for notices, permissions, and responding to privacy requests concerning that data. Paxton processes Customer Personal Data under the Terms, DPA, and any applicable BAA.
If your information appears in Customer Data, such as because you are a client, opposing party, witness, medical provider, employee, family member, or another person identified in a legal matter, please direct your request to the Customer that submitted the relevant Customer Data or on whose behalf it was submitted. Paxton may refer your request to that Customer and provide assistance as required by the DPA and applicable law.
This Privacy Policy does not apply to third-party websites, products, or services that have their own privacy notices. It also does not govern personal information Paxton processes about employees and contractors in the employment relationship; separate notices may apply.
2.1 Account and Business Contact Information
We may collect names, email addresses, phone numbers, job titles, firm or company names, mailing addresses, account credentials, user settings, and similar information when you create an account, request a demo, start a trial, subscribe, contact us, attend an event, or otherwise interact with Paxton.
2.2 Billing and Subscription Information
If you start a trial or paid subscription, Paxton and its payment processor collect and process information needed to administer the trial, process recurring payments, send billing or renewal notices, detect fraud, and manage cancellation and account status. Payment card information is processed by a third-party payment processor. Paxton may receive limited payment-related information, such as billing contact information, payment status, transaction identifiers, card brand, and the last four digits of a card, but Paxton does not store full payment card numbers.
2.3 Customer Data, Prompts, and Output
Customers and Authorized Users may submit, create, or receive content through the Services, including prompts, instructions, queries, uploaded files, document text, legal documents, case files, pleadings, correspondence, contracts, medical records, medical billing records, medical chronologies, expert reports, claim materials, chat or conversation content, generated Output, edits, annotations, citations, and other legal or case-related materials. Personal information in derived materials, such as extracted text, embeddings, search indexes, and content-bearing logs, may also be processed on the Customer’s behalf and is subject to the DPA where applicable.
Customer Data may include personal information about clients, opposing parties, witnesses, medical providers, experts, insurers, employees, contractors, family members, minors, and other individuals. The categories and sensitivity of Customer Data depend on what the Customer submits and how the Customer uses the Services.
2.4 Usage, Device, and Security Information
We may collect technical, diagnostic, security, and usage information, including IP address, device and browser information, operating system, general location derived from IP address, referring pages, pages or screens viewed, features used, session information, timestamps, account, feature, security, and usage activity, error logs, audit and security logs, performance data, and similar information about how the Site and Services are accessed and used.
2.5 Communications, Support, and Feedback
We collect information you provide when communicating with Paxton, including support requests, troubleshooting materials, feedback, survey responses, emails, chat messages, call notes, and recordings of calls or meetings where notice or consent is provided as required by law. If support materials contain Customer Data, Paxton treats that information in accordance with the Terms and applicable agreements.
2.6 Cookies and Similar Technologies
We and third parties, including service providers, may use cookies, pixels, web beacons, local storage, software development kits, and similar technologies to operate, secure, support, analyze, personalize, and improve the Site and Services; authenticate users; remember preferences; measure performance and marketing effectiveness; and support advertising. These technologies may collect information described in Section 2.4. Some third parties may collect information about activity over time and across websites or online services. Section 7 and our Cookie Policy provide additional information.
2.7 Information from Third Parties and Integrations
We may receive information from Customers, Authorized Users, service providers, payment processors, identity or authentication providers, business partners, event organizers, professional and public sources, and other third parties. If you connect a third-party integration, Paxton may receive account identifiers, authorization tokens, configuration information, and the content or records accessible through the connection as disclosed when you enable it. The third party’s own privacy notice governs its independent processing.
2.8 Google Account and Google Drive Data
Google Drive Sync. This section applies when you enable Paxton's Google Drive synchronization integration and describes how we access, use, store, share, and protect information obtained through that integration. The additional Google Drive restrictions apply to that information and its derivatives, not to other Customer Data merely because you have connected Google Drive.
Google permissions and continuous synchronization. When you connect Google Drive, Paxton requests “openid”, “userinfo.email”, “userinfo.profile”, “drive.readonly”, and “drive.file” permissions. The first three permit receipt of a Google account identifier, email address, and basic profile details. The “drive.readonly” permission permits Paxton to view and download files accessible through the connected Google Drive, not only individually selected files; Paxton requires this access for full, continuous Drive synchronization. The “drive.file” permission covers files used with the Paxton integration. Paxton uses these permissions for the connected features you authorize, subject to your Google access permissions and the Services’ functionality.
Use, storage, and connection choices. Paxton uses the Google connection to synchronize accessible file content and metadata, including updates, and to provide the document search, analysis, chat, embedding, and drafting functionality that you enable. It may retain imported files, file names and identifiers, extracted text, searchable representations, related chat context, and authorization tokens needed for these functions. When you disconnect, future synchronization stops and you may elect to keep or delete imported files in Paxton. Files kept in Paxton may continue to support historical chats. Disconnecting or deleting a copy in Paxton does not delete the original file in Google Drive.
Service providers and sharing. Google-derived documents and content may be processed through OpenAI for embeddings and other AI processing, Reducto for optical character recognition (OCR) when required, and relevant hosting and infrastructure providers to deliver the features you authorize. These providers process information only for their relevant service functions, subject to applicable agreements and Google API data-use requirements. Paxton does not transfer Google API Data to advertising platforms, data brokers, or information resellers. This description does not imply that providers have routine human access to your content.
Google Limited Use, AI training, and advertising. Paxton’s use and transfer of information received through Google APIs and information derived from it (collectively, “Google API Data”) adhere to the Google API Services User Data Policy and the Google Workspace User Data and Developer Policy, including their Limited Use requirements. Paxton uses Google API Data to deliver or improve the authorized user-facing features and for other purposes expressly permitted by Google. Paxton does not use, or permit its providers to use, Google API Data to create, train, or improve AI or machine-learning models except to the extent specifically permitted by Google’s policies for an approved user-facing feature, and does not use or transfer Google API Data for advertising. Processing through an AI model to provide a requested feature, such as search, embeddings, or drafting, is not itself model training. General product-improvement, de-identification, advertising, and business-transfer permissions elsewhere in this Policy do not override the Google-specific restrictions.
Security and human access. Google API Data is protected through Paxton’s access-management and security controls described in Section 9. Access is provisioned through identity and access management to personnel whose roles require it. Paxton personnel do not routinely inspect Google-derived content. Human review of specific content is limited to cases permitted by Google, including support requested by the user where any required affirmative permission for the particular content is documented, necessary security investigation, legal compliance, or qualifying aggregated and anonymized internal operations. Technical access alone does not authorize routine inspection for evaluation.
Disconnection, account deletion, and export. When disconnecting Google Drive, you can choose whether Paxton keeps or deletes imported files. Kept files may continue to support historical chats. Deleting your Paxton account removes stored Google-imported files and processed artifacts from Paxton’s active systems, subject to applicable legal preservation requirements and the ordinary backup lifecycle described in Section 8. Deleting a Paxton copy does not delete the source in Google Drive. For as long as Paxton uses or retains Google API Data, it provides export of equivalent information as required by Google’s applicable API terms. Use supported download or export features or contact support@paxton.ai for help with an available export route. Subscription cancellation, Google Drive disconnection, and Paxton account deletion are distinct actions.
Paxton does not intentionally seek sensitive personal information for general Site or marketing purposes, except where reasonably necessary for account security, payments, legal compliance, or another disclosed purpose. Customer Data, however, may contain sensitive personal information, including health information, medical records, medical billing information, government identifiers, financial information, information about minors, and confidential legal or case-related materials.
Customers are responsible for ensuring that they have the rights, notices, consents, authorizations, and other legal bases needed to submit and use Customer Data through the Services. Paxton processes Customer Data as described in the Terms, DPA, this Privacy Policy, and any applicable BAA.
A Customer must not submit PHI on behalf of a HIPAA covered entity or business associate unless the Customer and Paxton have entered into a written BAA. Health-related information is not PHI under HIPAA in every context and may be subject to other privacy laws. The Customer remains responsible for determining which requirements apply to its use case.
Paxton may use personal information for the following purposes:
Where applicable law requires a legal basis for processing, Paxton generally relies on performance of a contract, compliance with legal obligations, consent, and legitimate interests such as operating, securing, supporting, and improving the Site and Services and communicating about Paxton, balanced against applicable privacy rights.
Paxton processes Customer Data and Output to provide the Services requested by the Customer, including running queries, generating Output, maintaining Customer-specific context or retrieval functionality, conducting quality and security checks, providing support, and complying with law.
Paxton does not use identifiable Customer Personal Data to train or fine-tune its own generalized artificial intelligence models. The Services may use third-party AI model providers to process Customer Data, Output, and related content-bearing derivatives for authorized service purposes, subject to the Terms, DPA, any applicable BAA, and law. Paxton requires its third-party AI model providers to contractually prohibit the use of Customer Data, Output, and related content-bearing derivatives to train, fine-tune, or otherwise improve their generalized artificial intelligence models. These providers are also subject to applicable confidentiality, permitted-purpose, and security obligations.
Paxton uses OpenAI's Zero Data Retention (ZDR) controls for eligible API processing, subject to applicable technical limitations and exceptions. These controls limit OpenAI's retention of customer content processed through covered API endpoints. ZDR does not govern Paxton's own retention of Customer Data and Output to provide the Services or the retention practices of other service providers.
Paxton may use product telemetry, feedback that does not contain Customer Data, synthetic data, public data, Paxton-owned data, and aggregated or de-identified information to evaluate and improve the Services. Any aggregated or de-identified information derived from Customer Data must not identify the Customer or any individual. Where Paxton maintains information in de-identified form, Paxton uses reasonable measures to prevent re-identification and does not attempt to re-identify it except as permitted by law to test or validate de-identification.
Google Drive Sync. If a Customer or Authorized User enables Paxton's Google Drive synchronization integration, information obtained through that integration, including copies, extracted content, embeddings, and other derived information ("Google Drive Data"), is subject to the additional use, training, advertising, transfer, and other restrictions described in Section 2.8. These restrictions apply to Google Drive Data and its derivatives, including after disconnection for as long as Paxton retains such information. They do not extend to other Customer Data or Output solely because the Customer uses Google Drive Sync. Information received through other Google APIs remains subject to the requirements applicable to those APIs.
Paxton may disclose personal information in the following circumstances:
Service providers and subprocessors. We use vendors that help host, operate, secure, monitor, support, bill for, and improve the Services, including cloud and AI providers, payment processors, authentication providers, analytics and monitoring tools, communications and customer-support tools, security vendors, and professional advisors. They receive information appropriate to their functions and are subject to contractual or legal obligations appropriate to their role.
Legal and safety matters. We may disclose information when we reasonably believe it is necessary to comply with law, legal process, or a governmental request; enforce agreements; investigate fraud or misuse; or protect rights, safety, or security.
Business transactions. We may disclose or transfer information in connection with a financing, merger, acquisition, reorganization, sale of assets, bankruptcy, or similar transaction, including related due diligence. Google API Data is subject to Google's separate limits on transfers in business transactions, including prior user consent where required.
At your or the Customer's direction. We may disclose information when the relevant user or Customer directs or authorizes us to do so, including through integrations that the user or Customer enables.
Depending on the technologies used, the recipients' roles, and applicable law, certain disclosures of identifiers, device information, commercial information, and internet or other electronic network activity to analytics, marketing, or advertising providers may be considered a sale, sharing, or targeted advertising. Where applicable law requires notice, consent, or an opportunity to opt out, Paxton will provide the required notice or method for exercising that right. Customer Data and Output remain governed by the Terms, DPA, and any applicable BAA. This paragraph does not authorize advertising use or sale or sharing of Google API Data contrary to Section 2.8.
Information about subprocessors processing Customer Personal Data is available at our Subprocessor List, https://www.paxton.ai/legal/subprocessor-list. Customer authorization, changes, and any notice or objection rights are described in the DPA. Google API Data remains subject to the additional disclosures and restrictions in Section 2.8.
We and third parties, including service providers, may use first- and third-party cookies and similar technologies to operate, secure, support, analyze, personalize, and improve the Site and Services; authenticate users; maintain sessions; prevent fraud; remember preferences; measure marketing effectiveness; and support advertising.
Third parties may set or access cookies or similar technologies and, depending on their role and the technology, may collect information about activity over time and across websites or online services for analytics, measurement, personalization, or advertising. The specific technologies and purposes may vary by page, feature, location, and configuration.
You may manage cookies through browser or device settings and through any cookie controls Paxton makes available. Strictly necessary technologies may remain active. Where applicable law requires consent before non-essential technologies are used, or requires an opt-out from sale, sharing, or targeted advertising, Paxton will provide the required mechanism. Some browsers offer a "Do Not Track" setting. Paxton does not currently respond to ordinary Do Not Track signals. Paxton processes legally recognized opt-out preference signals only where and to the extent required by applicable law. Blocking cookies may affect certain Site or Service functionality. The advertising permissions in this Section do not apply to Google API Data in violation of Section 2.8.
For additional information, including technology categories and choices, see our Cookie Policy.
Paxton retains personal information for as long as reasonably necessary for the purposes described in this Privacy Policy, including to provide the Services, administer accounts and subscriptions, maintain security, prevent fraud, comply with tax, accounting, legal, and contractual obligations, resolve disputes, and enforce agreements. Retention periods vary based on the nature and sensitivity of the information, the purpose for processing, legal requirements, and operational needs.
Customer Data, Output, and Customer Personal Data within related content-bearing derivatives are subject to the Terms, DPA, and any applicable BAA for retention, access, export, and deletion. Customers should retain copies using available download or export functionality during the subscription term. Subscription cancellation stops future renewal and is not itself a request to delete Customer Data or Output. Where applicable Data Protection Law requires return or deletion of Customer Personal Data at a Customer’s direction at the end of Services, Paxton will comply through the mechanisms and exceptions described in the DPA. Google Drive disconnection, imported-file deletion choices, account deletion, and data portability are separately described in Section 2.8.
Following termination or expiration, Paxton may delete Customer Data and Output from active production systems in accordance with its retention practices, subject to applicable law, the DPA, any applicable BAA, and any separately agreed retention or return requirement. Residual copies may remain in backups until deleted through the ordinary backup cycle, subject to those requirements. Paxton may retain limited information as permitted by applicable law and applicable agreements for legal compliance, security, dispute resolution, or legal holds.
Paxton may retain aggregated or de-identified information that does not identify a Customer or individual for legitimate business purposes, subject to Section 5.
Paxton maintains commercially reasonable administrative, technical, and organizational safeguards designed to protect personal information and Customer Data against unauthorized access, use, disclosure, alteration, and destruction, including encryption and access controls appropriate to the information and Services. Safeguards may evolve as the Services and risks change.
No method of transmission or storage is completely secure, and Paxton cannot guarantee absolute security. Security incidents affecting Customer Data are handled in accordance with the Terms, DPA, any applicable BAA, and applicable law.
Additional information about Paxton's security practices is available on our Security page.
Depending on where you reside and applicable law, you may have rights to:
To exercise a right concerning personal information Paxton controls, email legal@paxton.ai and describe your request, or use another request method Paxton makes available or accepts as required by law. Including “Privacy Request” in the subject line may help route your email, but is not required. Paxton will not discriminate against you for exercising rights provided by applicable law. For Google API Data retained through the Drive integration, see Section 2.8 for connection, deletion, and export options.
Paxton may verify identity or authority where appropriate and permitted by applicable law, including for certain access, correction, or deletion requests. Verification is not required where applicable law prohibits it, including for applicable requests to opt out of sale or sharing; Paxton may request only information permitted by law that is needed to carry out the request.
An authorized agent may submit a request where permitted by law. Paxton may request proof of authority only as permitted by applicable law. The rights described in this section are available only to the extent provided by applicable law. Paxton will review and respond to requests as required by applicable law or a binding agreement. Where no applicable deletion right exists, Paxton may decline a request. Paxton is not required to provide individualized or selective deletion solely upon request unless required by applicable law or a binding agreement.
Paxton may retain information as reasonably necessary and permitted by law for security, fraud prevention, investigation of misuse, enforcement of its agreements, compliance with legal obligations, or the establishment, exercise, or defense of legal claims. Duplicate requests may be consolidated or closed without a separate substantive response where permitted by law.
If your request concerns Customer Data controlled by one of Paxton's Customers, please contact that Customer. Paxton may refer the request to the Customer or assist the Customer under the DPA.
You may unsubscribe from marketing emails using the unsubscribe link in the email or by contacting Paxton. Paxton may continue to send transactional, billing, security, support, or other administrative messages. You may update certain account information through account settings.
This section applies only to the extent Paxton is required to provide supplemental disclosures under a U.S. state comprehensive privacy law. Together with Sections 2, 4, 6, 7, and 8, it describes Paxton's practices in its business or controller capacity during the preceding twelve (12) months. Customer Personal Data is generally processed by Paxton as a service provider or processor on behalf of a Customer.
Paxton may have collected the following categories of personal information in its business or controller capacity: identifiers and customer-record information; commercial and payment information; internet or other electronic network activity; approximate location derived from IP address; professional or employment-related information; communications and audio or visual information where notice or consent is provided; inferences or analytics derived from account, Site, marketing, and usage information; and limited sensitive personal information, such as account credentials or information reasonably necessary for security, payments, or legal compliance.
Paxton collects these categories from you; Customers and Authorized Users; automatically through the Site and Services; service providers; payment, identity, authentication, analytics, and marketing service providers; business partners; public and professional sources; and other third parties described in Section 2. Paxton uses these categories for the purposes described in Section 4 and may disclose them to the recipients described in Sections 6 and 7.
Certain disclosures of identifiers, commercial information, and internet or other electronic network activity to analytics, marketing, or advertising providers may be considered a sale, sharing, or targeted advertising under applicable law. Where such law applies, Paxton provides the applicable right to opt out and other required choices. Paxton handles personal information of individuals under 16 as required by applicable law.
Paxton uses and discloses sensitive personal information in its business or controller capacity only for purposes reasonably necessary to provide and secure the Services, process payments, comply with law, or perform other permitted purposes. Paxton does not use sensitive personal information in its business or controller capacity to infer characteristics about individuals.
Typical retention criteria by category are summarized below. These criteria may be extended where required for legal holds, security, fraud prevention, disputes, or compliance.
| Category | Typical Retention Criteria |
|---|---|
| Account, contact, and professional information | For the account or business relationship and a reasonable period afterward for administration, support, security, legal, and compliance needs. |
| Billing and transaction information | For the subscription relationship and periods required or permitted for tax, accounting, payment disputes, fraud prevention, and legal compliance. |
| Site, usage, device, and security information | For periods reasonably necessary for operations, analytics, support, security monitoring, incident investigation, and service improvement. |
| Communications and marketing information | For the business relationship, until no longer needed for the relevant purpose, or until an applicable opt-out is processed, subject to legal and recordkeeping needs. |
| Customer Data and Output | As governed by the Terms, DPA, and any applicable BAA, including applicable retention or return requirements, production-system deletion practices, and the ordinary backup cycle. |
| Aggregated or de-identified information | For as long as it remains aggregated or de-identified and is used for a legitimate business purpose consistent with Section 5. |
The Site and user accounts are not directed to individuals under 18 years of age, and Paxton does not knowingly collect personal information directly from children for account creation or marketing. If Paxton learns that a child has directly provided personal information through the Site or an account in violation of this restriction, Paxton will take appropriate steps to delete or disable that information, subject to legal and contractual requirements.
Customer Data submitted by Customers may contain personal information about minors involved in legal matters, including medical, educational, guardianship, family, or damages-related information. Paxton processes that information on behalf of the relevant Customer under the Terms, DPA, and applicable law.
Paxton is based in the United States, and the Services are primarily offered from the United States. Personal information may be processed in the United States and in other locations where Paxton or its service providers operate. Those locations may have data-protection laws that differ from the laws where you reside.
Processing of Customer Personal Data and any applicable international-transfer terms are governed by the DPA or another applicable written agreement. Uses that require additional contractual terms or safeguards not covered by those agreements are subject to the restrictions in the Terms. These provisions do not limit Paxton’s obligations under applicable law.
Individuals outside the United States may have additional rights under applicable law, including the right to complain to a local data-protection authority. You may contact Paxton using the details below.
The Site or Services may contain links to, or integrations with, third-party websites, applications, and services. Paxton does not control and is not responsible for the privacy, security, or data practices of third parties acting independently. Review their privacy notices and terms before providing information or enabling an integration.
Paxton may update this Privacy Policy from time to time. The updated version will be identified by the "Last Updated" date above. If Paxton makes material changes, Paxton will provide notice as required by law, which may include notice through the Site or Services, by email, or by another appropriate method. Changes apply prospectively from the stated effective date unless applicable law requires otherwise.
If you have questions about this Privacy Policy or Paxton's privacy practices, or wish to exercise a privacy right, contact:
Paxton AI, Inc.
Attn: Privacy
3790 El Camino Real, #579
Palo Alto, CA 94306
Email: legal@paxton.ai
For routine account or support requests, you may also contact support@paxton.ai.
© 2026 Paxton AI. All Rights Reserved.
Paxton AI provides self-help services at your specific direction. We are not a law firm or a substitute for an attorney or law firm. Communications between you and Paxton AI are protected by our Privacy Policy but not by the attorney-client privilege or as work product. We cannot provide any kind of advice, explanation, opinion, or recommendation about possible legal rights, remedies, defenses, options, selection of forms, or strategies. Your access to our website is subject to our Terms of Service.