QuestLaw Privacy Policy

QuestLaw helps legal professionals and students collect and organize research materials, including citations, selected text, source information, notes, projects, and related research information.

QuestLaw is specifically designed around a privacy-preserving architecture. Substantive research data are protected by QuestLaw's Private Vault system and encrypted on the user's device. When those records are synchronized through QuestLaw's cloud infrastructure, the cloud service receives encrypted records rather than the readable plaintext contents of the user's research.

We do not sell user data, use it for advertising, provide it to data brokers, or provide users' research to generative artificial intelligence services.

This Privacy Policy applies to the QuestLaw browser extensions and the account and cloud services used by the Extension. It does not currently govern the separate QuestLaw Microsoft Word add-in.

1. Information QuestLaw Handles

QuestLaw handles several types of information in order to provide its legal-research organization functionality.

Account Information

QuestLaw requires an account. When you create or use an account, QuestLaw may process:

• your email address;
• an account or user identifier;
• authentication tokens and session information;
• authentication status; and
• related information necessary to provide and secure your account.

QuestLaw supports email/password authentication through Supabase. The Chrome extension also supports Google authentication; the Safari extension currently uses email/password authentication.

We use this information to authenticate users, maintain sessions, associate devices with accounts, provide synchronization and account functionality, prevent unauthorized access, and administer the service.

Research Content

QuestLaw processes information that you deliberately save, create, or organize through the Extension. This may include:

• case names and document titles;
• legal citations and pincites;
• selected or highlighted text;
• quotations;
• notes and other text you enter;
• source URLs;
• court, date, reporter, and document metadata;
• projects, folders, sections, tags, and other organization information;
• relationships or annotations between research materials; and
• other research information you choose to save.

QuestLaw does not use the contents of your research for advertising, data brokerage, user profiling, or artificial intelligence model training.

2. Private Vault and Encryption

QuestLaw protects substantive research records through its Private Vault architecture.

Research records are encrypted on the user's device before they are transmitted through QuestLaw's cloud synchronization system.

QuestLaw's cloud research transport is designed not to receive decrypted research objects. Instead, cloud synchronization uses encrypted record envelopes, blinded record identifiers, encrypted or wrapped cryptographic material, and limited metadata necessary to securely operate the synchronization system.

Accordingly, QuestLaw's cloud infrastructure is not designed to provide QuestLaw with access to the plaintext contents of your saved quotations, notes, legal analysis, or other substantive research records stored in the Private Vault.

This protection does not mean that QuestLaw receives no information at all. Certain information must remain available in order to operate accounts and synchronization, including account information, authentication information, device information, synchronization state, and certain cryptographic or protocol metadata.

3. Information Accessed on Westlaw and Lexis+

QuestLaw is designed to work with legal research services including Westlaw and Lexis+.

On supported legal-research pages, the Extension can access webpage content and document structure in order to provide its research-organization functionality.

Depending on the page and feature used, QuestLaw may locally process information such as:

• case or document titles;
• citations;
• reporter information;
• court and jurisdiction information;
• dates;
• legal opinion text;
• selected portions of a document;
• pagination and pincite information;
• URLs;
• document structure; and
• other metadata associated with the legal material.

QuestLaw uses this access to identify, extract, structure, and save legal research.

The Extension is not designed to collect unrelated information from Westlaw or Lexis+, such as account passwords, payment information, or communications.

When a user copies selected text on a supported page, QuestLaw may briefly read clipboard contents to confirm the copy captured the expected text, and then restores the clipboard to its prior contents. QuestLaw does not otherwise read, store, or transmit clipboard contents.

Users may optionally enable a session keep-alive feature, off by default, that periodically sends a lightweight request to a supported research page to help prevent the vendor session from expiring during active use. This feature does not collect additional content from the page.

4. Saving Material From Other Websites

QuestLaw also allows users to deliberately save selected material from webpages outside Westlaw and Lexis+.

When you invoke this functionality, such as by selecting text and choosing the QuestLaw save action, QuestLaw may process:

• the text you selected;
• the webpage URL;
• page title;
• page description or similar metadata;
• publication-date metadata, when available;
• thumbnail or image metadata, when available; and
• favicon or source information associated with the page.

QuestLaw does not use this capability to construct a general browsing history.

Access to an otherwise unsupported webpage occurs in connection with a user action requesting that QuestLaw save material from that webpage.

5. Browsing Information

QuestLaw necessarily processes URLs and source information when a user saves or organizes research associated with a webpage.

For example, QuestLaw may save a URL so that a quotation or research record can later be traced back to its source.

QuestLaw does not:

• monitor your browsing for advertising;
• sell browsing information;
• build advertising profiles based on websites you visit;
• track your activity across unrelated websites for marketing purposes; or
• maintain a general-purpose history of websites you browse.

Any browsing-related information processed by QuestLaw is used to provide the legal-research organization functionality requested by the user.

6. Information Stored on Your Device

QuestLaw stores information locally in your browser in order to provide the Extension.

Locally stored information may include:

• encrypted research records;
• quotations and highlights;
• citations;
• notes;
• projects and research organization information;
• source information and URLs;
• settings and preferences;
• account identifiers;
• authentication and session state;
• synchronization status;
• device identifiers;
• Private Vault information and cryptographic material;
• backup settings; and
• other information necessary for Extension functionality.

Some operational settings may be stored separately from the encrypted research records because the Extension must be able to access them in order to function.

7. Cloud Synchronization

QuestLaw may synchronize a user's encrypted Private Vault with QuestLaw's cloud infrastructure so that research can be available across supported devices or QuestLaw applications.

The cloud synchronization service may receive:

• encrypted research records;
• encrypted record envelopes;
• blinded record identifiers;
• vault identifiers;
• encrypted or wrapped cryptographic keys;
• cryptographic and protocol metadata;
• record types and version information needed to operate the protocol;
• device identifiers;
• device registration information;
• device activity timestamps;
• synchronization state and version information;
• encrypted device-pairing information; and
• other limited metadata required to operate, secure, and maintain synchronization.

The substantive contents of Private Vault research records are encrypted before transmission.

The cloud transport is designed so that the plaintext research object itself is not transmitted to QuestLaw's cloud database.

8. Authentication

QuestLaw uses Supabase for authentication and account infrastructure. Users authenticate with an email address and password. Where supported, including in the Chrome extension, users may instead authenticate with Google.

Authentication may involve processing:

• your email address;
• a Google or Supabase account identifier, depending on the sign-in method;
• authorization codes;
• access and refresh tokens;
• authentication state; and
• other technical information necessary to establish and maintain a secure session.

Google and Supabase process information in accordance with their own applicable privacy terms and policies.

QuestLaw uses authentication information only to provide and secure QuestLaw accounts and related functionality.

9. Service Providers

QuestLaw currently uses the following service providers in connection with the Extension.

Supabase

Supabase provides account authentication, database infrastructure, and encrypted cloud synchronization infrastructure.

Depending on the functionality being used, Supabase may receive:

• account identifiers;
• email addresses;
• authentication information;
• encrypted Private Vault records;
• blinded identifiers;
• encrypted or wrapped cryptographic material;
• device and synchronization metadata; and
• ordinary technical information associated with requests to its services.

The substantive contents of Private Vault research records are encrypted before they are transmitted to Supabase.

Google

Google provides the optional Google authentication service available in supported QuestLaw clients, including the Chrome extension.

Google may process information necessary to authenticate the user's Google account and authorize the user's QuestLaw login.

QuestLaw does not provide users' substantive Private Vault research to Google.

SMTP2GO

SMTP2GO delivers QuestLaw account-confirmation and password-reset messages. It may process the recipient email address and the transactional message needed to deliver those account emails.

QuestLaw does not provide users' substantive Private Vault research to SMTP2GO.

10. Artificial Intelligence

QuestLaw does not currently send Extension research content to OpenAI, Anthropic, Google Gemini, or another generative artificial intelligence provider.

QuestLaw does not use users' research records, notes, highlights, quotations, or other Private Vault contents to train artificial intelligence models.

If QuestLaw introduces functionality in the future that materially changes these practices, we will update our disclosures before collecting or using information in that manner.

11. Analytics

QuestLaw does not currently use a third-party behavioral analytics service in the Extension.

The Extension sends limited first-party feature-usage events to QuestLaw's Supabase infrastructure unless the user disables “Anonymous feature usage” in Settings. Each event contains a random installation identifier, an allowlisted feature name, a general surface and outcome, and the Extension version. The event does not contain an account identifier, email address, webpage URL, citation, quotation, note, document content, search text, or other research content.

Feature-usage events are used to understand whether core product functions work and are retained for up to 30 days. The random installation identifier is not joined to a QuestLaw account. QuestLaw does not retain an IP address or IP-derived identifier in the feature-usage tables, although hosting and network providers may process ordinary technical request information.

12. Error and Crash Reporting

QuestLaw does not currently use a third-party service such as Sentry to automatically collect Extension crash or error reports.

If third-party diagnostic or crash reporting is added in the future and results in additional collection or transmission of user information, our disclosures will be updated accordingly.

13. Advertising and Sale of Information

QuestLaw does not:

• sell personal information;
• sell research information;
• rent user information;
• provide user information to data brokers;
• use Extension information for targeted advertising;
• share Extension information for cross-context behavioral advertising;
• display third-party advertising in the Extension; or
• permit third parties to use QuestLaw research content for their own advertising purposes.

QuestLaw currently uses information only to provide, maintain, secure, troubleshoot, and improve its legal-research organization service.

14. Payments

QuestLaw does not collect or store full payment-card or bank-account details through the Extension or Word add-in. When paid functionality is available, checkout and billing management are hosted by Stripe.

Stripe may process information needed to complete and administer a transaction, including account email, billing address, payment method, tax location, subscription status, invoice information, and transaction identifiers. QuestLaw receives limited billing and subscription records needed to confirm access, provide support, prevent duplicate checkouts, and maintain accounting and tax records.

QuestLaw uses Stripe Tax to calculate and collect applicable tax where configured. Stripe’s handling of payment and tax information is governed by Stripe’s own privacy terms.

15. Backups and Exports

QuestLaw allows users to export or back up their research.

When a user requests or enables a backup, QuestLaw may create a backup file and save it through the browser's or operating system's download functionality.

Backup files are stored in locations controlled by the user and the user's operating system or browser.

Users are responsible for protecting exported or downloaded copies of their research.

Where an encrypted Private Vault export is used, the exported data is maintained in encrypted form.

16. How We Use Information

QuestLaw uses information handled by the Extension only as reasonably necessary to:

• provide legal-research collection and organization functionality;
• identify and structure legal source information;
• save citations, quotations, notes, and other user-selected research;
• authenticate users;
• maintain accounts;
• encrypt and decrypt research locally for the authorized user;
• synchronize encrypted research across supported devices;
• manage trusted devices;
• maintain Private Vault security;
• provide backup, import, and export functionality;
• provide the Extension's user interface;
• diagnose and correct technical problems;
• protect QuestLaw and its users against unauthorized access or abuse; and
• maintain and improve functionality directly related to QuestLaw's legal-research purpose.

QuestLaw does not use information obtained through browser-extension permissions for unrelated purposes.

17. Human Access to Research

QuestLaw's cloud synchronization architecture is designed so that QuestLaw does not receive the plaintext contents of Private Vault research records.

QuestLaw personnel therefore do not ordinarily have the ability to browse or read the plaintext research stored in a user's encrypted cloud vault.

A user may voluntarily provide information to QuestLaw, for example in a support request, bug report, or other communication. Information deliberately provided in that manner may be reviewed as necessary to respond to the user's request.

We may also access information where required by law or where reasonably necessary to investigate security threats, fraud, abuse, or attacks against the service, subject to applicable law and technical limitations.

18. Data Retention

Research stored in a user's Private Vault remains available until the user deletes the relevant research or deletes the associated account and cloud data.

Encrypted research synchronized to QuestLaw's cloud infrastructure may remain there while the associated account remains active.

Account and authentication information is retained as necessary to operate the user's account and provide QuestLaw services.

Locally stored Extension data remains under the control of the browser and the user and may be removed through QuestLaw's deletion functionality, the browser's extension controls, or browser-data controls.

User-created backup or export files are not automatically deleted by QuestLaw because those files are stored in locations controlled by the user.

19. Deleting Your Information

QuestLaw provides functionality for deleting local information and for deleting an account and associated QuestLaw cloud data.

Users may also contact QuestLaw at irac@questlaw.io for assistance with privacy or deletion requests.

Uninstalling the Extension does not by itself necessarily delete an existing QuestLaw account or encrypted information previously synchronized to QuestLaw's cloud infrastructure.

Users who want their QuestLaw account and associated cloud data deleted should use QuestLaw's account-deletion functionality or contact us.

20. Security

QuestLaw uses technical and organizational safeguards intended to protect user information.

QuestLaw's security architecture includes client-side encryption for substantive research records transmitted through the Private Vault synchronization system.

The current Private Vault implementation uses authenticated encryption and cryptographic key wrapping so that substantive research content is encrypted before transmission to the cloud service.

QuestLaw also uses encrypted HTTPS connections when communicating with its service infrastructure.

No security system can guarantee absolute security. Users should therefore maintain appropriate security over their devices, authentication accounts, QuestLaw passwords and recovery information, and exported backup files.

21. Sensitive and Confidential Legal Information

QuestLaw is intended for legal research, and information deliberately saved by users may contain confidential, privileged, personal, or otherwise sensitive information.

QuestLaw does not independently seek to collect categories such as health information, financial information, government identifiers, or other sensitive personal information unrelated to its legal-research purpose.

Such information may nevertheless appear within legal materials or notes that a user deliberately chooses to save.

Users are responsible for determining whether their use of QuestLaw is appropriate for particular information, including under applicable professional, ethical, employment, confidentiality, contractual, or legal obligations.

22. Children

QuestLaw is intended for legal professionals, legal researchers, and students.

QuestLaw is not directed to children under 13, and we do not knowingly solicit personal information from children under 13.

If you believe that a child under 13 has provided personal information to QuestLaw, contact us at irac@questlaw.io.

23. International Users

QuestLaw is operated primarily for users in the United States, but the Extension may be accessible in other jurisdictions.

Depending on where a user is located and where our service providers operate infrastructure, information associated with the user's account may be processed outside the user's home jurisdiction.

Users may contact us at irac@questlaw.io with requests concerning access, correction, deletion, or other applicable privacy rights.

24. Chrome Web Store User Data Policy

QuestLaw's use of information obtained through the Chrome Extension is limited to providing or improving QuestLaw's disclosed legal-research organization functionality and related security and operational purposes.

The use of information received from Google APIs will adhere to the Chrome Web Store User Data Policy, including the Limited Use requirements.

QuestLaw does not use or transfer information obtained through the Extension for personalized advertising, creditworthiness or lending decisions, sale to data brokers or information resellers, or other purposes prohibited by the Chrome Web Store User Data Policy.

25. Apple App Store Privacy Disclosure

The Safari extension uses the same Private Vault, account, cloud-synchronization, and limited feature-usage systems described in this Policy. QuestLaw's App Store privacy responses describe the data practices of the containing macOS app, the Safari extension, and the third-party services they use.

The Safari extension requests access only to supported Westlaw and Lexis+ websites, and Safari requires the user to grant that access. QuestLaw does not use Safari website access to build an advertising profile or a general browsing history.

26. Changes to This Privacy Policy

We may update this Privacy Policy when QuestLaw's functionality or information-handling practices change.

If we materially change what information the Extension collects, how that information is used, or the parties with whom it is shared, we will update this Privacy Policy and provide additional in-product or other notice where required.

The effective date at the beginning of this Privacy Policy identifies the current version.

27. Contact

Questions, privacy requests, and other concerns may be directed to:

QuestLaw
Website: questlaw.io
Email: irac@questlaw.io