Next Right Law Firm and Legal ConsultancyPrivacy and document processing
Draft for approval before activation — 28 September 2026. No claim of completed compliance review.
Who operates the service?
Next Right Law Firm and Legal Consultancy. Data requests and questions: info@nextrightlaw.com.
Conversations and memory
Messages, projects and working memory are stored in PostgreSQL/Supabase with owner and row-level isolation. The cookie contains a signed session identity, not messages. Guest access renews for 30 days with activity; access expiry does not automatically delete messages.
Attachments
Once enabled, files are privately stored and bound to their conversation and owner. They can be selected in other conversations within the same owner's project. Limits: 10 MiB per file, 5 per question, and 20 files or 100 MiB per owner. Extraction supports PDF up to 20 pages, DOCX, PNG, JPG and WEBP. Corrupt, protected or complex files may be rejected.
Extraction and external processing
Text extraction and OCR run on the service host. Excerpt transmission remains disabled until platform approval and activation, and also requires user consent. After activation the question, context and document excerpts may pass through OpenRouter to the model provider. Visual understanding requires separate activation and consent and transmits one image up to 2 MiB rather than just extracted text. Document contexts are not sent to the Jev router. Document content requires ZDR routing; if no eligible route is available, processing fails instead of weakening that requirement. No processing-region guarantee is made before provider agreements are approved.
Deletion and retention
A file and extracted text expire within 30 days and become inaccessible on expiry. A scheduled purge must be approved and enabled before launch to remove expired files, including inactive-user data. Files can be deleted from the attachments panel. This does not remove quotations in earlier messages; conversation removal requires a separate request to the firm. Backup periods and provider deletion terms require approval before client-document processing is activated.
Safe use
Upload only data you are authorized to process. Remove unnecessary sensitive details and check OCR errors. Download links last five minutes and require the owner's session. Technical logs contain durations and status, not file content or access keys.