1. Introduction

Legal Life is an AI-assisted legal-life management application operated by MoCharaLx. In this Policy, “MoCharaLx”, “we”, “us” and “our” refer to MoCharaLx as the operator and data controller for the Legal Life service.

This Privacy Policy explains how MoCharaLx collects, uses, stores, protects, shares and deletes personal data when you use the Legal Life website, app, assistants, connected services and related features.

We process personal data in accordance with applicable data-protection law, including the GDPR and applicable Irish data-protection and ePrivacy rules. This Policy applies to the Legal Life service as provided on the date shown above. Optional integrations and features apply only when enabled and used.

The full Privacy Policy is available publicly at https://legal-life.co.uk/privacy-policy. Where consent is required, reading this Policy does not itself replace a separate consent choice.

2. Data Controller

The data controller and operator responsible for Legal Life is MoCharaLx.

• Controller and operator: MoCharaLx, operating the Legal Life service.
• Website: https://legal-life.co.uk/
• General contact: info@legal-life.co.uk.
• Privacy and data-protection contact: privacy@legal-life.co.uk.
• Public privacy and deletion request form: https://legal-life.co.uk/delete-account.

For privacy and data-protection enquiries, contact privacy@legal-life.co.uk. For general enquiries, contact info@legal-life.co.uk.

3. Information We Collect

We collect information that you voluntarily provide, information generated through your use of the application, and information obtained through connected services where you provide permission.

3.1 Account Information

When you create an account, we may collect:

• Name, preferred name and account identifiers
• Email address and authentication/account status information
• Date of birth or age-related information where provided for age-aware routing
• Profile information, country/region, county, nationality, residency information and selected life stages
• Preferences, accessibility settings, language, privacy/consent records and notification preferences
• Subscription, payment-status and transaction identifiers where a paid feature, subscription or donation is used
• If you sign in using Google, we may receive Google account information made available by that authentication flow, such as account email address, name and profile identifier.

We only request information necessary to provide account authentication and app functionality.

4. Life Information and User-Generated Content

Legal Life allows users to organise legal aspects of their personal lives. Users may choose to provide information relating to:

• Birth and family events
• Education
• Employment
• Housing
• Relationships
• Financial matters
• Business activities
• Health-related life events
• Later life planning
• Bereavement and inheritance matters
• Personal goals and reminders
• Private notes and journal entries
• Tasks, deadlines and reminder details
• Trusted-contact information, emergency-preparedness details and shared items you choose to create
• Learning progress, saved insights and other user-selected app preferences

This information is provided voluntarily by the user.

Because some information may relate to sensitive areas of personal life, users control what information they provide and may delete information at any time.

5. Documents and Files

Users may upload documents to Legal Life, including:

• Legal documents
• Identification documents
• Certificates
• Contracts
• Letters
• Records relating to life events

Documents are processed solely to provide features requested by the user, including organisation, reminders, summaries and AI-assisted analysis.

We do not sell uploaded documents or use uploaded documents for advertising purposes.

6. AI Assistant and Chat Data

Legal Life includes four AI assistants: LxMo, the Legal Life concierge and personal legal assistant; Lx, the Legal Guide; Lx Lifeline, the context-aware services and support guide; and Lx Vault Intelligence, the Premium legal evidence and research assistant. They are designed to help users navigate legal information and organise their Legal Life.

When you interact with any of the AI assistants, we may process:

• Chat messages
• Questions submitted by you
• Information you provide during conversations
• Context necessary to generate responses
• Feedback provided by you

AI-generated responses are intended for information and organisational support only and do not constitute legal advice or establish a lawyer-client relationship.

The current source includes an AI-call audit mechanism that can store truncated, pattern-sanitised prompt and response summaries and usage metadata for troubleshooting, reporting and fallback behaviour. Pattern-based sanitisation can miss identifying or confidential details; it cannot guarantee that every personal detail is removed.

AI providers process prompt and context material to generate the response requested. The provider and settings can depend on the enabled feature. Do not submit information you do not wish to have processed through an AI feature.

We do not use your private conversations to advertise products or sell personal information.

7. Connected Google, Microsoft and External Services

Legal Life may offer optional integrations with Google Calendar, Google Drive, Gmail, Google Contacts and Microsoft Outlook / Microsoft 365.

These integrations are optional and require your explicit authorisation. Legal Life does not connect to an external account merely because you have an account with that provider.

Connected information may include calendar events, files and file metadata, email metadata/content excerpts, and contact information, depending on the integration and permissions you authorise.

Connected information is used only to provide the functionality you request, such as finding relevant records, linking them to Life Events, importing selected records into Life Vault, organising legal deadlines, and supporting requested Vault analysis.

We do not sell Google or Microsoft user data, use it for advertising, or use it for unrelated profiling. We do not use Google API data to develop, improve or train generalised AI or machine-learning models.

Imported or synchronised records remain personal data and remain subject to the Privacy Policy and deletion controls after import, even if you later disconnect the external account.

• Access is user-authorised and can be revoked
• Legal Life only requests permissions needed for the enabled integration
• External records are not automatically treated as legal evidence without user action
• You choose whether a connected record is linked to a Life Event or imported to Life Vault
• You can disconnect a provider from Legal Life Settings

Revoking permissions with the provider may stop future synchronisation, but records already imported into Legal Life remain subject to Legal Life retention and deletion controls until you delete them.

8. Personal Data Categories

Depending on how you use Legal Life, we may process the following categories:

9. Special Category Data

Some information provided through Legal Life may fall within the definition of special category personal data under Article 9 GDPR, including potentially:

• Health-related information
• Family circumstances
• Personal identity information
• Other sensitive personal information voluntarily provided by users

Where we rely on explicit consent under Article 9(2)(a) GDPR for a particular optional processing activity, we ask for a separate affirmative choice and record the relevant consent version and time. The applicable Article 6 legal basis and Article 9 condition depend on the purpose; entering information does not by itself mean that every later use is consented to.

Users can withdraw consent for future processing where consent is the legal basis, change optional analytics choices and request deletion. Withdrawal does not make processing carried out before withdrawal unlawful, and data may still be processed on another valid legal basis where permitted by law.

10. How We Use Your Information

We process personal information to:

• Provide Legal Life services
• Manage user accounts
• Provide AI-assisted legal information tools
• Organise life events
• Create reminders, deadline alerts, in-app notices and optional push/email notifications
• Process uploaded documents, private notes and AI-assisted requests
• Provide Google Calendar, Drive, Gmail or other connected-source functions only where enabled and authorised
• Provide account, subscription, checkout and donation functions where used
• Provide optional product analytics only where you enable that category
• Review separately opted-in research data and anonymised reusable contributions
• Improve reliability and accessibility, maintain security and troubleshoot errors
• Respond to support, privacy and user enquiries and comply with legal obligations

11. Legal Bases for Processing

Under GDPR, we rely on the following lawful bases:

Contractual Necessity — Article 6(1)(b): Processing necessary to provide Legal Life services requested by you. Examples include account creation, app functionality and managing your profile.

Consent — Article 6(1)(a): For optional analytics and research choices, connected-account permissions and other optional processing where consent is the selected lawful basis.

Explicit consent — Article 9(2)(a): Where we rely on explicit consent for the particular processing of special-category data.

Legitimate interests — Article 6(1)(f): Where necessary and balanced for security, fraud prevention, service reliability, troubleshooting, limited service improvement and protecting legal rights.

Legal obligation — Article 6(1)(c): Where necessary to comply with an applicable legal obligation.

The lawful basis is determined by the purpose and processing activity. Optional anonymised legal-system research has a separate opt-in setting; it is not the same as optional website analytics.

12. Data Sharing

We do not sell your personal data.

We may share information only where necessary with service providers and where legally required.

The service uses the Base44 platform for application hosting, authentication, database/storage and platform integrations. It uses PostHog for optional product analytics when enabled, Stripe-related checkout integrations for payment, subscription or donation flows where used, and Google or Microsoft services only where the relevant connection is enabled. Base44 integrations may also process requests for AI assistance or send service emails. Providers and data flows depend on the enabled feature and current configuration.

Service providers may process information to provide, secure and support their services under applicable contractual terms. Each provider’s own privacy and retention terms may also apply to data it processes as an independent controller, such as some payment or connected-account operations.

We may disclose information where required by law, court order, regulatory obligation or to protect legal rights. We do not sell personal data.

13. AI Processing and Third-Party AI Providers

Legal Life uses artificial intelligence technologies to provide assistance features.

Where AI services are used:

• Data is processed only to provide requested functionality
• Personal information is not sold
• AI requests are sent to the configured AI service provider used by the feature; the provider may process prompts, context, extracted text and related output to complete the request
• The app audit log is intended to store truncated, pattern-sanitised summaries and metadata rather than raw full prompts/responses; sanitisation is not guaranteed to remove every sensitive detail
• We do not authorise AI providers to use connected Google API data to train generalised AI models
• We limit transmission of personal information to what the enabled feature reasonably requires, subject to technical and provider limitations.

AI features transmit prompts and relevant context to the configured AI provider. Do not submit information you do not want processed by that feature.

13.1 Connecting the app to external AI clients (MCP)

The app can optionally be connected to external AI clients, such as ChatGPT or Claude, using the app’s built-in MCP server. This connection is off unless you explicitly enable and authorise it.

When connected, the AI client you authorised can read app data you grant access to and use app functions you expose, subject to your consent at connection time and the app’s existing access controls. Data shared through that connection is processed under the AI client’s own terms and privacy notice.

You can revoke the connection at any time in the app’s integration settings and in the AI client’s own account settings. Revoking stops future access; data already read by the client remains subject to that client’s retention terms.

14. Data Security

We implement appropriate technical and organisational measures including secure authentication, access controls, encryption where appropriate, data minimisation practices, and monitoring and security reviews.

However, no online service can guarantee absolute security.

15. Data Retention

We retain personal data for as long as reasonably necessary for the purpose for which it was collected, while the account and relevant feature are active, and for any applicable legal, security, dispute-resolution or accounting requirement.

A fixed 30-day recovery period applies to user-deleted Life Vault proof items and assistant conversations/messages. During that period the item is soft-deleted, hidden from ordinary app views and available only through Settings → Account → Recently Deleted. A user may restore it until its stated expiry. At the end of the 30-day period, a daily scheduled process permanently deletes recoverable server-side app records. Deleting one of these items again does not restart the original 30-day clock. For unauthenticated guest chats, active history remains in the current browser session; when a guest deletes a chat, a separate recovery copy is kept in that browser’s local storage for up to 30 days, is not synced to our servers or other devices, and is removed when expiry cleanup next runs on that device. Clearing browser storage or browser privacy settings may remove that copy earlier.

Tasks and Life Events are hard-deleted from the main app database immediately when the user deletes them. When a Life Event is deleted, proof items and assistant conversations/messages still linked to that event are soft-deleted and receive their own 30-day recovery period, so the parent event and its tasks can be removed without automatically destroying the associated evidence or conversation content. Tasks and Life Events themselves are not recoverable through Recently Deleted.

The 30-day recovery period does not apply to a full account-deletion request. The account-deletion flow attempts to delete supported account-linked records and remove the sign-in identity, rather than preserving a 30-day restore copy. If a private file cannot be permanently removed using a supported storage operation, the flow stops and tells you to contact privacy@legal-life.co.uk; it does not report account deletion as complete while leaving the private file behind. Shared legal authorities and common legal-knowledge records are retained separately from personal account content.

These app-level periods do not guarantee immediate erasure from every provider backup, infrastructure replica, security log or external account copy. Such copies may remain for the relevant provider or lawful retention period. Separately stored uploaded file objects are deleted where the storage mechanism supports it. If the storage provider does not expose a supported deletion operation for a private upload, the item is hidden and cannot be restored after its expiry, but the restricted deletion record is retained and an administrative deletion-failure record is raised until the file can be removed. Some security and audit records may be retained where necessary to protect the service or comply with law.

Optional analytics are enabled only if you choose them; research contributions are handled separately under the research choice and relevant contribution rules.

You can request account/data deletion at https://legal-life.co.uk/delete-account or email privacy@legal-life.co.uk. The public request page explains verification and follow-up.

16. Account and Data Deletion

While signed in, use Settings → Account Privacy → Delete Account to start the in-app deletion flow. If you cannot sign in or need the underlying sign-in identity removed as well, use https://legal-life.co.uk/delete-account or email privacy@legal-life.co.uk.

When the in-app deletion flow completes successfully, it removes supported account-linked database records, including life events, tasks, document/evidence records, conversations, journals, trusted-contact links, user submissions, research preferences, notifications, sync settings and relevant app logs, then deletes the associated Base44 User account record. The 30-day recovery window for individual proofs and assistant chats does not delay a full account-deletion request. If the system identifies a private upload that it cannot permanently delete through a supported storage operation, it stops before deleting the sign-in identity and directs you to privacy support so the remaining deletion can be handled without silently orphaning the file. The shared legal-knowledge corpus and common legal-authority source records are deliberately retained rather than deleted with one user account.

Deleting database records does not by itself prove that separately stored uploaded file objects, provider backups, security logs or external account copies have also been removed. If your account contained uploads or connected-service imports, use the public deletion-request route or email privacy@legal-life.co.uk so the request can be verified and any remaining deletion steps followed up. Limited records may be retained where required by law or necessary for security, claims or accounting, subject to access restrictions and applicable retention rules.

Deleting an account does not automatically revoke every external Google/Microsoft permission or erase copies held by those providers. Disconnect the integration or revoke provider access separately; imported copies already stored in Legal Life are addressed by this deletion process.

Account and data deletion request

17. Your GDPR Rights

You have the right to:

• Access — Request a copy of your personal data.
• Rectification — Request correction of inaccurate information.
• Erasure — Request deletion of your information.
• Restriction — Request limitation of processing.
• Data Portability — Request your information in a structured format.
• Objection — Object to certain processing activities.
• Withdraw Consent — Withdraw consent at any time where processing relies on consent.
• Complaint — You may complain to your relevant data protection authority. In Ireland: Data Protection Commission.

18. Children’s Privacy

The full registered My Life service is not intended for children under 12. Public information pages may still be accessible. The app also contains child- and youth-oriented information routes; users aged 12–17 may encounter age-aware experiences and additional safeguards.

Information about a child may still be processed if a user submits it, including in a support request or document. Do not submit children’s personal or sensitive information unless necessary for a feature and an appropriate legal basis and safeguards apply.

Read the separate Children and Young People’s Privacy Notice in the Legals section. For requests involving a child’s data, contact privacy@legal-life.co.uk. We may need to verify the identity and authority of a parent, guardian or young person before acting.

Children and Young People’s Privacy Notice

19. International Data Transfers

The app uses multiple service providers, and the location of processing, support access, backups and subprocessors can vary by provider and feature. The current code configures PostHog analytics to use its European API endpoint when analytics is enabled, but that alone does not establish that every provider or operation remains within the EEA.

Where personal data is transferred outside the EEA, we will rely on a valid transfer mechanism under applicable law, such as an adequacy decision or appropriate safeguards including Standard Contractual Clauses, and supplementary measures where required. International transfers depend on the provider and feature in use. Where required by applicable law, transfers rely on an adequacy decision or appropriate safeguards, including Standard Contractual Clauses and supplementary measures where necessary.

20. Changes to This Privacy Policy

We may update this Privacy Policy periodically.

Where significant changes occur, we will provide appropriate notice through the application or other communication channels.

21. Contact Us

If you have questions about this Privacy Policy or how we process personal data, contact:

MoCharaLx — controller and operator of Legal Life

Privacy and data-protection requests: privacy@legal-life.co.uk

General enquiries: info@legal-life.co.uk

Public deletion and privacy request form: https://legal-life.co.uk/delete-account

Public Legal Life Privacy Policy: https://legal-life.co.uk/privacy-policy

Google API Services User Data Compliance Statement

Legal Life’s use of information received from Google APIs complies with the Google API Services User Data Policy, including Limited Use requirements.

Legal Life accesses Google user data through the relevant Google authorisation flow and uses it to provide the feature the user requests.

Google API data is not sold, used for advertising, or used to develop, improve or train generalised AI or machine-learning models. Google API data is not transferred to others except as necessary to provide the requested feature, for security, to comply with law, or with the user’s affirmative permission.

• Users may disconnect a Google integration or revoke access through Google account permissions; this stops future access to the extent the provider revocation takes effect.
• Google data imported into Legal Life remains subject to the retention, deletion and privacy controls in this Policy.
• Human access to Google API data is restricted to circumstances permitted by the Google API Services User Data Policy, including where necessary for security, legal compliance or user-requested support.