Privacy notice

Scope

Rillor operates Grellum and is responsible for the information handling described in this notice. This notice covers Grellum's public website, private-beta intake, account enrollment, authenticated legal research application, measured-usage controls, and subscription billing.

Information processed

A private-beta request includes the requester's name and work email and may include a job title, company or firm, and use case. Account enrollment includes name, normalized email, a one-way password hash, selected plan, Terms and Privacy revision acceptance, and account-security records. The application processes research prompts, conversation history, workflow events, citations, generated answers, provider-reported resource-usage observations, weekly usage totals, and plan-admission decisions. Operational logs may include timestamps, request identifiers, bounded error details, and keyed network identifiers used to secure the service and prevent abuse.

Billing information

Stripe processes checkout, payment methods, subscription status, invoices, taxes, refunds, disputes, and billing-portal activity. Grellum does not store full payment-card numbers or card security codes. Grellum stores the Stripe customer and subscription identifiers, selected plan and price mapping, subscription and payment status, billing-operation history, signed-event processing records, and the limited billing details Stripe returns that are needed to provide and support the subscription.

How information is used

Information is used to evaluate private-beta access, create and authenticate accounts, execute and preserve requested research, enforce weekly usage allowances, maintain source mirrors, create and reconcile subscriptions, provide billing support, diagnose failures, prevent abuse, and improve reliability and security. Private-beta contact information is not used to subscribe a requester to unrelated marketing.

Research confidentiality

Do not submit information you are not authorized to process. Grellum is not presently represented as a substitute for a law firm’s confidentiality, conflicts, privilege, records-management, or client-intake controls. Private-beta users should apply their own professional obligations before entering client facts.

Providers and data sources

Research execution uses an isolated Codex research runtime and approved legal-source services. The site worker is configured without access to the operator’s personal connectors or unrelated cloud credentials. Stripe processes billing information under its own privacy terms. Official public legal sources may receive narrowly scoped search and retrieval requests.

Retention and deletion

Private-beta requests and their bounded consent, retry, and submission-audit metadata are retained for up to 12 months unless access is provisioned, the requester asks for earlier deletion, or a legal obligation requires a different period. Keyed intake abuse-prevention fingerprints become eligible for deletion after two days. Account, conversation, and workflow records are retained while an account is active so research can continue in the background and remain available in history. Immutable usage observations, legal acceptance records, invoices, subscription events, disputes, and related audit records may be retained as needed for billing, fraud prevention, tax, accounting, security, and legal obligations even after account closure.

Choices and requests

Account holders may update supported account details and manage payment methods or cancellation through the application and Stripe-hosted billing portal when enabled. Requests to access, correct, export, or delete personal information may be sent to the contact below. A request may be limited where retention is required for security, billing, tax, dispute, legal-hold, or other legal obligations.

Contact and changes

Questions, withdrawal of a private-beta request, and deletion requests may be sent to trevor@grellum.com. Material changes will be published on this page with a revised effective date.