Privacy Policy

Last updated: April 8, 2026

AAI for MerusCase ("AAI", "we", "us") is operated by AAI.dev. This policy describes how we collect, use, and protect information when you use our software.

1. What We Collect

Account Information

When you sign up: your name, email, phone number, firm name, MerusCase API token, staff role assignments, and billing information (processed by our payment provider).

Case Data

AAI accesses your MerusCase data through the MerusCase API using your API token. This includes cases, parties, events, tasks, activities, uploads, injuries, contacts, billing ledger entries, and document content.

Your case data is never stored by AAI. It is fetched live from MerusCase during each session and passes through the AI reasoning engine for processing. When your session ends, the data is not retained.

Usage Data

Query logs and audit logs are stored locally on your machine in ~/.aaicase/ with owner-only file permissions (mode 600). We do not collect or transmit this data.

2. Where Your Data Goes

Your case data is transmitted to two destinations: your MerusCase account (via API) and the AI reasoning engine (for query processing). One other destination: AAI's own licence server. No analytics services. No advertising networks. No data brokers. The application contacts AAI's licence server for three things: a version and licence check (the machine's name and licence key); a crash report when the program fails, with paths, IDs, dates, emails, SSN- and phone-shaped numbers and known personal field values removed (turn it off with AAI_NO_CRASH_REPORTS=1 or "crash_reports": false in ~/.aaicasepro/config.json); and a support ticket only when you choose to file one. No case data is sent there on purpose.

3. AI Processing

A third-party AI service processes your queries. Your data is not used to train AI models under the API terms. The AI service's data retention policy applies to data in transit.

4. Local Data Protection

All files in ~/.aaicase/ are mode 600 (owner read/write only)
API token never appears in logs or conversation history
Temp files use secure random directories and are deleted immediately after use
API response cache auto-expires
SSRF protection and path traversal protection enabled

5. Audit Trail

Every write operation is logged to ~/.aaicase/audit.log (appended, never edited in place; rotated at 10 MB with the five newest compressed archives kept, older ones deleted) with timestamp, endpoint, case ID, and API response.

6. What We Do NOT Do

We do not sell, share, or disclose your data to third parties
We do not use your case data to train AI models
We do not store your case data on our servers
We do not collect analytics or usage telemetry; the only automatic reports are the licence check and the redacted, opt-out crash reports described in section 2
We do not access your MerusCase account outside of your active sessions

7. Your Rights

You may request deletion of your account, export your local data from ~/.aaicase/, revoke access by changing your MerusCase API token, or delete all local data by removing the directory.

8. Contact

Email: sean@aai.dev