Privacy policy

Personal data

1As used in this Policy:

“user” means an individual who (a) visits isaaclu.com, (b) signs in to use a Project, or (c) contacts Isaac Lu Yang; and

“personal data” means data, whether true or not, about a user who can be identified (a) from that data, or (b) from that data and other information to which Isaac Lu Yang has or is likely to have access.

2Depending on how you use isaaclu.com, the personal data collected may include the following.

(a)Visits. When you visit the site, visits are counted anonymously: the page, what you click, the site you came from, your country and the type of device. This uses no cookies and records no IP address, name or email address. If your browser sends a Global Privacy Control or Do Not Track signal, nothing is counted.

(b)Sign-in. When you sign in to use a Project, the sign-in service (Clerk) holds your email address and, if you sign in with Google, your name and profile photo. It also keeps a record of your sign-ins, including your IP address and browser.

(c)Bot check. Before you use a Project, a bot check (Cloudflare Turnstile) confirms that you are a person. It uses your IP address and information about your browser.

(d)Weekly counts. For each Project, a count of how often you use it each week is kept, linked to your sign-in.

(e)Amicus questions. If you ask Amicus a question, the question is kept, linked to your sign-in.

(f)Documents. If you upload a document to a Project, it is handled as paragraphs 5 and 7 and the Terms of Use describe.

(g)Emails. If you email Isaac Lu Yang, your email address and your message are received.

(h)Connections. The companies that host this site (Cloudflare and Google) receive your IP address and browser details whenever your browser connects to them, and keep records of those connections under their own terms.

3Other terms used in this Policy have the meanings given to them in the PDPA (where the context so permits). “BOA Autobot”, “LLM”, “Projects”, “Output”, “Third Party LLM”, “Usage Data” and “Derived Data” have the meanings given to them in the isaaclu.com Terms of Use.

AI processing and data usage

4Amicus is the only Project that sends your data to an LLM to produce Output. On isaaclu.com, your personal data is sent to an LLM only when you ask Amicus a question.

5On isaaclu.com, the BOA Autobot and Keystone read documents by fixed deterministic rules written in their code. Your documents, and anything you type into those Projects, are not put through an AI language model of any size, or any other model built by machine learning. Keystone’s code includes optional features that can use an LLM, including its assistant, its labelling of clauses and its comparison of changes in the law. On isaaclu.com those features are switched off, and Keystone uses its rule-based versions of them instead. They hold your documents on Google Cloud only for as long as is necessary to provide their features. If you would rather your documents never leave your device, each has an open-source version that runs on your own computer.

6When you ask Amicus a question, the question, up to the two previous questions and answers in the conversation, and the passages retrieved from the papers are transmitted, encrypted in transit, to Google’s Gemini models through Google Cloud’s Vertex AI, which generate the answer. To retrieve those passages, the question, together with the previous question in the conversation, is also sent to Google’s embedding model on Google Cloud.

7Isaac Lu Yang does not use your questions or documents to train, fine-tune or improve any AI model. Under its Google Cloud terms, Google does not use the data Amicus sends it to train its models without Isaac Lu Yang’s permission, and Isaac Lu Yang has not given that permission. Isaac Lu Yang does not control or guarantee how Google handles data.

Data flow for Amicus

7.1Initiation: data is sent only when you ask Amicus a question.

7.2Transit: your question and the conversation are sent, encrypted in transit, to Google Cloud.

7.3Processing: Gemini writes an answer from the retrieved passages. Any quotation that Amicus cannot find word for word in the paper is withheld.

7.4Storage: your question is kept, linked to your sign-in, with a record of whether it was answered, which passages were used and how many tokens were used, and is deleted within 30 days. The answer is not stored.

Collection, use and disclosure of personal data

8Personal data is generally collected only (a) if you provide it voluntarily, after being told the purposes for which it is collected and consenting to its collection and use for those purposes (for example, by signing in to use a Project), or (b) where the PDPA or another law permits or requires its collection and use without consent. Your consent will be sought before additional personal data is collected, or before your personal data is used for a purpose not set out in this Policy, except where the law permits otherwise.

9Your personal data may be collected and used for any or all of these purposes:

(a)providing the Projects you use, including verifying your identity when you sign in;

(b)keeping the Projects for people rather than automated scripts (the sign-in, the bot check and the weekly limits);

(c)improving Amicus and preventing misuse (the Amicus questions);

(d)seeing which parts of the site are read (the anonymous visit counts);

(e)responding to your queries, requests and complaints, including replying to your emails;

(f)complying with any applicable law, regulation or requirement of a governmental or regulatory authority; and

(g)passing it to the service providers in paragraph 10, for the purposes above.

10Your personal data may be disclosed:

(a)to the following service providers, which process it on behalf of Isaac Lu Yang:

• Clerk, for sign-in;
• Cloudflare, for hosting, the bot check, the anonymous visit counts, and forwarding email;
• Google Cloud, for running the Projects and storing the weekly counts and Amicus questions;
• Google’s Gemini models, on Google Cloud, which receive your Amicus question and the conversation, as paragraph 6 describes; and
• Gmail, where email sent to Isaac Lu Yang is delivered; and

(b)where required by law, or by a court or other governmental or regulatory authority.

When the BOA Autobot checks authorities, only the neutral citations of Singapore judgments are sent to eLitigation, from Isaac Lu Yang’s server. No personal data is sent.

Personal data is not sold or used for advertising.

11Isaac Lu Yang may use Usage Data to compile anonymous, aggregated statistics (“Derived Data”), such as how many questions Amicus answered or withheld and how often each Project is used. Derived Data cannot reasonably be used to identify any individual, and is used to understand and improve the Projects.

12The purposes in paragraph 9 may continue to apply for a reasonable period after you stop using isaaclu.com, within the retention periods in paragraph 27.

Reliance on the legitimate interests exception

13In accordance with the PDPA, Isaac Lu Yang may collect, use or disclose your personal data without your consent for the legitimate interests of Isaac Lu Yang or another person. Before relying on the legitimate interests exception, Isaac Lu Yang assesses the likely adverse effect on you, and relies on it only where the legitimate interests outweigh that effect.

14Under the legitimate interests exception, your personal data may be collected, used or disclosed for the detection and prevention of misuse of the Projects, including through the bot check, the weekly limits and the review of Amicus questions.

15This purpose may continue to apply for a reasonable period after you stop using isaaclu.com, within the retention periods in paragraph 27.

Withdrawing your consent

16By signing in to use a Project, you consent to the collection, use and disclosure of your personal data as this Policy describes. Your consent remains valid until you withdraw it in writing. You may withdraw consent, and ask Isaac Lu Yang to stop collecting, using or disclosing your personal data for any or all of the purposes above, by email to the address in paragraph 32.

17A request to withdraw consent may take a reasonable time to process, depending on its complexity, and you will be told of its consequences, including any legal consequences. In general, a request is processed within 30 days of receipt.

18Depending on the nature and scope of your request, you may no longer be able to use the Projects. In particular, you will no longer be able to use the account whose information you want removed to access Projects that require a sign-in. You will be told this before your request is completed. If you decide to cancel your withdrawal, please say so by email, as in paragraph 16.

19Withdrawing consent does not affect the collection, use or disclosure of personal data without consent where the law permits or requires it.

Access to, correction and deletion of personal data

20You may ask, by email to the address in paragraph 32, for (a) a copy of the personal data held about you, or information about how it has been used or disclosed, (b) your personal data to be corrected or updated, or (c) your personal data to be deleted.

21A reasonable fee may be charged for an access request. If so, you will be told the fee before the request is processed.

22Your request will be answered as soon as reasonably possible, and generally within 30 days. If it cannot be answered within 30 days, you will be told in writing, within those 30 days, when it will be answered. If a request cannot be met, you will generally be told why, unless the PDPA does not require it.

Protection of personal data

23To protect your personal data against unauthorised access, collection, use, disclosure, copying, modification, disposal or similar risks, Isaac Lu Yang takes reasonable steps, and relies on the security measures of the service providers. These include:

• collecting as little personal data as possible (for example, the visit counts record no IP address, and Amicus does not store its answers);
• requiring a sign-in and a bot check before any Project can be used;
• encryption of data in transit;
• automatic deletion of stored Amicus questions and weekly counts after a fixed period; and
• keeping service keys in secret stores, out of the code, and protecting the site’s administration page with a password.

24No method of transmission over the internet, and no method of electronic storage, is completely secure. Security cannot be guaranteed, but these measures are kept under review. If a data breach is likely to cause you significant harm, you will be notified as the law requires.

Accuracy of personal data

25Isaac Lu Yang generally relies on the personal data you provide. To keep it current, complete and accurate, please tell Isaac Lu Yang by email if it changes.

Retention of personal data

26Personal data is kept only for as long as it is needed for the purposes for which it was collected, or as the law requires or permits. It ceases to be kept, or the means by which it can be associated with you are removed, as soon as it is reasonable to assume that keeping it no longer serves those purposes and is no longer necessary for legal or business purposes.

27In particular:

• Anonymous visit counts: 30 days.
• Weekly counts and Amicus questions: deleted within 30 days.
• Documents you upload: only for as long as is necessary to provide the Project’s features, as the Terms of Use describe.
• Your sign-in account: until you delete it or ask for it to be deleted.
• Emails: if you send an email to Isaac Lu Yang using your email address, it is kept for the purposes of servicing your requests or questions.
• Records kept by service providers: under their own terms.

Transfers of personal data outside of Singapore

28The Projects run, and the weekly counts and Amicus questions are stored, in Singapore. Clerk keeps sign-in data in the United States. Cloudflare and some Google services, including the Gemini and embedding models that Amicus uses, may process data outside Singapore.

29When personal data is transferred outside Singapore, it is protected by those providers’ contractual terms, and Isaac Lu Yang takes steps to ensure that it continues to receive a standard of protection at least comparable to that under the PDPA.

Cookies and your browser’s storage

30Signing in sets cookies that keep you signed in. They are necessary for the sign-in to work. The anonymous visit counts use a random number stored in your browser tab, not a cookie, and it is removed when you close the tab. Keystone stores which view you last used in your browser.

AI disclaimer

31The Projects provide legal research and document assistance only. Nothing on isaaclu.com, including any Output, is legal advice, and using the site does not create a lawyer–client relationship. You are solely responsible for reviewing and checking all Output before you use it. Section 8.3 of the Terms of Use says more.

Data protection officer

32Isaac Lu Yang is responsible for personal data on this site and acts as its Data Protection Officer. If you have any queries or feedback about how personal data is handled, or wish to make a request, you may contact Isaac Lu Yang:

Email: Isaac Lu Yang by email

Effect of policy and changes to policy

33This Policy applies together with the Terms of Use and any other notice given when personal data is collected. It explains how Isaac Lu Yang handles personal data, and does not form part of any contract.

34This Policy may be revised from time to time. The date below shows when it last changed.