OrionLaw Privacy Policy
Last updated: September 21, 2026 · Effective: September 21, 2026
1. Introduction
OrionLaw (referred to as "we", "us", or "our") is an AI legal workspace built for small and medium businesses and startup teams. This Privacy Policy (the "Policy") applies to our website at https://law.waveinsight.cn, the OrionLaw product, and its API access capability (together, the "Service"). It explains what personal information we collect when you use the Service, how we use, store, share, and protect it, and what rights you can exercise.
- Operating entity: Hangzhou Shenxiu Si Technology Co., Ltd. (杭州参宿四科技有限公司)
- Contact for privacy matters: 867663065@qq.com
See also our Terms of Service.
In one sentence: your contracts and uploaded files are not retained — they are used only to parse and generate results for the current task, and are removed from our servers once that processing finishes.
Please note in particular: contract review, contract drafting, and legal Q&A require us to process the contract text, documents, and conversations you upload or paste. Those materials may contain personal information and trade secrets belonging to you, your counterparties, your employees, or other third parties. Please confirm that you are authorized to submit them (see Sections 2.2 and 5).
2. Information We Collect
2.1 Account and identity information
| Type of information | When it is collected | Notes |
|---|---|---|
| Mobile phone number | Registration, SMS-code login, password reset | Required to create an account |
| Password | When you set or change a password | Stored only as a salted hash (bcrypt), never in plain text; optional if you sign in with verification codes only |
| WeChat authorization data | When you choose WeChat QR sign-in or link your account | openid, unionid, nickname, avatar; not collected if you do not use WeChat sign-in |
| Account records | Throughout your use of the Service | User ID, account status, registration and last sign-in time |
2.2 Content you submit
- Contracts and documents (used for processing, original not retained): files you upload or text you paste, file names and formats, extracted text, and the contract type, scenario, and parameters you provide (such as party names and terms). We do not retain your contract text or the contract file itself: it is read and processed only while the review, drafting, or parsing task runs, and is removed from our servers when that processing ends.
- Review and drafting results: AI-generated risk lists, risk levels, suggested revisions, drafted clauses, redline comparisons, and export records.
- Q&A sessions: your questions and follow-ups, AI answers, cited sources, and conversation titles.
To perform this processing we must send the relevant text to an upstream AI model provider, which returns the results (see Section 4). That text is used for the current task only.
Sensitive personal information: if a contract genuinely contains sensitive personal information such as identity card numbers, bank account numbers, biometric data, or health data, please redact or mask it before uploading, and submit only the minimum information necessary for the task.
2.3 Usage and billing records
- Invocation records: feature, endpoint, quota consumed, request ID, timestamp, and calling platform and client version.
- Quota and ledger entries: daily quota, weekly cap, boost-pack (credit) balance, and entries for top-ups, charges, rollbacks, adjustments, and support-initiated changes.
- Orders and payments: order number, order type, amount, payment status, and the transaction number returned by the payment institution. We do not collect or store your payment password or full bank card number; those are handled directly by the payment institution.
- Notifications and support records: quota and expiry reminders, and records of your communications with us.
2.4 Device and log information
- IP address, browser and operating system information, client version, request times and endpoint paths;
- Error and crash logs, and API rate-limiting records;
- Administrative audit logs: records of administrator actions on accounts, plans, and pricing, kept for internal audit and compliance.
2.5 Information stored in your browser
The Service's web interface stores a small amount of data in your browser, on your own device:
| Content | Purpose |
|---|---|
| Sign-in tokens (access / refresh token) | Keep you signed in |
| Sidebar open state | Remember your interface preference |
| "Remember account and password" | Written to local storage only if you tick the option, and expires automatically after 7 days; removed by clearing browser data or unticking the option |
| Session drafts and API key activity records | Improve your experience |
You can clear this local data at any time through your browser settings. You will need to sign in again afterwards.
2.6 Information we do not collect
- Browsing history unrelated to the Service;
- Contents of system permissions such as contacts or photo library (the Service does not request these permissions);
- Payment passwords or full bank card numbers;
- We do not sell or rent your personal information.
3. How We Use Your Information
| Purpose | Information used | Basis |
|---|---|---|
| Provide contract review, contract drafting, and legal Q&A | Content you submit, account information | Necessary to perform our contract with you |
| Registration, sign-in, and identity verification | Phone number, verification codes, account records | Necessary to perform our contract with you |
| Quota accounting, payment collection, and reconciliation | Usage and billing records, order information | Necessary to perform our contract with you |
| Customer support and dispute handling | Contact details, communication records, order information | Necessary to perform our contract with you |
| Service security and risk control (abuse prevention, rate limiting, audit) | Device and log information | Necessary to comply with legal obligations and to perform our contract with you |
| Sending verification codes and essential notices by SMS or email | Phone number, email address | Necessary to perform our contract with you |
| Product improvement and statistical analysis | De-identified or aggregated usage and performance data | Statistical information after de-identification |
Model training: we do not use your contract content or Q&A content to train general-purpose models that are made available to the public. If we later intend to use de-identified content for model improvement, we will inform you separately and obtain your consent.
4. Sharing and Third-Party Services
We do not sell or rent your personal information. We share or entrust processing only in the following necessary cases:
| Recipient | Information shared | Purpose |
|---|---|---|
| Upstream AI model provider | Contract text, Q&A content, and processing instructions required for the task (current task only, not retained) | Generate review, drafting, and Q&A results |
| Third-party payment institution | Order number, order amount | Collect payment and reconcile accounts |
| SMS / email channel providers | Phone number or email address | Deliver verification codes and notices |
| WeChat Open Platform | WeChat account data within the scope you authorize | Verify your identity when you choose WeChat sign-in |
| Cloud and infrastructure providers | Data necessary for storage and processing | Hosting of servers, databases, and caches |
| Professional advisers such as accountants and lawyers | Information within the necessary scope | Audit and legal compliance |
| Authorities legally entitled to require disclosure | Information provided under lawful request | Comply with mandatory assistance obligations |
For processors acting on our behalf, we contractually specify the purpose, duration, manner, and security measures of processing, and require them not to use the information for any other purpose, not to retain it beyond the necessary period, and not to use your contract content to train their models. If a merger, acquisition, or business transfer occurs, we will require the successor to remain bound by this Policy, or otherwise obtain your consent again.
5. Storage, Cross-Border Transfer, and Security
- Storage location: your personal information is stored on servers located in the People's Republic of China.
- Encryption: HTTPS/TLS encryption in transit; passwords stored as salted hashes; sensitive configuration and API credentials stored encrypted.
- Access control and audit: access is controlled on a least-privilege basis, with traceable administrative audit logs.
- Cross-border transfer: as a matter of principle we do not provide your personal information to recipients outside China. If a cross-border transfer becomes genuinely necessary, we will fulfil the applicable notice requirements, obtain your separate consent, and complete the required security assessment or filing.
- Retention periods:
| Data category | Retention period |
|---|---|
| Account information | While your account exists; deleted or anonymized within 30 days after account deletion |
| Uploaded contract files and contract text | Not retained: used only for the current task and removed from our servers when processing ends |
| Results and session records (review results, drafts, Q&A) | Until you delete them yourself or close your account; removed from the production environment within 30 days after deletion |
| Orders and transaction ledger | Not less than 3 years from completion of the transaction (as required by law) |
| Device and log information | No longer than 6 months |
| Verification code records | Retained for audit purposes for no longer than 6 months |
Security incidents: if a personal data breach, tampering, or loss occurs, we will take remedial measures immediately and notify you and the competent authorities as required by law.
6. Your Rights
To the extent provided by law, you may:
- Access and copy your personal information;
- Correct and complete inaccurate or incomplete information;
- Delete your information (for example, where we processed it unlawfully or in breach of contract, or where the purpose has been achieved); the product lets you delete history records and sessions yourself, and because contract text is not retained there is nothing further to delete on that front;
- Withdraw consent at any time for processing based on consent, without affecting the lawfulness of processing carried out before withdrawal;
- Close your account, after which we will stop providing the Service and delete or anonymize your personal information;
- Export your data: invocation records and credit ledgers can be exported as CSV, and documents and results in the formats offered in the product;
- Request an explanation, lodge a complaint about our processing, or report the matter to a regulator.
To exercise these rights, use the settings pages in the product or contact us via Section 9. We will respond within 15 business days after verifying your identity.
7. Children's Privacy
The Service is provided for businesses and adults. If you are under 18, please use the Service with the consent and involvement of a guardian. The Service is not directed to children under 14, and we do not knowingly collect their personal information; if we discover that we have, we will delete it as required by law.
8. Changes to This Policy
We may update this Policy from time to time. For material changes concerning processing purposes, categories of information, recipients, or your rights, we will notify you prominently through in-product notices, email, or an announcement on our website. Continuing to use the Service after a change takes effect means you accept the updated Policy; if you do not agree, you may stop using the Service and close your account.
9. Contact Us
If you have any questions, comments, or complaints about this Policy or our handling of personal information, please contact us:
- Operating entity: Hangzhou Shenxiu Si Technology Co., Ltd. (杭州参宿四科技有限公司)
- Email: 867663065@qq.com
- Website: https://law.waveinsight.cn
If you believe our processing has infringed your lawful rights, you may also lodge a complaint or report with the competent authorities for cyberspace affairs or market regulation.
10. Language Version
This Policy is published in Chinese and English. The Chinese version is the authoritative and controlling text; the English version is a translation provided for convenience only. In the event of any ambiguity, inconsistency, or conflict between the two versions, the Chinese version prevails.
© 2026 OrionLaw. All rights reserved.