Privacy Policy

Invictus AI Corporation | Effective Date: July 1, 2026 | Version 2.0

About This Policy

This Privacy Policy explains how Invictus AI Corporation (“Invictus AI,” “we,” “us,” or “our”) collects, uses, shares, and protects information from users of the Verena Platform (the “Platform”). This policy applies to both Verena service tiers — Standard and Plus Human. Where data practices differ by tier, this policy clearly distinguishes the applicable rules.

Capitalized terms not defined in this policy have the meanings given in the Verena Terms of Service.

The Two Entities Behind Verena

Understanding which legal entity is involved in your use of the Platform helps clarify how your information is handled.

Invictus AI Corporation A Nevada technology company. Invictus AI owns, operates, and hosts the Verena Platform and is the data controller for account, usage, and Standard tier data collected through the Platform.

Invictus Counsel, PLLC An Arizona-licensed professional limited liability company and law firm affiliated with Invictus AI. When you subscribe to Plus Human, your attorney-client relationship is with Invictus Counsel. IC Pros — the attorneys and legal professionals who supervise Plus Human activities — are internal professionals at Invictus Counsel. For legal matter data collected through the Plus Human tier, Invictus AI and Invictus Counsel act as joint data controllers, with Invictus Counsel bearing professional responsibility for the handling of privileged communications.

Defined Terms

The following terms have specific meanings throughout this policy:

IC Pro: An internal professional at Invictus Counsel, PLLC who is licensed to practice law and who supervises Plus Human activities on the Platform.

Standard: The base Platform tier providing AI-powered legal information without IC Pro supervision. Standard outputs are not privileged and do not constitute attorney work product.

Plus Human: The premium Platform tier in which your interactions are supervised by an IC Pro at Invictus Counsel. Attorney-client privilege attaches to the Plus Human chat thread from the moment your Engagement Letter has been countersigned by an IC Pro, and extends to all activities within that supervised thread.

Engagement Letter: The legal agreement that formalizes your attorney-client relationship with Invictus Counsel. It must be signed by you and countersigned by an IC Pro to become effective. See the Verena Terms of Service for complete terms governing the Engagement Letter lifecycle.

Confidential Communications: Content you submit through your Plus Human chat thread during an Active Engagement, which is protected by attorney-client privilege from Engagement Letter countersign forward. Standard chat is not privileged — even if you have an Engagement Letter on file — because there is no IC Pro in the loop for Standard interactions.

Table of Contents

Section 1. Information We Collect

Section 2. How We Use Information

Section 3. Cookies and Tracking Technologies

Section 4. Information Sharing

Section 5. Confidential Communications — Plus Human

Section 6. Data Security

Section 7. Data Retention

Section 8. Your Rights

Section 9. Data Deletion Requests

Section 10. International Data Transfers

Section 11. Children’s Privacy

Section 12. Changes to This Privacy Policy

Section 13. Contact Us

Section 1. Information We Collect

1.1 Information You Provide (All Users)

We collect information you provide directly when you create an account, use the Platform, or contact us, including:

Personal information: name, email address, phone number, and contact details.
Account credentials and authentication data.
Payment and billing information (processed through third-party payment processors; Invictus AI does not store full payment card numbers).
User Content: documents, text, files, and uploads submitted to the Platform.
Communications with our support team.

1.2 Additional Information — Standard

For Standard users, we additionally collect:

AI interaction data: prompts, queries, and outputs generated through Standard activities.
Workflow and usage patterns to improve Standard AI features.

1.3 Additional Information — Plus Human

For Plus Human users, we additionally collect:

Legal matter information: case details, documents, and communications submitted in connection with legal services delivered through the Platform.
Confidential Communications: content submitted through your Plus Human chat thread during an Active Engagement, which may be protected by attorney-client privilege from Engagement Letter countersign forward (see Section 5).
Attorney engagement information: Engagement Letters, matter identifiers, and IC Pro assignments.

1.4 Information Collected Automatically

We automatically collect technical and usage information when you access the Platform, including:

Device information: device type, operating system, browser type and version.
Log data: IP address, access times, pages visited, features used, and referring URLs.
Usage information: interactions with Platform features, workflow completions, session duration.
Location information: derived from IP address or device settings where applicable.
Cookies and tracking technologies: as described in Section 3.

Section 2. How We Use Information

2.1 Uses Applicable to All Users

We use information collected from all users for the following purposes:

Providing, maintaining, and improving the Platform and its features.
Processing payments and managing billing arrangements.
Communicating with users about products, features, updates, and support.
Ensuring Platform security, fraud prevention, and compliance with applicable law.
Conducting analytics to improve user experience and business operations.
Enforcing our Terms of Service and legal rights.
Responding to legal process and regulatory requirements.

2.2 AI Model Training — Standard

For Standard users, aggregated and de-identified usage data — including interaction patterns and workflow data — may be used to train and improve Verena’s AI models. Identifiable user content will not be used for AI training without your explicit consent. You may opt out of AI training use of your de-identified data at any time (see Section 8.2).

2.3 AI Model Training — Plus Human

For Plus Human users, the AI training default is reversed from Standard:

Permitted without consent Aggregated, de-identified operational data (e.g., workflow timing, system performance data) that cannot be linked to any specific user or legal matter may be used for Platform improvement without separate consent.

Requires explicit opt-in All other Plus Human data — including Confidential Communications, identifiable legal matter information, and Engagement Letter data — will not be used for AI training without your explicit written opt-in consent (see Section 8.3). This restriction applies regardless of whether the data has been de-identified if there is any reasonable possibility it could be linked to you or your matter.

2.4 Legal Services Delivery — Plus Human

For Plus Human users, we additionally use information to:

Facilitate the attorney-client relationship between you and your IC Pro at Invictus Counsel.
Deliver legal services, including AI-assisted drafting reviewed and supervised by your IC Pro.
Maintain legal matter files and comply with attorney record-keeping obligations.
Communicate with regulatory bodies and state bars as required by applicable professional responsibility rules.

Section 3. Cookies and Tracking Technologies

We use cookies and similar tracking technologies to personalize user experience, analyze Platform performance, support security, and deliver relevant communications. Types of cookies we use include:

Essential cookies: necessary for Platform functionality and authentication. Cannot be disabled.
Analytics cookies: help us understand how users interact with the Platform. May be disabled through browser settings or cookie preferences.
Preference cookies: remember your settings and choices across sessions.
Security cookies: support fraud prevention and account security.

Users may control non-essential cookie preferences through browser settings. Disabling certain cookies may affect Platform functionality. In jurisdictions requiring cookie consent, additional consent options will be presented at login.

Section 4. Information Sharing

4.1 We Do Not Sell Personal Information

Invictus AI does not sell, rent, or trade personal information to third parties for their own marketing purposes.

4.2 Sharing with Service Providers

We share information with third-party service providers who support our business operations, including:

Payment processors (for billing and subscription management).
Cloud hosting and infrastructure providers.
Analytics vendors (using aggregated or de-identified data).
Security and fraud prevention services.
Customer support platforms.

All service providers are contractually required to use information only to perform services for Invictus AI and to maintain appropriate security standards.

4.3 Sharing with Affiliated Entities

We may share information with Invictus AI affiliates. Our primary affiliate in the context of the Verena Platform is Invictus Counsel, PLLC — the affiliated law firm whose IC Pros supervise Plus Human activities. Any affiliate receiving your information is bound by these same privacy obligations.

4.4 Legal Disclosures

We may disclose information when required by applicable law, regulation, court order, or valid legal process. Where legally permissible, we will notify affected users before complying with such process.

4.5 Business Transfers

In the event of a merger, acquisition, sale of assets, or similar corporate transaction, your information may be transferred to the successor entity, subject to the same privacy protections described in this policy. We will notify users of any such transfer and provide an opportunity to delete your account if the successor entity’s privacy practices materially differ.

4.6 Sharing with IC Pros — Plus Human

For Plus Human users, Confidential Communications and legal matter information are shared with your assigned IC Pro at Invictus Counsel and, where applicable, supporting legal staff at Invictus Counsel, solely for the purpose of delivering legal services. This sharing is consistent with attorney-client privilege and the common interest doctrine. Confidential Communications are not shared with any other third party except as described in Section 5.2.

Section 5. Confidential Communications — Plus Human

5.1 Scope of Heightened Protection

Confidential Communications — content submitted through your Plus Human chat thread during an Active Engagement, from Engagement Letter countersign forward — are subject to heightened protection beyond the standard data security measures that apply to all user data. This heightened protection includes:

Logical separation of Confidential Communications from Standard user data in our systems.
Access controls limiting internal access to Confidential Communications to only those personnel whose functions require it for Platform operation or legal services delivery.
No use of Confidential Communications for AI training without explicit opt-in consent (see Section 2.3).
Minimum seven (7) year retention following conclusion of the engagement, consistent with attorney file retention obligations (see Section 7.2).

Important Standard chat and Standard-tier activities and outputs are not privileged — even if you have an Engagement Letter on file. Attorney-client privilege attaches only to the Plus Human chat thread from Engagement Letter countersign forward and does not extend to your account status generally.

5.2 Permitted Disclosures of Confidential Communications

Invictus AI will not voluntarily disclose Confidential Communications except:

As required by applicable law, regulation, or valid legal process.
As necessary to deliver legal services to you (including disclosure to your IC Pro and authorized legal staff at Invictus Counsel).
With your prior written consent.
As otherwise required by applicable professional responsibility rules.
To prevent reasonably certain death or substantial bodily harm, as permitted under applicable rules of professional conduct.

Where legally permissible, Invictus AI will provide advance notice before disclosing Confidential Communications pursuant to legal process and will cooperate with your efforts to seek a protective order.

5.3 Privilege Preservation

You are responsible for not taking actions that waive attorney-client privilege, including sharing account credentials with unauthorized persons, voluntarily disclosing Confidential Communications to parties outside the privilege, or granting unauthorized third-party access to the Platform. Invictus AI’s and Invictus Counsel’s access to Confidential Communications is limited to what is necessary to operate the Platform and facilitate legal services — consistent with the recognized principle that sharing with a necessary service provider does not waive privilege.

Section 6. Data Security

6.1 Security Measures

Invictus AI implements commercially reasonable technical and organizational security measures designed to protect user information against unauthorized access, disclosure, alteration, and destruction. These measures include:

Encryption of data in transit using TLS and at rest using AES-256 or equivalent.
Role-based access controls limiting employee access to user data.
Regular security assessments and penetration testing.
Multi-factor authentication for administrative access.
Incident response procedures for security events.

6.2 No Absolute Security Guarantee

No security system is impenetrable. Invictus AI does not warrant that user information will never be accessed by unauthorized parties. You should take steps to protect your own account security, including using strong passwords and not sharing credentials.

6.3 Data Breach Notification

In the event of a confirmed data breach affecting user information, Invictus AI will notify affected users as required by applicable law, and in any event within seventy-two (72) hours of confirming a breach that poses a material risk to users. Notification will include: (a) the nature of the breach; (b) categories of information affected; (c) steps taken to address the breach; and (d) recommended steps for affected users.

Section 7. Data Retention

7.1 Standard — Retention

For Standard users, we retain personal information and user content for as long as necessary to fulfill the purposes described in this policy, comply with legal obligations, resolve disputes, and enforce our agreements. Account data is retained for the duration of the account and for up to three (3) years following account closure, after which it is securely deleted or de-identified. You may request earlier deletion in accordance with Section 9.

7.2 Plus Human — Retention

For Plus Human users, retention periods reflect both standard data practices and the professional obligations of attorneys:

7-Year Retention Client matter files, Confidential Communications, and Engagement Letter records are retained for a minimum of seven (7) years following conclusion of the engagement, or such longer period as required by applicable state bar rules or law. Billing and payment records are likewise retained for seven (7) years for tax and audit purposes.

Account and personal information not subject to professional retention obligations is retained for the duration of the account and for seven (7) years following account closure or conclusion of the last active engagement, whichever is later.

Upon expiration of the applicable retention period, records will be securely deleted or de-identified. You may request a copy of your matter file at any time during the retention period.

Section 8. Your Rights

8.1 Rights Available to All Users

Depending on your location, you may have the following rights regarding your personal information:

Access: request a copy of the personal information we hold about you.
Correction: request correction of inaccurate or incomplete information.
Deletion: request deletion of your personal information, subject to legal and professional retention obligations.
Objection: object to certain processing activities, including use for analytics or marketing.
Restriction: request that we restrict processing of your information in certain circumstances.
Portability: request your personal information in a structured, machine-readable format.

To exercise any of these rights, contact privacy@invictus.ai. We will respond within the timeframes required by applicable law (and in any event within thirty (30) days for most requests).

8.2 AI Training Opt-Out — Standard

Standard users may opt out of the use of their aggregated, de-identified data for AI model training by contacting privacy@invictus.ai. Opt-out requests will be processed within thirty (30) days and will not affect your access to the Platform.

8.3 AI Training Opt-In — Plus Human

Plus Human users who wish to affirmatively permit use of their Confidential Communications or identifiable legal matter data for AI training must provide explicit written opt-in consent by contacting privacy@invictus.ai. This opt-in is separate from any other consent given in the account registration or Terms of Service flow. You may revoke opt-in consent at any time; revocation applies prospectively and does not require deletion of previously de-identified data.

8.4 California Users (CCPA / CPRA)

California residents have additional rights under the California Consumer Privacy Act and California Privacy Rights Act, including:

Right to know what personal information has been collected, used, disclosed, or sold.
Right to delete personal information (subject to applicable exceptions).
Right to correct inaccurate personal information.
Right to opt out of the sale or sharing of personal information. Invictus AI does not sell personal information.
Right to limit use of sensitive personal information.
Right to non-discrimination for exercising CCPA/CPRA rights.

To exercise California rights, contact privacy@invictus.ai. We will respond within forty-five (45) days, with an additional forty-five (45) days available upon notice if required.

8.5 EEA, UK, and International Users (GDPR)

Users located in the European Economic Area, United Kingdom, or other jurisdictions with similar data protection laws have rights including access, rectification, erasure, restriction, portability, and objection.

Legal bases for processing: Invictus AI processes your personal data on the following legal bases:

Contract performance (GDPR Art. 6(1)(b)): processing necessary to provide you with the Platform, manage your account, and deliver the services you have requested.
Legitimate interests (GDPR Art. 6(1)(f)): processing for security, fraud prevention, Platform improvement, and analytics, where these interests are not overridden by your rights.
Legal obligation (GDPR Art. 6(1)(c)): processing required to comply with applicable law, including professional responsibility rules governing IC Pros.
Consent (GDPR Art. 6(1)(a)): processing for AI model training on Standard data (opt-out) and Plus Human data (opt-in), and for certain marketing communications.

Data Controllers Invictus AI acts as data controller for account and Standard tier data. For Plus Human legal matter data, Invictus AI and Invictus Counsel, PLLC act as joint controllers, with Invictus Counsel bearing professional responsibility for privileged communications.

For questions or requests, contact privacy@invictus.ai. EEA users may also lodge a complaint with their local supervisory authority.

Section 9. Data Deletion Requests

You may request deletion of your personal information at any time by contacting privacy@invictus.ai. We will process deletion requests within thirty (30) days, subject to the following:

Standard Users Deletion requests will be honored for all personal information and user content, except where retention is required by applicable law or for legitimate business purposes such as fraud prevention, dispute resolution, or audit requirements.

Plus Human Users Deletion of client matter files, Confidential Communications, and Engagement Letter records is subject to the seven (7) year retention obligations described in Section 7.2. Deletion of this data before the retention period expires may conflict with attorney professional obligations and will require review by the applicable IC Pro and, where necessary, state bar guidance. Personal information not subject to professional retention obligations (such as marketing preferences and account settings) may be deleted upon request.

Section 10. International Data Transfers

The Platform is operated from the United States. If you access the Platform from outside the United States, you acknowledge that your information may be transferred to, processed, and stored in the United States and other countries, which may have different data protection laws than your home jurisdiction. For EEA/UK transfers, Invictus AI relies on Standard Contractual Clauses or other lawful transfer mechanisms as required by applicable law.

Section 11. Children’s Privacy

The Platform is not directed to individuals under the age of 18 and we do not knowingly collect personal information from minors. If we become aware that we have inadvertently collected information from a minor, we will promptly delete it. If you believe we have collected information from a minor, please contact privacy@invictus.ai.

Section 12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. Material changes will be communicated via email to the registered account address and through an in-Platform notice at least thirty (30) days before the effective date. Your continued use of the Platform after the effective date constitutes acceptance of the updated policy. If you do not agree with the updated policy, you must close your account before the effective date.

Plus Human Users Any material change to our practices with respect to Confidential Communications or AI training use requires fresh, affirmative consent before the change takes effect. We will not retroactively alter the protections applicable to Confidential Communications already collected.

Section 13. Contact Us

For privacy questions, data requests, or to exercise your rights:

Email: privacy@invictus.ai

General support: support@invictus.ai

Mailing address: Invictus AI Corporation, [Address]

We are committed to working with you to resolve privacy concerns promptly and fairly.

Attorney Advertising Notice

Plus Human involves legal services Plus Human involves legal services delivered by attorneys at Invictus Counsel, PLLC, an Arizona-licensed professional limited liability company. Communications regarding Plus Human features may constitute attorney advertising under applicable state bar rules. Prior results do not guarantee a similar outcome. The attorney-client relationship is established only upon execution of a countersigned Engagement Letter, and no attorney-client relationship is formed through use of Standard tier features or by reading this Privacy Policy.

By using the Verena Platform, you acknowledge that you have read and understood this Privacy Policy.