Privacy Policy

Last updated: September 5, 2026. Effective immediately for the exhibitset.com website and for the early-access ExhibitSet application.

1. Who we are and what this policy covers

ExhibitSet is a product of Neurai Technologies Private Limited ("Neurai", "we", "us"), a company incorporated in India with its registered office at H No. 944, Block C, Sushant Lok 1, Gurugram, Haryana 122001, India. Neurai is the data controller (in United States terms, the business) for the personal information described in this policy.

This policy covers:

• the website at exhibitset.com and its subdomains, and
• the ExhibitSet application at app.exhibitset.com, which is in early access and requires sign-in with an e-mail address.

Billing and team features are not yet switched on; we will update this policy before they go live and give you notice on this page. Signing in creates an account that holds your e-mail address. Nothing in the application sends document content anywhere.

2. Your documents

This is the section that matters most, so it is stated plainly.

• Documents are processed on your computer. When you open a PDF in ExhibitSet, every operation, including rendering, search, redaction, stamping and export, runs inside your web browser using code that we serve to you. The document's bytes are never sent to our servers, to Neurai, or to any third party as part of that processing.
• We cannot see, retrieve or recover your documents. Because they never reach us, we hold no copy. If you lose a file, we cannot restore it. If a court or authority asked us for your documents, we would have nothing to produce.
• File names stay with you too. The application does not transmit file names, page counts, or the text of your documents.
• What the application does download: the application code itself, including the PDF engine, from app.exhibitset.com. It does not fetch resources from third-party content networks. You can confirm this with your browser's developer tools; see our security page for the exact steps.
• Account data. Our account service stores the e-mail address you sign in with, a hashed session identifier, the time of your last sign-in, and the matter metadata you choose to enter, such as a matter name, a Bates prefix and the last Bates number used. It does not store document content, file names or production logs unless a future feature explicitly asks you to upload something, in which case we will say so at the point of upload and update this policy first.

You remain responsible for the documents you process, for where you save the output, and for complying with any protective order, confidentiality obligation or professional rule that applies to them.

3. Information we collect

3.1 Information you give us

• Email you send us. If you write to hello@exhibitset.com, we receive your email address, your name if you include it, and whatever you write. Our mail is hosted by Google Workspace.
• Early-access requests. These arrive by email and are handled the same way.
• Sign-in. To use the application you enter your email address. We send a six-digit code to it and, once you have entered the code, keep the address, the time you signed in and a session identifier so you stay signed in for up to 30 days. The code itself is stored only as a hash and expires after ten minutes.

3.2 Information collected automatically on the website

• Analytics. exhibitset.com uses Google Analytics 4 to understand which pages are read and roughly where visitors come from. Google Analytics collects a randomly generated client identifier stored in a cookie, the pages you view, referring site, browser and device type, screen size, language, and an approximate location derived from your IP address at the country, region or city level. Google does not log or store the IP address itself in Google Analytics 4. We have turned off Google Signals, so no advertising identifiers are collected and no data is used for cross-site advertising. We have set the retention period for user-level data to two months.
• Your privacy signals are honored. If your browser exposes a Global Privacy Control signal to web pages, or has Do Not Track enabled, the analytics script is not loaded at all and no analytics cookie is set. This applies automatically, without a banner and without any action on your part. Note that Chrome and Edge do not yet send Global Privacy Control on their own; a privacy extension can add it, and Do Not Track is available in both browsers' settings.
• Country check. Each page asks our hosting provider, Cloudflare, for the country of your connection using a same-origin request that involves no third party. The result is used for two things only: showing a notice to visitors outside the United States that ExhibitSet is currently offered in the US only, and deciding whether to load analytics. Analytics is never loaded for visitors in the EEA, UK or Switzerland, so no consent banner is needed. If the check fails for any reason, no notice is shown and analytics stays off. Dismissing the notice is remembered for the browser session only, on your device. The notice includes an optional form for your name and email. Submitting it opens your own email application with a pre-filled message to hello@exhibitset.com; nothing is transmitted to this website and nothing is stored by it unless you choose to send that email yourself, in which case we hold it as ordinary correspondence.
• Server logs. The website and application are served through Cloudflare. Cloudflare records the IP address, request time, requested URL, user agent and similar technical data for each request, for security and performance purposes, for a short period. We do not add our own request logging.

3.3 Information collected automatically in the application

The application sets one strictly necessary cookie, your sign-in session, runs no analytics and sends no telemetry. The only requests it makes are to load its own code and to our own account service at api.exhibitset.com, for sign-in, your plan and your matter metadata. Any change to this will be described here before it ships.

3.4 Information we do not collect

We do not collect document content, document metadata, payment card numbers (payments, when they launch, will be handled by a payment processor that never shares full card details with us), precise geolocation, biometric information, or information from data brokers.

4. Cookies and similar technologies

The application at app.exhibitset.com sets only the sign-in session cookie described above, and only after you enter a code. It may use your browser's local storage to keep your work between sessions on your own device; that data never leaves the device and you can clear it through your browser settings.

To opt out of Google Analytics everywhere, you can install Google's browser opt-out add-on, enable Global Privacy Control, or block cookies for this site.

5. How we use information and our legal bases

We do not use personal information for automated decision-making that has legal or similarly significant effects, and we do not use it to train machine-learning models.

6. Who we share information with

We share personal information only with the service providers below, each of which processes it on our behalf under contractual terms, and only for the purpose stated.

We may also disclose information if required by law, court order or governmental request, to protect the rights, safety or property of Neurai or others, or as part of a merger, acquisition or sale of assets, in which case this policy continues to apply to the transferred information. We will never be in a position to disclose your documents, because we do not have them.

We do not sell personal information, and we do not share it for cross-context behavioral advertising, as those terms are defined in the California Consumer Privacy Act and similar state laws. We have not done so in the preceding twelve months.

7. International transfers

Neurai is based in India, the account data described in section 2 is stored in India, and our service providers operate in the United States and elsewhere. When personal information from the European Economic Area, the United Kingdom or Switzerland is transferred to those countries, we rely on the European Commission's Standard Contractual Clauses, the UK International Data Transfer Addendum, and, where a provider is certified, the EU-U.S. Data Privacy Framework. You can ask us for a copy of the relevant safeguards using the contact details below.

8. How long we keep information

• Email: for as long as needed to handle your request and for a reasonable period afterwards to keep a record of the correspondence, then deleted.
• Analytics: user-level and event-level data is retained by Google Analytics for two months; aggregated reports may be kept longer and contain no personal information.
• Server logs: retained by Cloudflare for its standard short retention period.
• Documents: never received, therefore never retained.

9. Security

The strongest security control we have is architectural: your documents never leave your computer, so there is nothing for us to lose. Beyond that, the website and application are served only over HTTPS with strict transport security, carry a Content Security Policy that restricts what the pages may load and where they may connect, and are deployed from a source-controlled build with review. Our security page explains how to verify these claims yourself. No method of transmission or storage is completely secure, and you should keep your own device and browser up to date.

10. Your rights: United States

Depending on where you live, you may have the right to know what personal information we collect, use and disclose; to access it; to correct it; to delete it; to obtain a portable copy; to opt out of the sale or sharing of personal information and of targeted advertising and certain profiling; and not to be discriminated against for exercising these rights. Residents of California, Colorado, Connecticut, Virginia, Utah, Texas, Oregon, Montana and other states with comprehensive privacy laws may exercise these rights by emailing hello@exhibitset.com with the subject "Privacy request".

• Opt-out preference signals. We treat a Global Privacy Control signal that your browser exposes to the page as a valid request to opt out of sale and sharing, and we honor it automatically by not loading analytics. We do not sell or share personal information in any case.
• Verification. Because we hold very little information about you, we will usually verify a request by confirming control of the email address it concerns.
• Authorized agents may submit requests on your behalf with written permission that we may ask to see.
• Appeals. If we decline a request, you may appeal by replying to our decision, and we will respond within the time required by your state's law. Residents of some states may also contact their state attorney general.
• Response time. We respond within 45 days, extendable once where the law permits, and we will tell you if we need more time.

For the purposes of California law, in the preceding twelve months we have collected the categories of personal information described in section 3 (identifiers such as email address and analytics identifiers; internet activity such as pages viewed; and approximate geolocation), from the sources described there, for the purposes in section 5, and disclosed them only to the service providers in section 6. We do not knowingly collect sensitive personal information.

11. Your rights: EEA, United Kingdom and Switzerland

If the GDPR or UK GDPR applies to you, you have the rights of access, rectification, erasure, restriction, portability and objection, and the right to withdraw consent at any time without affecting earlier processing. Where we rely on legitimate interests, you may object and we will stop unless we can show compelling grounds. You may also lodge a complaint with your local supervisory authority; in the UK that is the Information Commissioner's Office. Contact us at hello@exhibitset.com to exercise any right. We have not appointed an EU or UK representative; we will do so if and when our processing requires it.

12. Users in India

Neurai is incorporated in India. When and to the extent the Digital Personal Data Protection Act, 2023 is in force and applies, you may access, correct and erase your personal data, nominate a person to exercise your rights, and raise a grievance with us at the address below; if unresolved, you may approach the Data Protection Board of India.

13. Children

ExhibitSet is a professional tool for legal work and is not directed to anyone under 18. We do not knowingly collect personal information from children. If you believe a child has provided information to us, contact us and we will delete it.

14. Professional obligations and no legal advice

ExhibitSet is software. Neurai is not a law firm, does not practice law, and does not provide legal advice. Nothing on this site or in the application, including the redaction patterns, court profiles and preflight checks, is a substitute for your own judgment, your court's current rules, or your professional obligations of competence and confidentiality. You are responsible for confirming that any output meets the requirements of the court or the receiving party, and for reviewing redactions before you rely on them. Using ExhibitSet does not create an attorney-client relationship with anyone.

15. Changes to this policy

When we change this policy we will update the date at the top. If a change materially reduces your rights or changes how we handle documents, we will give prominent notice on this site before it takes effect. Earlier versions are available on request.

16. How to contact us

Neurai Technologies Private Limited
H No. 944, Block C, Sushant Lok 1
Gurugram, Haryana 122001, India
Email: hello@exhibitset.com

For security vulnerabilities, use the address in our security.txt file.