Privacy policy
What Passim collects, why, how long it keeps it, and how to ask for changes.
Last updated: September 13, 2026
Passim is a legal research service operated by Passim AI LLC. This policy explains what information Passim collects when you use the website, the API, and the Passim MCP server, why it collects it, how long it keeps it, and how to ask us to change or delete it.
Two things frame everything below. Passim is a retrieval service: the AI assistant you use sends it a research query and receives legal sources back. Passim never receives the rest of your conversation, your documents, or your client files. And Passim does not use anything you send it to train or fine-tune any model.
What we collect
| Information | Why we have it | How long we keep it |
|---|---|---|
| Account details | Your email address, name, sign-in identity from your OAuth provider, and sign-in history, so we can give you access and secure it. | While your account is open, then deleted on request. |
| Access credentials | API keys (stored hashed), OAuth claims, and the tools each key may call. | Until you or we revoke them. |
| Research activity | Which tools were called, by whom, when, and how often, so we can run the service, enforce rate limits, and bill per seat. The text of your queries is not retained. | Operational logs 90 days; usage counts while your account is open. |
| Saved work | Saved searches, collections, notes, and alert settings you create on the website, if you use those features. | Until you delete them or close your account. |
| Messages to us | Access requests, support, privacy, and security messages, including your name, firm, and email. | Kept as business records while relevant. |
| Device and usage data | IP address, browser or client type, pages and routes requested, timing, and errors, for security and reliability. | 90 days. |
| Billing details | Plan, seats, and payment status. Card numbers are handled by our payment processor and never reach Passim's servers. | As required for tax and accounting records. |
Please do not put Social Security numbers, A-numbers, passport numbers, dates of birth, or other client-identifying facts into a research query. Passim does not need them to find the law.
Your queries
The content of a query, meaning your search terms, citations, and questions, is processed to answer it and then discarded. Passim's usage records keep the tool name, the calling account or key, counts, timing, and dates. Queries travel in request bodies rather than URLs, so they never appear in access logs, and our error reporting is configured not to capture request bodies. When an operational problem needs correlation, content fields are fingerprinted rather than stored.
Your AI assistant is a separate service
Claude, ChatGPT, or whichever MCP client you use processes your conversation, decides when to call Passim, and receives Passim's results. It may keep that material under its own terms and your workspace's settings. Passim does not control that provider's retention, training, human review, data residency, or administrator settings, and its promises here apply only to Passim. For confidential client work, use a workspace whose agreement meets your firm's requirements.
No model training
Passim does not use account data, queries, tool calls, saved work, or messages to train or fine-tune any model, and does not send your queries to any AI provider. Where Passim uses AI itself, it is to summarize and classify public legal materials, never your data.
Cookies and analytics
Passim uses cookies only for sign-in, session security, and rate limiting. There is no advertising, no cross-site tracking, and no marketing analytics on any research, account, or MCP surface. If Passim ever adds visitor analytics, they will run only on the public home, what-it-is, and pricing pages, and this policy will say so first.
How information is shared
Passim shares information with a small number of providers that help run the service, such as hosting, sign-in, email delivery, and error monitoring. Each is listed on the subprocessors page with what it does and where it is, and each processes information only as needed to provide its service. Passim does not sell personal information and does not share it for advertising.
Passim may also disclose information when the law requires it, to protect the security of the service or the rights of others, to investigate misuse, or as part of a merger, acquisition, or financing, in which case this policy will continue to apply to the transferred information.
Public legal records
The Passim library is built from public legal materials. Those records can contain personal information because a court or agency published it. Passim uses them for research, citation, and source verification. If a record returned by Passim exposes information you believe should be restricted, write to us with the source URL, the document identifier, and the concern, and we will review it.
Retention and deletion
Operational logs are deleted after 90 days unless a specific security incident, abuse investigation, dispute, or legal obligation requires keeping particular records longer. Account data and saved work are kept while your account is open and deleted when you ask us to close it. Business records and public legal materials are kept as long as they are needed for the purposes described above.
Security
The controls that protect your information are described on the security page, including what is in place, what is planned, and what has not yet been independently audited. No online service can promise perfect security, and Passim does not.
Your rights
You can ask us to:
- tell you what personal information we hold about you and give you a copy;
- correct information that is inaccurate;
- delete your account and the information associated with it;
- restrict or object to a particular use of your information where the law gives you that right.
To make a request, email chris@chrishammondlaw.com. We may need to verify that the request comes from you, and we may keep specific records where the law or the security of the service requires it. We will not treat you differently for exercising these rights.
Children
Passim is for legal professionals and other adults. It is not directed to anyone under 18, and we do not knowingly collect information from children.
International users
Passim is operated from the United States and its providers are located there. If you use Passim from elsewhere, your information will be processed in the United States.
Changes to this policy
When this policy changes, the date at the top changes with it, and material changes will be announced on this page before they take effect. Passim will not begin using personal information for model training or advertising without notice and, where required, your consent.
Contact
Passim AI LLC. Privacy questions and requests: chris@chrishammondlaw.com.