Version 0.6 · effective 3 November 2026

Lawfair terms of use, v0.6 (Nov 2026)

1. Who we are, and who these terms bind

1.1 Lawfair is operated by Cyber Mangrove Ltd (company no. SC625467), Hudson House, 8 Albany Street, Edinburgh EH1 3QB ("we", "us").

1.2 "You" means the person using Lawfair. "Your organisation" means the firm, chambers, company or other body you use Lawfair for. If you practise on your own account, as an advocate does, you are your organisation.

1.3 By clicking Accept you agree to these terms for yourself and, where you use Lawfair for your organisation, on its behalf. You confirm you are authorised to do so. If you are not, you accept them for yourself only, and you must not upload your organisation's material until someone authorised has accepted them. We may ask your organisation to confirm its acceptance in writing.

1.4 These terms include the Data Processing Addendum in the Schedule below (the "Addendum"). It governs personal data in the material you upload. Our Privacy Notice explains how we handle your own personal data.

2. The service

2.1 Lawfair analyses a dispute from the material you provide. It sets out the issues, the arguments on each side, a likely outcome, quantum, expenses and net position. It can also draft documents.

2.2 Alpha preview. Lawfair is experimental. Features may change or be withdrawn without notice, and outputs may be wrong or incomplete.

2.3 What has been measured. Lawfair's accuracy has been measured only against published Scottish court judgments, which are cases that reached a decision. These have not been measured:

• accuracy on live or settled matters;
• arbitration analysis;
• document triage;
• drafting.

2.4 Business use only. Lawfair is for qualified legal professionals, and people working under their supervision, acting in the course of their business. It is not for consumers.

3. Access

3.1 Access is by invitation, and we approve each account.

3.2 Each account is for one named person. Keep your password and second factor to yourself. You are responsible for activity on your account. Tell us at once at privacy@lawfair.uk if you suspect misuse.

3.3 Access is free. We will give at least 30 days' notice before introducing any charge, and nothing is payable without your separate agreement.

4. Feedback

4.1 Access is given in exchange for feedback. Tell us:

• what worked;
• what was wrong or confusing;
• what is missing;
• whether an output changed how you would approach the matter.

We may ask for a short form or call. Feedback is a condition of continued access, not an obligation you owe: if none comes, we may withdraw access under clause 14.2.

4.2 We may use feedback freely and without payment, and improvements we make belong to us. Neither using Lawfair nor giving feedback creates any ownership, equity, partnership or other interest in Lawfair or in us. Nor does it create any entitlement to payment for anyone's time.

4.3 Feedback about a particular case instructs us to review that case in order to act on it (Addendum clause 2.1).

5. Acceptable use

You must not:

• (a) upload material you are not entitled to upload (clause 6);
• (b) use Lawfair to give or obtain legal advice except under the supervision of a qualified professional;
• (c) copy, reverse-engineer or extract Lawfair's prompts, models, methods or data, or try to;
• (d) use Lawfair or its outputs to build, train or improve a competing product or AI model;
• (e) test, probe or bypass Lawfair's security or access controls without our written permission;
• (f) scrape, bulk-download or automate access to Lawfair;
• (g) share your account, or let anyone else use it;
• (h) upload anything unlawful, or malicious code.

6. Your material

6.1 "Your material" is everything you upload or enter, together with what Lawfair generates from it.

6.2 Authority to upload. Whether you may upload material is your judgement, as the person who owes the duties attached to it. Each time you upload, you confirm all of these:

• your organisation, its client, and any arbitration agreement, rules, tribunal or court order that applies, permit sharing the material with a service like Lawfair for this purpose;
• uploading it does not breach any duty of confidentiality you owe;
• your organisation has a lawful basis for the processing, and where needed a condition for special-category or criminal-offence data.

6.3 Upload only what the analysis needs. Names, addresses and reference numbers rarely matter to it, and we recommend removing them where they don't.

6.4 Your material belongs to you, your organisation or your client. You give us only the rights we need to process it as the Addendum describes.

6.5 Where it is processed. Your material is stored and processed in the UK, on Amazon Web Services in London. That includes the AI analysis, which runs on Amazon Bedrock. Bedrock does not store your material, share it with the model's developer, or use it to train any model. We do not use your material to train any model.

7. Data protection

7.1 For personal data in your material ("case data"), your organisation is the controller and we are its processor. The Addendum applies.

7.2 For your account data, and data about how you use Lawfair, we are the controller. The Privacy Notice applies.

8. Not legal advice

8.1 Lawfair does not give legal advice. Using it creates no solicitor-client or other professional relationship with us. Outputs are decision support for qualified professionals.

8.2 Check every output independently before relying on it, in particular:

• the authorities it cites and what they decided;
• the law it states;
• the figures it gives.

You remain responsible for any advice you give and any step you take.

8.3 Predicted outcomes and figures are estimates, not guarantees.

9. Intellectual property

9.1 Lawfair belongs to us or our licensors, including its software, prompts, models, methods and the data we compile.

9.2 As between us, outputs generated from your material belong to your organisation. Where an output contains anything of ours that is not specific to your matter, such as standard wording or structure, you may use it as part of the output.

9.3 Judgments shown in Lawfair are published by the Scottish Courts and Tribunals Service. Contains public sector information licensed under the Open Government Licence v2.0. Neither SCTS nor any court endorses Lawfair or its analysis.

10. Confidentiality

10.1 We hold your material for you, in confidence. We use it only to provide Lawfair as these terms and the Addendum describe. Anyone who can access it for us is bound by a duty of confidentiality.

10.2 Sharing material with us is not intended to waive any privilege or confidentiality in it, and we will do nothing to waive it.

11. Disclaimers

Lawfair is provided as it is. To the extent the law allows, we give no warranty that:

• outputs are accurate, complete or current, or reflect current law;
• Lawfair will be available or free of errors.

AI models can state the law wrongly, misdescribe what an authority decided, and give figures without a sound basis.

12. Liability

12.1 Nothing in these terms excludes or limits liability for:

• death or personal injury caused by negligence;
• fraud or fraudulent misrepresentation;
• any other liability that cannot lawfully be excluded or limited under the law of Scotland.

12.2 Subject to 12.1, we are not liable for:

• (a) indirect or consequential loss;
• (b) loss of profit, revenue, business, goodwill or anticipated savings;
• (c) loss arising from reliance on an output you did not check as clause 8.2 requires;
• (d) loss arising from material you were not entitled to upload;
• (e) the outcome of any matter.

12.3 Subject to 12.1, our total liability to you and your organisation together, arising from or in connection with Lawfair, these terms and the Addendum, is limited to £10,000 in aggregate. This applies whether the claim arises in contract, delict (including negligence), breach of statutory duty or otherwise.

12.4 The cap reflects that Lawfair is a free preview and no fees are paid. We will revisit it before offering a paid service.

12.5 Nothing in this clause limits a data subject's rights under data protection law.

12.6 Each part of this clause is separate. If one part is unenforceable, the rest still applies.

13. Indemnity

13.1 Your organisation will indemnify us against claims by anyone else, and the losses and reasonable costs that follow from them, arising from:

• (a) material uploaded from its accounts that the uploader was not entitled to upload;
• (b) a breach of clause 5.

13.2 We will tell you promptly of any such claim and consult you on how it is handled. We will not settle it without your consent, which you will not unreasonably withhold.

14. Ending access, and your data

14.1 You may stop using Lawfair, and delete your account in Settings, at any time. Deletion is immediate and permanent, so export first.

14.2 We may withdraw your access:

• (a) at once, if you breach these terms, if your account is compromised or misused, or to protect Lawfair, its users or others;
• (b) otherwise on 30 days' notice, during which you can export your data. This includes where feedback is not forthcoming and where we close the preview.

14.3 When access ends, case data is returned or deleted as the Addendum provides.

14.4 Clauses 4.2, 9, 12, 13, 14, 17 and 18 continue after access ends.

15. Changes

15.1 We may change these terms. You will be asked to accept each new version before you continue using Lawfair. We will give at least 14 days' notice by email of a change that reduces your rights, unless the law or Lawfair's security requires sooner.

15.2 If you do not accept a new version, stop using Lawfair. Email privacy@lawfair.uk and within 14 days we will export your data to you and delete your account. Until then, the version you last accepted governs your data.

16. Transfer to a successor

16.1 We may transfer these terms, together with your recorded acceptance, to a successor. A successor is a company later incorporated to operate the Lawfair business (for example, one trading as "Lawfair"), or anyone who acquires the Lawfair business or its assets.

16.2 On transfer:

• these terms and your acceptance continue in force against the successor;
• the successor is bound by terms no less protective of you;
• where the successor becomes a controller of your data, we will update the Privacy Notice and the Addendum to name it.

16.3 You may not transfer your rights under these terms without our written consent.

17. General

17.1 These terms, the Addendum and the documents they refer to are the whole agreement about Lawfair. Neither of us relies on anything not set out in them.

17.2 For case data, the Addendum prevails over these terms.

17.3 If any part of these terms is unenforceable, the rest still applies.

17.4 No one else has rights under these terms. The Contract (Third Party Rights) (Scotland) Act 2017 does not apply.

17.5 A failure or delay in enforcing a right does not waive it.

17.6 Notices to us go to legal@lawfair.uk. Notices to you go to your account email.

18. Law and courts

These terms are governed by the law of Scotland. The Scottish courts have exclusive jurisdiction.

Schedule: Data Processing Addendum

1. Scope

1.1 This Addendum applies to personal data in material uploaded to Lawfair, or generated in it, for your organisation ("case data"). It is part of the Lawfair terms of use ("the terms"). For case data it prevails over the terms.

1.2 In this Addendum, "you" means your organisation, as defined in the terms. "Data protection law" means the UK GDPR, the Data Protection Act 2018 and PECR, as amended from time to time. Other terms take their UK GDPR meanings.

1.3 You are the controller of case data, and we are your processor. Annex 1 describes the processing.

2. Instructions (Art 28(3)(a))

2.1 We process case data only on your documented instructions. Those instructions are:

• the terms and this Addendum;
• your users' actions in Lawfair: each upload, analysis, draft, export and deletion;
• a support request from one of your users, including feedback about a case, which instructs us to review that case in order to act on it;
• a failure while carrying out one of your users' requests, which instructs us to investigate it and put it right, reading only what that needs;
• any other written instruction you give that is consistent with the terms.

2.2 We use case data for nothing else. In particular, we do not use it to train or fine-tune any AI model, to profile anyone, or for marketing, and we do not sell it.

2.3 We will tell you if, in our opinion, an instruction infringes data protection law.

2.4 If the law requires us to process case data other than on your instructions, we will tell you first, unless the law forbids that. Clause 10 sets out how we handle a demand for case data.

3. Our people (Art 28(3)(b))

3.1 Access to case data is limited to people who need it to provide Lawfair, act on your instructions or keep Lawfair secure. Each is bound by a duty of confidentiality.

3.2 We do not read case data except:

• to act on your instructions;
• to investigate a security incident;
• where the law requires.

3.3 We do not put case data into any AI service other than through the sub-processors in Annex 3.

4. Security (Art 28(3)(c), Art 32)

We apply the measures in Annex 2. We may change them, but not so as to reduce the overall protection of case data.

5. Sub-processors (Art 28(2), (3)(d), (4))

5.1 You authorise the sub-processors listed in Annex 3.

5.2 We will give at least 30 days' notice before adding or replacing a sub-processor of case data. Notice goes by email, with a new version of the terms.

5.3 You may object on reasonable data-protection grounds within the notice period. If we cannot resolve the objection, you may stop using Lawfair, and we will delete your case data without charge.

5.4 Each sub-processor is bound by a written contract whose data-protection obligations are no less protective than this Addendum. We remain responsible to you for each sub-processor's performance.

6. Location and transfers

6.1 We store and process case data in the UK, in the AWS London region.

6.2 We will not transfer case data outside the UK except on your instruction. Any new location comes with notice under clause 5.2, and with a transfer mechanism that data protection law recognises.

7. Data subjects' rights (Art 28(3)(e))

7.1 If a data subject asks us about case data, we will pass the request to you without undue delay. We will not respond to it ourselves, except to say that we have passed it on.

7.2 Your users can export, correct and delete case data in Lawfair themselves. Where that is not enough, we will give you reasonable help.

8. Personal data breaches (Art 28(3)(f), Art 33)

8.1 We will notify you without undue delay, and in any event within 48 hours of becoming aware, of any personal data breach affecting case data.

8.2 As far as it is known at the time, the notice will give:

• what happened;
• the categories and approximate number of data subjects and records concerned;
• the likely consequences;
• the measures taken or proposed;
• a contact.

We will update it as we learn more.

8.3 We will cooperate with your investigation, and with your notifications to the ICO and to data subjects. We will not notify the ICO or data subjects about case data on your behalf, unless you ask us to or the law requires it.

8.4 Notifying you is not an admission of fault.

9. Impact assessments (Art 28(3)(f), Arts 35–36)

We will give reasonable help with your data protection impact assessments and any prior consultation with the ICO. That help includes a summary of our own DPIA and our Security Overview.

10. Demands for case data

10.1 If a court, regulator, police force or other authority demands case data from us, we will:

• (a) refer the demand to you where we can;
• (b) tell you promptly, before disclosing anything, unless the law forbids that;
• (c) give you a reasonable opportunity to object or to seek a protective order, and support you in doing so;
• (d) where the material may be privileged, assert that it may be, and that we hold it for you;
• (e) disclose only the minimum the demand requires.

11. Return and deletion (Art 28(3)(g))

11.1 Your users can export case data at any time in Settings, and can delete any case, or their account, at once.

11.2 When access ends for any reason, you have 30 days to export case data. If access ended at once under terms clause 14.2(a), we will provide the export on request within those 30 days. After that we delete it, unless the law requires us to keep it.

11.3 Deleted data persists in encrypted database backups for up to 7 days, until those backups expire. Backups are used only to recover the service after a failure.

11.4 On request, we will confirm deletion in writing.

12. Information and audits (Art 28(3)(h))

12.1 On request, we will make available the information needed to show we meet Art 28:

• this Addendum;
• our Security Overview;
• a summary of our DPIA;
• our sub-processors' own assurance reports, where they allow us to share them.

Once a year, we will also answer a reasonable security questionnaire.

12.2 If that information does not show compliance, or a regulator requires more, you may audit us. Either you or an independent auditor may carry it out. The auditor must be bound by confidentiality and must not be our competitor. An audit:

• happens no more than once in 12 months, except after a breach affecting your case data or where a regulator requires;
• takes place on 30 days' notice, during business hours;
• is at your cost;
• is remote where possible;
• must not expose other users' data.

13. Your responsibilities

You confirm that:

• you have a lawful basis for the processing, and a condition for any special-category or criminal-offence data;
• you have given data subjects the information the law requires, or an exemption applies;
• your instructions comply with data protection law;
• your users upload material only as terms clause 6.2 permits.

14. Liability

Liability under this Addendum is subject to terms clause 12, including its cap. Nothing in this Addendum limits a data subject's rights under data protection law.

15. Duration

This Addendum applies for as long as we hold case data.

Annex 1: the processing

Annex 2: security measures

Annex 3: sub-processors of case data

Processors of the account data we control are listed in the Privacy Notice.

Clicking Accept records your name, account, timestamp, and this version.