Privacy Policy

1. Who We Are and How This Policy Works

This Privacy Policy describes how personal information is collected, used, and disclosed in connection with the website located at www.arceus.legal, Counsel OS (our client collaboration platform, described in Section 3), related subdomains, email communications, and online intake forms (collectively, the “Site”).

This Site is operated under a management services arrangement between two separate legal entities: Gero Labs, Inc., a Delaware corporation doing business as Arceus (the “MSO”), which provides non-legal administrative, marketing, technology, and business support services; and Arceus P.C., a California professional law corporation (the “Firm”), which is the entity that provides legal services to clients. The MSO does not practice law, does not provide legal advice, and is not a party to the attorney-client relationship.

1.1 Who is responsible for what

Arceus MSO operates the public marketing Site as a technical and business matter — hosting, security, analytics, advertising, content, and the general intake/contact forms — and is the entity that determines the purposes and means of processing ordinary Site-visitor data (browsing activity, cookies, newsletter sign-ups, general contact-form fields, and similar). For that data, Arceus MSO is the “business”/“controller” referred to throughout this Policy.

Arceus MSO also develops, hosts, and provides technical support for Counsel OS, the client collaboration platform described in Section 3. With respect to Onboarding Information, Client Content, and communications with your legal team submitted through Counsel OS, Arceus MSO acts solely as a service provider to Arceus P.C. — processing that information only on the Firm’s instructions and for the purpose of providing the platform — and not as an independent business determining its own purposes for that data.

Arceus Law is the entity you engage (by separate written engagement letter) if you become a client, and is solely responsible for legal advice, case handling, client files, and any information provided in the course of, or in anticipation of, an attorney-client relationship. Sections 3 and 12 below explain how that information is treated differently from ordinary Site data.

Except where this Policy says otherwise, references to “we,” “us,” and “our” mean Arceus MSO acting as operator of the Site.

2. No Attorney-Client Relationship Is Formed by Using the Public Website

Information submitted before an engagement letter is signed is reviewed for routing and conflict-check purposes and is handled as described in Section 12. If you are on a deadline (such as a statute of limitations), do not rely on a website submission to preserve your rights — contact the Firm directly by phone.

This section concerns the public marketing website only. If you already have a signed engagement letter with Arceus P.C. and have been given access to Counsel OS, Section 3 describes how your information is handled there.

3. Counsel OS: The Client Collaboration Platform

Counsel OS is the secure client portal Arceus P.C. makes available to its clients to upload and exchange documents, track matters, and communicate with their legal team. It is only available to current clients (or prospective clients being onboarded) with an active login; it is not part of the public marketing Site described in Sections 5 through 11.

3.1 Who operates Counsel OS and in what role

Arceus MSO builds, hosts, and maintains the Counsel OS technology on behalf of Arceus P.C. As explained in Section 1.1, Arceus MSO acts as a service provider/processor to the Firm for everything you submit through Counsel OS — it does not use that information for its own independent purposes (such as MSO’s own marketing, analytics, or advertising), does not sell or share it, and accesses it only as necessary to build, host, secure, and support the platform, or as instructed by the Firm.

3.2 Accounts and eligibility

To use Counsel OS you must be invited by the Firm and create an account using your name, email address, and (if applicable) your organization. We use this account information to authenticate you, maintain your session, and associate your activity with the correct matter(s).

3.3 Onboarding Information and company profile

When your organization is onboarded to Counsel OS, we collect the information needed to set up your account, tailor how your contracts are reviewed, and build a profile of your company (“Onboarding Information”). Onboarding Information is collected through the Counsel OS sign-up and onboarding flow, the Legal Preferences and account settings you complete, your onboarding call with the Arceus team, and the sources described below. It may include:

• Company and contact details — your organization’s legal name, website, business address, industry, and the name, job title, email address, and phone number of the account owner and other key contacts.
• Team members and escalation contacts — the names, email addresses, and roles of colleagues you invite to Counsel OS, and who should receive attorney questions and escalations.
• Legal preferences and playbook positions — your standard positions on key contract terms (for example, limitation of liability, indemnification, confidentiality, payment terms, and governing law), approval thresholds, fallback positions, and risk tolerances.
• Contracting profile — the types of contracts you typically handle, their frequency and volume, expected timing of upcoming contracts, pain points with your current legal process, and anything else you choose to tell us during onboarding.
• Billing information — your plan, quote approvals, billing contact, and payment details. Card payments are processed by our payment processor (Stripe); we do not store full payment card numbers.
• Connection and channel settings — which tools you connect (such as the Arceus Slack agent, Google Workspace, or Salesforce) and how they are configured (see Section 3.6).
• Publicly available business information. To pre-populate and enrich your company profile, Counsel OS may collect publicly available information about your organization from the internet — such as your company website, press releases, public business databases and filings, and professional networking sites. This may include your company’s description, products and services, customers and markets, size, funding stage, locations, leadership names and titles, and publicly posted terms (such as terms of service or a privacy policy). We use this information only to understand your business so that intake, first-pass contract analysis, and your playbook reflect how your company operates. We do not use it to build marketing profiles of individual employees, and you can review and correct your company profile in Counsel OS account settings or by contacting your legal team.

Onboarding Information is client information. Arceus MSO processes it only as a service provider to the Firm (Section 3.1); it is subject to the confidentiality commitments in Section 12, is never sold or shared for advertising, and is retained and deleted as described in Section 3.8.

3.4 Content you submit (“Client Content”)

Counsel OS lets you submit agreements, counterparty redlines, and other documents relating to your matter — by uploading them to the portal or sending them to the Arceus agent in Slack — together with the context, instructions, and deadlines you provide (“Client Content”). As between you and us, you retain ownership of your Client Content. We use Client Content solely to provide, maintain, and support Counsel OS and the legal services the Firm has been engaged to perform, including the AI-assisted first-pass analysis described in Section 4. We do not use Client Content to train artificial intelligence or machine-learning models, for MSO’s own advertising or analytics, or for any purpose unrelated to your matter, without your separate written consent.

3.5 Communications with your legal team

Messages you send to attorneys or staff through Counsel OS are handled as attorney-client communications and are subject to the confidentiality and privilege protections described in Section 12 — not treated as ordinary marketing or support data. Access to these communications is limited to the attorneys and staff working on your matter and the limited Arceus MSO personnel who need access to operate the platform (e.g., for technical support), consistent with Section 12.1’s ethical-wall commitments.

3.6 Connecting Slack, Google Workspace, and Salesforce

Counsel OS allows you to optionally connect it to third-party services you already use, including Slack, Google Workspace (G Suite), and Salesforce, so that matter updates, documents, or notifications can flow between Counsel OS and those tools. When you connect an integration:

• You authorize the connection yourself (typically via OAuth) and control which permissions (“scopes”) you grant; we request only the access needed for the features you enable.
• Information exchanged through the integration — for example, a notification posted to a Slack channel, a document synced to a Google Drive folder, or a matter status pushed to a Salesforce record — is shared only with the workspace or account you connected, and is governed by your organization’s own agreement and settings with Slack, Google, or Salesforce, in addition to this Policy.
• You are responsible for ensuring you have the necessary rights within your organization to connect these accounts and to share matter-related information through them.
• You can review connected integrations and revoke access at any time from Counsel OS account settings or directly within the third-party service; once revoked, we stop syncing new data, though data already shared through the integration remains subject to that third-party service’s own retention and deletion practices.

3.7 Security

We use administrative, technical, and physical safeguards designed for the sensitivity of Client Content and legal communications, including encryption of data in transit and at rest, role-based access controls limiting Counsel OS data to your matter team, authentication safeguards, and logging of access to Client Content.

3.8 Retention and deletion

Retention period. Client Content, Onboarding Information, and communications in Counsel OS are retained for the term of your engagement plus up to three (3) years, unless you ask us to delete them sooner. Security and access logs are retained for at least 90 days. Because Counsel OS holds client-file records, retention and deletion are also subject to the Firm’s client-file record-retention policy and its obligations under the California Rules of Professional Conduct, which may require the Firm to keep certain records for a longer period.

Exporting your data. You can download your reviewed contracts and redlines from the Counsel OS portal at any time during your engagement.

End of engagement. When your engagement ends, we remove your users’ access to Counsel OS.

Deletion requests. On written request to privacy@arceus.legal or your legal team, we delete your data from active systems within 30 days, and copies in database backups roll off within a further 7 days. We will confirm deletion to you in writing, and will tell you if any records must be kept to meet the Firm’s professional or legal obligations.

3.9 Sub-processors

In providing Counsel OS, Arceus MSO uses the sub-processors listed below. Each is bound by written confidentiality, security, and data-protection obligations and may process Client Content or Onboarding Information only as needed to provide its service to us.

We will post updates to this list at arceus.legal/subprocessors before a new sub-processor begins processing Client Content. Services you connect yourself, such as Salesforce or your own Slack or Google Workspace account, are governed by your organization’s agreements with those providers (Section 3.6).

4. Artificial Intelligence

Counsel OS uses artificial intelligence, including large language models, to help the Firm deliver legal services faster. This section explains how AI is used, what information it processes, and the limits we place on it.

4.1 How Counsel OS uses AI

When you submit a contract, Counsel OS uses AI tools under attorney supervision to:

• conduct intake and prepare a quote and turnaround estimate for your approval;
• gather relevant context from your Onboarding Information, company profile, legal preferences, prior matters, and any tools you have connected;
• perform a first-pass analysis — flagging issues and risks on key terms and generating initial redlines, summaries, and draft counterparty emails; and
• track the status of your matters and route questions and escalations.

4.2 AI model providers

We use third-party AI model providers to process Client Content and Onboarding Information as needed for these functions. These providers are sub-processors (Section 3.9) engaged under terms that prohibit them from using your information to train their models and that limit their retention of it to what is needed to provide the service and to meet safety and legal requirements.

4.3 No training on your data

We do not use Client Content, Onboarding Information, or attorney-client communications to train or fine-tune AI models — ours or any third party’s — without your separate written consent. Your legal preferences and company profile are used to tailor the work performed for your organization, not to improve outputs for other clients.

We may use aggregated or de-identified information — such as turnaround times, feature usage, and error rates — to operate, secure, and improve Counsel OS. De-identified information is processed using measures designed so that it cannot reasonably be used to identify you, your organization, or your matters; we maintain it only in de-identified form and do not attempt to re-identify it.

4.4 Confidentiality

AI processing takes place within Counsel OS and is subject to the same confidentiality, security, and ethical-wall commitments as the rest of the platform (Sections 3 and 12). The Firm uses AI tools consistent with its duties of confidentiality and competence under the California Rules of Professional Conduct and the State Bar of California’s guidance on the use of generative AI in the practice of law.

4.5 Human oversight

AI output is a first pass, not legal advice. A licensed Arceus P.C. attorney reviews every deliverable, makes the legal judgment calls, and signs off before it is delivered to you — you never receive unreviewed AI output as legal work product. We do not use AI to make decisions that produce legal or similarly significant effects about you, such as whether the Firm will represent you, without meaningful human review (see Section 10).

4.6 Questions about AI

If you have questions about how AI is used on your matters, or would like to discuss limits on its use for a particular matter, contact your legal team or email privacy@arceus.legal.

5. Information We Collect

The categories below describe the personal information collected through the public marketing Site and, where noted, in connection with onboarding to Counsel OS. See Section 3 for the separate categories of information — account data, Onboarding Information, Client Content, and communications — collected through Counsel OS itself.

We do not knowingly collect Social Security numbers, driver’s license numbers, financial account credentials, or precise (GPS-level) geolocation through the Site itself.

6. How We Use Information

Arceus MSO uses the categories of information above for the following business purposes:

• Operating, maintaining, and securing the Site;
• Responding to inquiries and routing prospective-client submissions to the Firm for conflict checks and intake;
• Onboarding new clients to Counsel OS on the Firm’s behalf — creating and enriching company profiles (including with publicly available business information, as described in Section 3.3), configuring legal preferences, team members, and escalation contacts, and setting up billing and integrations;
• Providing the AI-assisted intake, context-gathering, and first-pass contract analysis described in Section 4, subject to attorney review;
• Sending requested information, newsletters, or marketing communications, where you have not opted out;
• Measuring and improving Site performance and content through analytics;
• Advertising and marketing, including measuring the effectiveness of campaigns (see Section 8 on cookies and “sharing”);
• Detecting, investigating, and preventing fraud, abuse, and security incidents;
• Complying with legal obligations and enforcing our terms.

We do not use information collected through the Site to make decisions about legal representation on a fully automated basis; intake and engagement decisions are made by attorneys at the Firm. See Section 4.5 (Human oversight) and Section 10 (Automated Decision-Making Technology).

7. How We Disclose Information

We disclose personal information to the following categories of recipients:

• Arceus P.C. — for conflict checks, intake, and (if you become a client) legal representation;
• Service providers and processors — hosting, database, email delivery, scheduling, customer relationship management (CRM), payment processing, monitoring, analytics, and AI model providers (see Sections 3.9 and 4.2), bound by contract to use information only to provide services to us;
• Advertising and analytics partners — for site measurement and interest-based advertising, as described in Section 8;
• Slack, Google Workspace, and Salesforce — only where you connect one of these as a Counsel OS integration, and only to the extent of the permissions you grant, as described in Section 3.6;
• Professional advisors — auditors, insurers, and legal counsel to the MSO or Firm, as needed;
• Government authorities or other third parties — where required by law, subpoena, or court order, or to protect rights, safety, or property;
• A successor entity — in connection with a merger, financing, or sale of some or all of the MSO’s business.

“Sale” and “Sharing” under California law. We do not sell personal information, and we have not sold personal information in the preceding 12 months. However, the Site uses Google advertising cookies (e.g., _gcl_au) and a LinkedIn advertising cookie (e.g., bcookie), which constitute “sharing” personal information for cross-context behavioral advertising as that term is defined under the CCPA/CPRA. You can opt out of this sharing at any time — see Section 9 — and the Site honors the Global Privacy Control signal as an opt-out request (Section 8.1). This “sharing” discussion concerns the public marketing Site only; Client Content and communications you submit through Counsel OS are never sold or shared for advertising (Section 3.4). More broadly, we do not sell, rent, or share client information — including Counsel OS account data, Onboarding Information, company profiles, Client Content, and attorney-client communications — with anyone for their own purposes, and we do not use it for advertising.

8. Cookies and Online Tracking Technologies

The Site uses cookies and similar technologies for essential site functionality, analytics/performance measurement, and advertising.

8.1 Global Privacy Control and Do Not Track

This Site is programmed to detect and honor the Global Privacy Control (GPC) signal as a valid request to opt out of the sharing of personal information for the browser or device sending it. The Site currently does not otherwise respond to browser “Do Not Track” signals that are not GPC, as there is no common industry standard for interpreting them, consistent with Cal. Bus. & Prof. Code § 22575(b)(7).

8.2 Managing cookies

You can manage or block cookies through your browser settings, our cookie-consent banner/preference center, or the opt-out mechanisms described in Section 9. Blocking some cookies may affect Site functionality.

9. Your California Privacy Rights (CCPA/CPRA)

If you are a California resident, and to the extent the CCPA applies to Arceus MSO’s processing of your information, you have the following rights, subject to certain exceptions:

• Right to Know / Access — what personal information we have collected, used, disclosed, and (where applicable) sold or shared about you in the preceding 12 months, and to receive a portable copy;
• Right to Delete — request deletion of personal information we collected from you, subject to legal exceptions (e.g., completing a transaction, security, legal compliance, internal lawful use compatible with the context of collection);
• Right to Correct — request correction of inaccurate personal information;
• Right to Opt Out of Sharing — we do not sell your personal information. The only “sharing” of personal information under California law occurs through the advertising cookies on the public Site described in Section 8, which are used for cross-context behavioral advertising. You can opt out of this sharing at any time using the “Do Not Sell or Share My Personal Information” link or by sending a GPC signal. Client information in Counsel OS — including account data, Onboarding Information, and Client Content — is never sold or shared;
• Right to Limit Use of Sensitive Personal Information — direct us to limit use of sensitive personal information to purposes necessary to provide requested services;
• Right to Non-Discrimination — we will not deny goods/services, charge different prices, or provide a different level of service because you exercised a privacy right;
• Right to Appeal — where we deny a request, you may appeal the decision as described in our response.

These rights concern the public marketing Site’s use of your information as described in this Policy. Requests relating to Client Content or communications in Counsel OS should go through the Firm under your engagement agreement, since Arceus MSO holds that information only as the Firm’s service provider (Section 3.1).

9.1 How to submit a request

You may submit a request by: (a) emailing privacy@arceus.legal; or (b) sending mail to 150 Post St., Ste 660, San Francisco, CA 94108. We will verify your identity using a reasonable method proportionate to the sensitivity of the request before responding, and will respond within 45 days (extendable once by an additional 45 days with notice to you).

Authorized agents may submit a request on your behalf by providing signed permission and, where required, verifying their own identity; we may still require you to directly verify your identity or confirm the agent’s authority.

We do not sell personal information, and we will not share the personal information of consumers we know to be under 16 years of age without opt-in consent (from the minor, aged 13–15, or a parent/guardian for a minor under 13). See Section 13.

Shine the Light. California residents may separately request, once per year and free of charge, information about disclosure of personal information to third parties for their own direct marketing purposes under Cal. Civ. Code § 1798.83, by writing to 150 Post St., Ste 660, San Francisco, CA 94108.

10. Automated Decision-Making Technology

As of the effective date of this Policy, Arceus MSO does not use automated decision-making technology (ADMT) on the Site to make decisions that produce legal or similarly significant effects (for example, decisions about whether to represent you). If that changes, this Policy will be updated to include a pre-use notice describing: the purpose of the ADMT; your right to opt out (unless an exception applies) and to appeal a decision involving human review; and how to exercise those rights, consistent with the CCPA regulations effective January 1, 2026. Counsel OS uses AI tools to assist attorneys in preparing legal work (Section 4), but those tools do not make decisions about you; every deliverable is reviewed and signed off by a licensed attorney.

11. Your Privacy Rights in Other U.S. States

If you are a resident of a state that has enacted a comprehensive consumer privacy law — which, as of 2026, includes (among others) Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, Delaware, Iowa, Indiana, Tennessee, Kentucky, Rhode Island, Nebraska, and Arkansas — you generally have rights similar to those described in Section 9: the right to confirm and access personal data we process about you, correct inaccuracies, delete personal data, obtain a portable copy, and opt out of targeted advertising, the sale of personal data, and profiling in furtherance of decisions producing legal or similarly significant effects. Most of these laws also require us to honor a universal opt-out mechanism (such as GPC) for opt-out-eligible browsers, which we do.

To exercise these rights, use the same contact methods listed in Section 9.1. We will not discriminate against you for exercising these rights. If we deny your request, you may have the right to appeal, and, following an unsuccessful appeal, to contact your state Attorney General.

Because state laws differ in scope, thresholds, and exact terminology, this section is intentionally general.

12. Confidentiality of Prospective and Current Client Information

This section explains how the MSO/Firm structure protects client confidentiality and the attorney-client privilege, and is a key operational commitment underlying this Policy, not just a legal disclaimer. It applies with equal force to information submitted through the public Site described in Section 2 and to Client Content and communications submitted through Counsel OS described in Section 3.

12.1 Ethical wall between MSO and Firm

Arceus MSO personnel may have access to the Site’s general contact/intake form, and to Counsel OS infrastructure, solely to perform administrative and technical functions — routing submissions to the Firm, conflict-check logistics, hosting, and technical support for Counsel OS. Arceus MSO personnel do not provide legal advice, do not make decisions about representation, and are bound by confidentiality obligations in their agreements with the Firm not to access, use, or disclose the substance of any prospective or actual client matter, Client Content, or attorney-client communications except as necessary to perform those administrative and technical functions.

12.2 What governs client and case information

Once you become a client of Arceus P.C., information relating to your representation — including Client Content and communications submitted through Counsel OS — is governed by the engagement agreement, the California Rules of Professional Conduct (including Rule 1.6 on confidentiality), and applicable evidentiary privilege law — not by this Site Privacy Policy. If there is any conflict between this Policy and the Firm’s professional confidentiality obligations to a client, those professional obligations control.

12.3 Before you are a client

Prospective-client communications sent before an engagement letter is signed are protected to the extent required by Rule 1.18 of the California Rules of Professional Conduct (duties to prospective clients), but — as noted in Section 2 — are not protected by attorney-client privilege merely because they were submitted through the public Site. Please avoid including highly sensitive details in an initial web inquiry; the Firm will ask for those details through Counsel OS or another secure channel once a conflict check is complete and you have signed an engagement letter.

13. Children’s Privacy

The Site is intended for adults and is not directed to children under 13. We do not knowingly collect personal information from children under 13 in violation of the Children’s Online Privacy Protection Act (COPPA). If we learn we have inadvertently collected such information, we will delete it. As noted in Section 9.1, we also apply the CCPA’s heightened opt-in requirements for the sharing of personal information of known minors under 16.

14. Marketing Communications

If you sign up for emails, texts, or calls, we will only send marketing communications consistent with your consent and applicable law, including the CAN-SPAM Act (which requires a functioning unsubscribe mechanism in every commercial email, honored promptly) and the Telephone Consumer Protection Act (TCPA) (which requires appropriate consent before autodialed, prerecorded, or text marketing calls/messages, and an easy way to revoke it). You can unsubscribe from emails using the link in any message, reply STOP to text messages, or contact us using Section 19. This section does not apply to case-related communications sent to you through Counsel OS or by your legal team, which are not marketing.

15. Data Security

We maintain administrative, technical, and physical safeguards designed to protect personal information from unauthorized access, use, or disclosure, scaled to the sensitivity of the information involved. For the public marketing Site, this includes standard web-application security practices (encrypted connections, access controls, vendor due diligence). For Counsel OS — which holds Client Content and attorney-client communications — Section 3.7 describes additional safeguards, including encryption in transit and at rest, role-based access limited to your matter team, and access logging. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

16. International Visitors

This Site is directed to visitors in the United States. If you access the Site, or use Counsel OS, from outside the United States, your information will be transferred to and processed in the United States, which may not have the same data protection laws as your home jurisdiction. Where you connect a Slack, Google Workspace, or Salesforce integration (Section 3.6), those providers may process data using their own global infrastructure regardless of where you are located.

17. Third-Party Links

The Site may link to third-party websites we do not control. This Policy does not apply to those sites, and we encourage you to review their privacy policies separately.

18. Changes to This Policy

We may update this Policy from time to time. We will post the revised Policy with a new “Last Updated” date and, where changes are material, provide additional notice as required by law before the changes take effect.

19. Contact Us

19.1 Privacy requests and Site-operation questions (Arceus MSO)

Gero Labs, Inc. d/b/a Arceus — Attn: Privacy

150 Post St., Ste 660, San Francisco, CA 94108.

Email: privacy@arceus.legal

19.2 Counsel OS support (technical issues, integrations, access)

For help logging in, connecting Slack/Google Workspace/Salesforce, or other technical issues with Counsel OS, contact support@arceus.legal. This channel is for technical/operational support only and is staffed by Arceus MSO personnel bound by the confidentiality commitments in Section 12.1 — it is not a substitute for contacting your attorney about your matter.

19.3 Prospective or existing client / legal-matter questions (Arceus P.C.)

Arceus P.C.

150 Post St., Ste 660, San Francisco, CA 94108.

Email: contact@arceus.legal

Please do not use this Firm contact channel to submit a privacy rights request under Sections 9–11 — use the Arceus MSO contact details in Section 19.1 so the request reaches the team responsible for handling it.