Privacy Policy

1. Who We Are

Cullis AI, LLC ("Cullis AI," "we," "us") is a Montana limited liability company providing AI governance consulting, expert witness services, and continuing legal education programs. Our principal place of business is Billings, Montana. For privacy inquiries, contact jacobrebo@cullis.ai.

2. Scope of This Policy

This Privacy Policy describes how Cullis AI collects, uses, retains, and shares personal information through the cullis.ai website (the "Site"), through direct communication with us (email, phone), and through the delivery of our Services. It does not apply to third-party websites linked from the Site.

3. Personal Information We Collect

We collect personal information from the following sources:

3.1 Information You Provide Directly

• Contact and inquiry information. When you email us, call us, or submit an inquiry through the Site, we collect the information you provide, typically including your name, email address, phone number, firm or organization name, role, and the substantive content of your message.
• CLE registration information. If you register for a Cullis AI CLE program, we collect registration details required for accreditation, including your name, bar number, jurisdiction, email, and payment information (processed by a third-party payment processor; we do not store full card numbers on our systems).
• Engagement information. If you become a Client, we collect the information required to scope, deliver, and bill the engagement, as set forth in the applicable Statement of Work or engagement letter.

3.2 Information Collected Automatically

• Server logs. Our website host (Netlify) maintains standard server logs that may include IP address, browser type, referring URL, and timestamps. We do not maintain a separate analytics layer beyond what is provided by our host.
• Cookies. The Site does not deploy advertising or cross-site tracking cookies. The website host may set technical cookies necessary for delivery of the Site. If we add analytics or marketing cookies in the future, we will update this Policy and (where applicable law requires) request consent.

3.3 Information We Do Not Collect

• No on-site chatbot. At present, the Site does not include a chat widget. We do not collect chat transcripts through this Site.
• No sensitive categories. We do not knowingly collect sensitive personal information such as government-issued identifiers, biometric data, health information, or precise geolocation through the Site.
• No data from children. The Site is intended for legal professionals and is not directed to children under sixteen (16). We do not knowingly collect personal information from children.

4. How We Use Personal Information

We use personal information for the following purposes:

• To respond to your inquiries and follow up on requests for information about our Services;
• To deliver the Services you have engaged us to provide, including scoping engagements, performing the work, and invoicing;
• To process CLE registrations, deliver CLE programs, and report CLE credits to the appropriate accreditation authorities;
• To run conflict checks before substantive engagement discussions, given our expert witness practice;
• To maintain our business records (including engagement files, deliverables, and invoicing records);
• To comply with applicable legal, regulatory, tax, and professional obligations;
• To protect the security of the Site and our business.

We do not use personal information for any form of automated decision-making that produces legal or similarly significant effects.

5. Legal Bases (Where Required)

Where the General Data Protection Regulation ("GDPR") or similar laws apply, we rely on the following legal bases for processing: (a) performance of, or steps preparatory to, a contract with you; (b) our legitimate interests in operating, securing, and developing our business, where those interests are not overridden by your rights; (c) compliance with our legal obligations; and (d) your consent, where consent is required and you have given it.

6. How We Share Personal Information

We do not sell, rent, or trade personal information. We share personal information only in the following limited circumstances:

• Service providers. With a small number of vendors who process information on our behalf to operate the business, such as our website host, email provider, payment processor, and accounting/professional services providers. These vendors are bound by contract or platform terms to use the information only to provide their services to us.
• Legal compliance. Where required by law, regulation, subpoena, or other valid legal process, or where we believe in good faith that disclosure is necessary to protect our rights, your safety, or the safety of others.
• Business transfers. In connection with a merger, acquisition, financing, reorganization, or sale of all or a portion of our business or assets. We will require the receiving party to honor this Policy or notify you of any material changes.
• With your direction. Where you direct us to share information, including with retaining counsel, court reporters, accreditation bodies, or other third parties relevant to the Services.

7. International Data Transfers

Cullis AI is based in the United States. If you contact us from outside the United States, your personal information will be transferred to and processed in the United States. Where required by applicable law, we implement appropriate safeguards for such transfers.

8. Retention

We retain personal information for as long as is reasonably necessary to fulfill the purposes for which it was collected and to comply with our legal, regulatory, tax, and professional record-keeping obligations. In general:

• Inquiry correspondence: retained for the duration of the inquiry and a reasonable follow-up period (typically up to 24 months).
• Engagement files: retained for the duration of the engagement plus the period required by applicable law and professional standards, typically a minimum of seven (7) years.
• CLE registration records: retained as required by the applicable CLE accrediting authority.
• Financial and tax records: retained as required by applicable tax and accounting law.

9. Your Rights

Depending on where you reside and the applicable law (including the Montana Consumer Data Privacy Act for Montana residents, the California Consumer Privacy Act for California residents, and the GDPR for residents of the European Economic Area and the United Kingdom), you may have some or all of the following rights with respect to your personal information:

• The right to access the personal information we hold about you;
• The right to request correction of inaccurate or incomplete information;
• The right to request deletion of personal information, subject to our legal and professional record-keeping obligations;
• The right to opt out of the sale or sharing of personal information (we do not sell or share personal information for cross-context behavioral advertising);
• The right to data portability, where applicable;
• The right to withdraw consent, where processing is based on consent;
• The right to lodge a complaint with a supervisory authority (for EEA/UK residents).

To exercise any of these rights, email jacobrebo@cullis.ai. We will respond within the timeframes required by applicable law. We may need to verify your identity before fulfilling a request, and we may decline a request to the extent permitted by law (for example, where compliance would compromise an ongoing engagement or violate a record-retention obligation).

10. Security

We maintain reasonable administrative, technical, and physical safeguards designed to protect personal information against unauthorized access, alteration, disclosure, or destruction. These include access controls on business systems, encryption in transit for the Site, and limiting personal information access to those with a business need. No system can be guaranteed to be completely secure. If we become aware of a personal data breach affecting your information, we will notify you and applicable authorities as required by law.

11. Confidentiality & Privilege Considerations

If you send Cullis AI confidential information through this Site (for example, by email) before a mutual NDA is in place, please be aware that such information is not protected by attorney-client privilege (because Cullis AI is not your attorney) and may not be protected by other confidentiality regimes until an NDA is executed. We recommend that you limit unsolicited initial communications to a high-level description of the matter and your contact information; we will follow up with the conflict-check process and a mutual NDA before discussing specifics.

12. Changes to This Policy

We may update this Privacy Policy from time to time. The "Last updated" date at the top of this page reflects the most recent revision. Material changes will be highlighted at the top of the Policy for a reasonable period and, where required by law, brought to your attention through other means.

13. Contact

Questions, requests, or complaints related to this Privacy Policy or our handling of your personal information may be directed to:

Cullis AI, LLC
Attn: Privacy Inquiries
Billings, Montana
Email: jacobrebo@cullis.ai
Phone: (406) 529-5268