TLR Legal Retrieval Service Privacy Notice

This notice applies to the TLR legal retrieval service (tlr.dr-legal.com.tw), including its MCP endpoint and REST API, provided by Dr.Legal (法律偵探, dr-legal.com.tw). The Service lets AI tools such as Claude and ChatGPT search and cite Taiwanese court decisions, statutes, constitutional rulings and administrative rules. The final answer is generated by your own AI; we only supply the original content and verifiable citation links.

1. Two access methods and the data each involves

• OAuth connection (Dr.Legal account sign-in) (platforms such as Claude and ChatGPT, or your own program): when connecting, the tool registers a client with us. We store that client’s identifier, name and redirect URL, together with its access and refresh tokens and their expiry. Since 30 October 2026 authorization requires signing in to a Dr.Legal website account, and the connection is tied to your member account: we store the member identifier, sign-in email, display name and first/last sign-in times, used to identify the user, measure usage, handle abuse and make necessary contact. Anonymous connections created before 30 October 2026 are not linked retroactively and lapse when their authorization expires.
• Named API keys (partners): we store a hash of the key, the key’s label and the partner’s contact email, used to identify and contact the partner.

2. What we record for each request

Regardless of the access method, each call to the Service is logged with:

• your query text (the text itself and its hash; see section 4 for how it is used);
• the function called: judgment search, judgment full text, statute lookup, administrative-ruling search, or bundle search;
• the document identifier for full-text requests;
• response status, latency and result count;
• timestamp, source IP address and User-Agent (used for abuse detection, traffic auditing and protection of the Service);
• for OAuth connections and named keys, the corresponding client identifier or key identifier.

Do not enter real names, national ID numbers or non-public case details in your queries: whatever you type is recorded together with the query. Note also that the AI tool you use is usually a cloud model, and your conversation with it is processed by that AI provider first, outside TLR’s control.

3. What we cannot see

• The prompts and the full conversation context inside your AI tool.
• The answers your AI (Claude, ChatGPT and so on) generates for you.

The final answer exists only between you and your AI provider; we never see it.

4. How query text and logs are used

We keep query text and request logs in order to:

• improve retrieval quality: find queries that return nothing or poor results, and add data or adjust retrieval accordingly;
• understand which legal topics users care about, plan data and content, and write topic articles, FAQs and case guides;
• detect abuse, audit traffic, manage quotas and protect the Service;
• for partners with named keys, reconcile usage under the applicable agreement.

We do not use query text to train generative AI models.

If de-identified queries are ever used to build retrieval evaluation or annotation datasets, this will be subject to human review and limited to improving the Service’s retrieval and data quality.

5. Citation links

Judgment citation links point to dr-legal.com.tw/fullview/<document id>, a public page that renders the original decision. It is the same public page we publish for indexing by Google, ChatGPT, Perplexity and others.

6. Retention and sharing

In request logs, the query text, source IP address and User-Agent are kept for 12 months and then cleared automatically by a scheduled job. After clearing, only the remaining fields (function, status, latency, timestamp, client or key identifier) are retained for long-term usage statistics. OAuth client registrations are kept while the connection remains valid; named-key records are kept after revocation until the partnership ends.

We do not sell these logs and do not provide them to third parties for their own purposes. To operate the Service, the following processors handle related data on our instructions:

• Cloudflare: network proxy and encryption in transit for the Service. Your requests pass through its network.
• Provider of AI-assisted operations tooling: we use a cloud AI tool hosted outside Taiwan for abuse detection and traffic audits, during which request log entries may be read. This data is not used to train AI models.

Request logs are stored on servers we operate ourselves in Taiwan. The processors above are located outside Taiwan (mainly in the United States), so data may be processed there.

You may email [email protected] to request deletion of records relating to you. Please include enough detail to identify them, such as the connection time, source IP address or client identifier. Backups and records held by the processors are outside the scope of deletion and expire under their own retention periods.

7. Compliance

Access logs and data governance for the Service follow the ISO 42001 AI management system standard. The privacy policy for the website itself and the Chrome extension is at Privacy Policy (Chinese). The Chinese version of this notice is authoritative; this English version is provided for convenience only.