GLM-Legal Privacy Review: Is Z.ai Safe for Client Contracts?

Short answer: GLM-Legal is a closed legal model that you can only reach through Z.ai’s servers, and the consumer agent it is heading to, AutoClaw, lists your uploaded files and code among the data it may use to train its models, with no opt-out we could find. Our verdict is AVOID FOR CLIENT WORK. Policy reviewed October 2026, three days after Z.ai launched GLM-Legal and invited “independent practitioners” into its beta. The pitch is strong for a solo consultant: contract review, evidence analysis and compliance checklists from a model that beat its own base version by 12.5 points on Harvey’s legal agent benchmark. The catch is that contract review means uploading the exact documents your clients trusted you to keep confidential. Below is what Z.ai’s documents actually say, checked against how we vet privacy claims.

What GLM-Legal does with your data

Privacy at a glance

Privacy dimension	GLM-Legal / Z.ai’s answer
Trains on your data?	AutoClaw: user content listed for model training
Training opt-out	None documented for AutoClaw or Z.ai chat
Data retention	Inputs kept while your account exists
Third-party sharing	Group affiliates, vendors, authorities, deal partners
Storage region	Mainly Singapore; overseas group transfers allowed
Enterprise-team tier	API DPA: content not stored, application-only beta
Open weights?	No, hosted by Z.ai only

GLM-Legal launched on October 12, 2026. Per Z.ai’s launch post (retrieved 2026-10-15), there are two doors in: an API beta you apply for through a consultation form, and AutoClaw, Z.ai’s desktop agent, where the company says the legal model will arrive “soon”. Hacker News commenters pointed out in the 673-point launch thread that the weights are not public, so you cannot run it on your own hardware.

That makes the AutoClaw policy the one most freelancers will actually sign. Per the AutoClaw privacy policy (effective March 25, 2026, retrieved 2026-10-15), the app collects the text, files, images, audio, video, shell commands and code you submit. When a task needs the web, it also reads page information, including pages you log into on its behalf. The purpose table then lists user content, alongside logs and device data, under improving and developing the service, and names training and improving models as an example. The legal basis is legitimate interest, not consent. The only carve-out is data pulled through Google Workspace APIs.

Retention is open-ended. Inputs are kept as long as you have an account. You can delete individual conversations, which the policy says disappear from history and the back end, and closing your account triggers deletion or anonymization under applicable law.

The controller for both AutoClaw and Z.ai chat is Jingsheng Hengxing Technology, a Singapore company. Both policies say data is generally processed in Singapore, but may also move to affiliated companies within the group and to their service providers overseas. Disclosure categories include affiliates, vendors, prospective investors or buyers, and government authorities.

The API is different. Per the Z.ai API privacy policy and its data processing addendum (retrieved 2026-10-15), Z.ai says it does not store the text you send through the API and processes it in real time only. Separately, the launch post explains that legal professionals grade production outputs and that this feedback flows into later training cycles. It does not say whose outputs.

What this means for solo freelancers

Legal AI is the category where a privacy gap costs the most, because the input is almost always someone else’s confidential information. Three scenarios show where it bites.

If you upload a client’s services contract to AutoClaw for a quick review, the file becomes user content. Based on the policy as written, that content sits in the bucket Z.ai may use to improve its models, and there is no switch to refuse. Most NDAs and consulting agreements bar you from sharing the client’s documents with third parties for their own purposes. Model improvement is a purpose of Z.ai’s, not your client’s.

If you let the agent fetch documents from a signed-in portal, such as a client’s contract management system or shared drive, the policy treats the page information it collects as part of the task. You are effectively granting a desktop agent your client’s access rights, and the resulting data follows the same retention and training rules.

If your clients are in the EU or UK, the processing chain is hard to document. The vendor sits in Singapore, allows onward transfers to group affiliates elsewhere, and does not name them. Based on the policy as written, this approach carries a real risk: you could not tell a client which jurisdictions their contract passed through. Our explainer on what a data processing agreement means for solo consultants lists the questions to ask before any vendor touches client personal data.

There is also a privilege question. Lawyers in the launch thread pointed out that typing your own legal questions into a third-party AI is not automatically protected the way a conversation with counsel is. If you are a paralegal, contract manager or legal-ops freelancer, ask the supervising attorney before any matter file goes near a hosted model.

How to use it safely

If you still want to test GLM-Legal, treat it as a public-document tool and nothing more.

1. Use the API route, not the desktop agent, for anything real. Apply at z.ai/consultation/legal and ask for the API terms and the data processing addendum in writing. The addendum’s no-storage commitment is the strongest promise Z.ai makes anywhere.
2. Ask whether API outputs feed the training loop. The launch post describes graded production feedback becoming training signal. Get a written answer on whether your API traffic is excluded before sending a single client clause.
3. Test with redacted or synthetic contracts. Replace party names, prices, dates and governing-law details with placeholders such as “Client A” and “Vendor B”. A model can still spot a weak termination clause without knowing who signed it.
4. If you install AutoClaw, keep it in a sandbox. Run it under a separate macOS or Windows user account with no synced client folders, and deny file-access prompts for directories that hold client work. Do not log it into client portals.
5. Delete as you go. After each test session, delete the conversation from your history; the policy says this removes it from the back end. Close the account when the trial ends.
6. Tell the client. If any client material is involved, a one-line disclosure in your engagement letter avoids a surprise later.

Finally, keep a short log of what you tested, when, and with which redacted file. If a client later asks whether their documents reached an offshore AI vendor, a dated record beats memory.

For a wider routine across your whole stack, our guide on how to opt out of AI training for freelance work covers the same checks for other assistants.

Privacy-friendlier alternatives

For contract review, the safer options either keep the document off a vendor’s servers or keep it under encryption the vendor cannot read.

• Lumo by Proton: what it gives you that GLM-Legal does not is a published no-training, no-logs posture, with saved chats under zero-access encryption and open-source code you can inspect. It is a general assistant, not a legal specialist, so expect clause summaries rather than benchmark-grade analysis. Free tier available; Lumo Plus is $12.99 a month or $9.99 a month billed yearly. Best for freelancers who want a quick second read of a contract without feeding a training corpus.
• LM Studio with an open-weight model: what it gives you is a model that runs entirely on your laptop, so no contract ever leaves your machine. The app is free; the cost is hardware, since good reasoning models want 32 GB of memory or more. Best for technical consultants and anyone bound by strict NDAs.
• Proton Drive: not an AI tool, but the right home for the contracts themselves. End-to-end encrypted storage and expiring share links mean the files you do not send to any AI stay readable only by you and the client. Free tier available; paid plans start in the low single digits per month. Best for solo consultants exchanging signed agreements.

If you already use Proton, our Lumo privacy review goes deeper on its limits. For another China-linked assistant compared on the same criteria, see our Kimi AI privacy review.

A quick note on cost, because it drives behavior. GLM-Legal’s appeal is partly price: specialist legal platforms built for law firms are usually sold on annual seats far above a solo budget, which is exactly why a cheap hosted model is tempting. Pairing a free local model for first-pass reading with a paid encrypted assistant for summaries covers most freelance contract work for under $15 a month, without handing a vendor the documents.

The test for any legal AI is the same three questions: does the vendor keep the document, can it train on it, and will it sign a processing agreement naming every place the data goes. Today GLM-Legal’s consumer route fails the first two, and its API route is still a closed beta.

The verdict

Frequently asked questions

Does GLM-Legal train on my contracts?

Based on the policy as written, the route most freelancers will use leaves the door open to training. The AutoClaw policy lists user content, including files and code, under improving and developing services, with model training given as an example and no opt-out. The Z.ai API addendum says submitted text is not stored at all. The launch post adds that graded production feedback becomes training signal, without saying which channel that feedback comes from.

Is GLM-Legal open source or self-hostable?

No. GLM-Legal is built on GLM-5.3-Flash, but Z.ai has not released its weights, and commenters in the Hacker News launch thread noted it is only available through Z.ai. That matters for privacy because self-hosting is the usual way to keep confidential documents on your own hardware. If an open-weight version ships later, the privacy picture changes completely and we will update this review.

Is Z.ai GDPR-friendly for EU client documents?

Based on the policy as written, it is difficult to document. The controller is a Singapore company, data is mainly processed in Singapore, and onward transfers to group affiliates and their providers abroad are allowed without a named list. The policy promises lawful transfer mechanisms but publishes no sub-processor list. If you handle personal data for an EU or UK client, request the processing addendum and transfer details in writing first.

Can I use GLM-Legal for HIPAA data or medical-legal files?

Based on the public documents, no. Neither the AutoClaw policy, the Z.ai chat policy nor the API terms mention HIPAA or offer a business associate agreement, and none describe healthcare-specific safeguards. Personal injury files, disability claims and medical malpractice records often contain protected health information. Keep them out of GLM-Legal entirely and use a vendor that will sign a business associate agreement or a fully local model.

Where is GLM-Legal data stored?

Both the Z.ai and AutoClaw policies say services are generally provided from Singapore, so your data is generally processed there. The same sections allow transfers to affiliated companies in the Z.ai group and their designated providers located overseas, plus disclosure to government authorities where Z.ai believes the law requires it. The API addendum also points to Singapore but says submitted text is processed in real time and not saved.

Sources

• Z.ai: GLM-Legal launch post, published 2026-10-12 (retrieved 2026-10-15)
• AutoClaw Privacy Policy, effective 2026-03-25 (retrieved 2026-10-15)
• Z.ai Privacy Policy (chat), last updated 2025-09-29 (retrieved 2026-10-15)
• Z.ai API Privacy Policy and Data Processing Addendum (retrieved 2026-10-15)
• Hacker News launch discussion, 673 points (retrieved 2026-10-15)
• Unite.AI coverage of the GLM-Legal launch, 2026-10-12 (retrieved 2026-10-15)
• GLM-Legal on Product Hunt (retrieved 2026-10-15)
• Lumo by Proton, product and pricing page (retrieved 2026-10-15)

Reviewed by Jérémy, founder of AidTaskPro and GreenBudgetHub. Based in central France. Privacy posture sourced from public policies and vendor documentation as of October 15, 2026.