Document reference: INF-03-DOC-01
Owner: Legal Lead + CEO (Andrew Herbert)
Approved by: CEO (Andrew Herbert) + Legal Lead
Effective date: 2026-04-20
Next review date: 2027-04-20 (annual cycle)
Version: 1.0 | Classification: Confidential
Stored at: Google Drive/Legal/Policies/IP/· Wiki.js Legal > Policies > IP
This policy applies to all entities under PrivateAI LLC and REMAP.ai, including all
employees, contractors, and clients engaged in AI services. It applies from the moment
a party receives or generates any REMAP.ai or PrivateAI information, regardless of
whether a formal contract has been executed.
Entities covered:
Persons covered:
All pre-existing IP including AI methodologies, frameworks, software tools, platforms,
and general business knowledge developed independently or prior to client engagements.
| Entity | IP assets owned |
|---|---|
| REMAP.ai | AI Adoption Pathway (Roadmap) Methodology · engagement frameworks · discovery templates · workshop facilitation materials · speaking decks · training curricula · educational content · brand, name, visual identity, and website content |
| PrivateAI LLC | Reusable code libraries · prompt libraries · agent configuration templates · internal tooling (project management scripts, QA frameworks) · general-purpose AI pipeline architectures built outside client projects · all work product created by contractors during any engagement (work-for-hire) |
Usage rule: REMAP.ai IP may be reused across multiple clients. PrivateAI
pre-engagement IP is licensed (not transferred) to clients.
All deliverables, models, code, documentation, and configurations created specifically
for the client and paid for under contract. Client data remains client property.
Client-owned assets (upon full payment):
Conditions:
| Type | Terms |
|---|---|
| Background IP licence to clients | Non-exclusive, non-transferable, perpetual licence to use PrivateAI pre-existing IP solely within the deliverable context. Client may not sublicence, resell, or use such IP to build competing products. |
| Open-source components | Disclosed in project documentation. Client must comply with applicable OSS licences (MIT, Apache 2.0, etc.) |
| Jointly developed IP (rare) | Where agreed in writing in the SOF, joint IP is owned equally. Neither party may sublicence without the other's consent. |
Nothing. Contractors retain no ownership of work product developed during
engagements. All deliverables are owned by PrivateAI LLC under work-for-hire provisions.
Contractor IP obligations (enforced via OPS-L01b):
Exceptions: None by default. Any variation requires Legal Lead + CEO written
approval.
Transfer trigger: Receipt of full payment for all fees in the applicable SOF.
Transfer mechanism: Transfer is automatic upon payment confirmation — no separate
assignment deed required unless requested. The SOF and MSA together constitute the
written record of transfer.
| Transfers to client | Does NOT transfer to client |
|---|---|
| Client-specific deliverables as defined in SOF scope | PrivateAI background IP and pre-existing tools |
| Custom models trained on client data | General methodologies, frameworks, or reusable components |
| Bespoke documentation and handover materials | Learnings or aggregated insights from the engagement |
Partial payment rule: No IP transfers until full payment. Partial delivery does
not create partial IP transfer.
Pre-existing PrivateAI IP incorporated into client deliverables remains protected.
Clients receive a non-exclusive, perpetual licence to use such IP solely within the
deliverable for internal business purposes only.
Protected background IP includes:
Protection mechanisms:
Reverse engineering: Clients are contractually prohibited from reverse-engineering
or extracting background IP from deliverables.
Confidentiality period: 5 years from the end of the engagement or expiry of the
relevant agreement, whichever is later.
What is confidential:
Obligations — all parties:
| Obligation | Detail |
|---|---|
| Do not disclose | No third-party disclosure without prior written consent |
| Use only for engagement | Confidential information used only for the purpose of the engagement |
| Standard of care | Apply at least the same care as used for own confidential information (minimum: reasonable care) |
| Notify on breach | Notify Legal Lead immediately upon becoming aware of any actual or suspected breach |
Exclusions: Information that is publicly available, independently developed, or
received lawfully from a third party without restriction.
NDAs are required before accessing sensitive client or PrivateAI information. Use only
templates from INF-03-DOC-03 (NDA Template Library) — no ad-hoc NDAs.
| When required | Template |
|---|---|
| Before any discovery/scoping call where client shares sensitive information | Template A — Mutual |
| Before client provides data, systems access, or proprietary project details | Template B — Client to PrivateAI |
| Before any contractor begins work | Template C — Contractor to PrivateAI (via OPS-H01c) |
| Before partner or referral discussions involving commercial terms or client data | Template D — Mutual Partner |
Process:
/Legal/NDAs/Processing environments:
Retention:
| Scenario | Retention rule |
|---|---|
| Standard engagement | Client data retained for duration of engagement plus any post-engagement support period defined in the SOF |
| Default limit | 90 days post-engagement end, then secure deletion |
| Extended retention (e.g. model maintenance) | Must be agreed in writing in the SOF |
GDPR / data law: Clients in regulated jurisdictions are directed to the applicable
Data Processing Agreement (DPA) in OPS-L01a.
What can be captured internally (permitted):
What cannot be captured:
Process:
What constitutes a breach:
Reporting process:
Consequences:
| Party | Consequence |
|---|---|
| Employees | Formal disciplinary action up to and including termination |
| Contractors | Immediate termination of engagement; clawback of fees where applicable |
| Clients | Engagement suspension; legal remedies as per MSA |
| All parties | Potential civil liability for damages |
| Doc ID | Name | Location |
|---|---|---|
| INF-03-DOC-01 | IP & Confidentiality Policy (this document) | Google Drive /Legal/Policies/IP/ · Wiki.js |
| INF-03-DOC-02 | IP Asset Register + NDA Register | Google Drive /Legal/ |
| INF-03-DOC-03 | NDA Template Library (Templates A–D) | Google Drive /Legal/NDAs/ |
| OPS-L01a | Client MSA and SOF | Google Drive /Legal/ |
| OPS-L01b-DOC-01 | Employment & Contractor Template Library | Google Drive /Legal/Templates/EmploymentContracts/ |
| Direction | Workflow | What flows |
|---|---|---|
| Upstream | OPS-L01a — Client Agreements | MSA and SOF define IP transfer and licence terms referenced by this policy |
| Downstream | OPS-L01b — Employment & Engagement Contracts | IP assignment clause content sourced from this policy for all templates |
| Downstream | OPS-H01a — Internal Hiring | IP assignment clause enforced via employment agreement |
| Downstream | OPS-H01c — Contractor Hiring | IP assignment + NDA (Template C) signed at contractor onboarding |
| Downstream | DEL-07 — Knowledge Management | Knowledge capture rules governed by this policy |
| Downstream | INF-02 — Security Incident & Breach Response | IP/confidentiality breach reported here and logged in INF-02-DOC-02 |
| Role | Name | Date |
|---|---|---|
| CEO | Andrew Herbert | Pending signature |
| Legal Lead | TBD | Pending signature |
Review gate: Annual review due 2027-04-20. Legal Lead coordinates with external
counsel in AU and US. Any material changes require Andrew's written approval before
the updated policy is published.
| Version | Date | Description | Author |
|---|---|---|---|
| 1.0 | 2026-04-20 | Initial policy — IP ownership framework (REMAP.ai, PrivateAI, client, contractor), deliverable transfer rules, confidentiality obligations (5-year period), NDA requirements (4 templates), data handling (90-day default retention), knowledge capture rules, breach reporting and consequences. | Habiba Shahbaz + Andrew Herbert |