Privacy Policy

Draft — pending attorney review. This outline shows the topics this policy will cover. It is not yet a final policy.

1. Scope

• Covers information about firm users (owners, partners, staff) and visitors to the website.
• Information that firms enter about their clients is governed by the Data Processing Agreement; the firm decides what is collected and why.

2. Information we collect

• Account details: name, email, role, firm.
• Billing details: handled by Stripe; we receive plan, seat count, and payment status, not full card numbers.
• Usage and security logs: sign-ins, actions recorded in the audit log, device and browser information.

3. How we use it

• To provide and secure the service, send account and billing emails, and support you.
• We do not sell personal information. [Counsel: complete list of purposes and legal bases.]

4. Service providers

[Counsel: subprocessors and their roles — hosting (Vercel), database and authentication (Supabase), payments (Stripe), email (Resend).]

5. AI providers

None. AI features are off, and no client or firm data is sent to any AI provider until a firm's data agreement is in place.

6. Security

• Each firm's data is isolated in the database (row-level security). Access is role-based, and changes are recorded in an audit log.
• Two-factor sign-in (an authenticator app) is required for every user, with single-use recovery codes.
• [Counsel and security: incident response and breach notification.]

7. Retention

[Counsel: retention schedule, aligned with the Terms (read-only period, closing, scheduled purge).]

7a. Product demo

• The demo at our demo address is a separate copy of the app with fictional firms and clients only. It sends no email to anyone and takes no payments.
• If you give us your name, work email, firm name and firm size to start a demo, we use them only to follow up with you about the product.
• We keep those details for 12 months after you start the demo, then delete them automatically. We also record which demo steps you tried, so we know what to follow up on.
• Your progress through the demo's "Try these" steps is recorded with your details and is deleted with them, 12 months after you start the demo.
• Your demo copy (including anything you type or upload in it) is deleted automatically 7 days after you last use it, or 14 days after you start it, whichever comes first. Please don't upload real client documents to the demo.
• To have your details deleted sooner, contact us. [Counsel: confirm wording and contact method.]

8. Your choices and rights

[Counsel: access, correction, deletion, and state-specific rights.]

9. Children

The service is for professional use and is not directed to children.

10. Changes and contact

[To be completed by counsel.]