Data Policy

1. Data We Collect and Process

Case Data

All information you input into case files, including party names, factual descriptions, legal arguments, evidence descriptions, and generated documents. This data is classified as confidential and is stored with AES-256 encryption at rest.

User Account Data

Name, email address, billing information (payment tokens, not raw card data), subscription status, and account preferences.

Uploaded Evidence

Documents, images, and files you upload to the Evidence Vault are encrypted with AES-256 at rest and stored in secure, access-controlled storage. Evidence files are not accessible to Company personnel except upon your explicit technical support request.

Generated Documents

Documents generated through the Platform are stored in your account and encrypted. You retain full ownership of generated documents.

2. Data Classification

• Confidential: Case data, evidence, generated documents, attorney communications — AES-256 encrypted, access-controlled
• Personal: Name, email, billing info — encrypted, limited retention
• Operational: Anonymized usage logs, error reports — retained for system improvement

3. Data Location

All user data is stored in the United States. We do not transfer personal or case data to servers outside the United States without explicit user consent and appropriate data transfer agreements.

4. Data Access Controls

Access to production databases and storage systems is restricted to authorized engineering personnel only, is logged and audited, requires multi-factor authentication, and is subject to least-privilege access principles. No customer case data is accessible to sales, marketing, or other non-engineering personnel.

5. Third-Party Data Sharing

We do not sell data to third parties. Limited data sharing occurs with:

• Stripe — Payment processing (payment tokens only, not case data)
• Anthropic — AI processing for document generation (session-scoped, not retained for training)
• Infrastructure providers — Hosting and storage (encrypted, no access to content)

6. Legal Process and Law Enforcement

We will notify you of any legal process seeking access to your data (to the extent permitted by law) and will seek to narrow the scope of any such request. We will not provide access to case data without valid legal process.

7. Breach Notification

In the event of a data breach affecting your personal information, we will notify affected users within 72 hours of discovery and provide details of the nature of the breach, data affected, and remediation steps taken.

8. Data Portability and Deletion

You may export all your data (documents, case files, evidence) in standard formats at any time. Upon account deletion, personal data is purged within 30 days; anonymized operational logs may be retained per our Retention Policy.

9. Contact

Data inquiries: [email protected] or Contact Form.