Privacy Policy
DRAFT — PENDING LEGAL REVIEW. This is an engineering-stage draft to fix broken links and give counsel a concrete starting point. It is not legal advice and has not been reviewed by a licensed attorney or privacy professional. Bracketed items [like this] require your input or counsel's confirmation — especially the sub-processor data-handling terms, which should be verified against each vendor's actual agreement before publishing.
Effective date: [DATE] Last updated: [DATE]
This Privacy Policy explains how [LegalNerds entity] ("LegalNerds," "we," "us") collects, uses, and shares information when you use our Service. By using the Service, you agree to this Policy.
1. Information We Collect
- Account information. Name, email, and authentication details when you create an account.
- Matter and intake information. The information you provide about your legal matter — including facts, dates, parties, documents, and free-text descriptions. This may include sensitive personal information. You control what you submit; please avoid submitting more sensitive information than necessary.
- Payment information. Processed by our payment processor, Stripe. We do not store full payment card numbers; Stripe handles card data subject to its own terms.
- Usage and device information. Log data, device and browser information, and how you interact with the Service.
- Communications. Messages you send us and emails we exchange.
2. How We Use Your Information
We use information to:
- provide, operate, and improve the Service;
- generate AI-assisted guidance and documents in response to your inputs;
- process payments, send transactional and account emails, and provide support;
- monitor performance, debug errors, and maintain security;
- comply with legal obligations.
3. AI Processing and Service Providers (Sub-Processors)
To operate the Service, we share information with the third-party providers below. Importantly, the matter information you submit is transmitted to third-party AI providers for processing so the Service can generate guidance and documents.
| Provider | Purpose | Data involved |
|---|---|---|
| Anthropic | AI processing (guidance/document generation, verification) | Your inputs and matter content |
| xAI (Grok) | AI processing (independent review/verification) | Your inputs and matter content |
| Supabase | Database and application hosting | Account and matter data |
| Vercel | Application hosting/delivery | Usage and request data |
| Stripe | Payment processing | Payment and billing data |
| Resend | Transactional email delivery | Email address, message content |
| Sentry | Error monitoring | Diagnostic/log data (may incidentally include limited content) |
[Counsel/founder: confirm each provider's data-handling terms before publishing — in particular whether the AI providers' API terms include zero-retention and no-model-training commitments for your account, and reflect that accurately here. Do not overstate protections you have not contractually secured.]
We require our providers to handle information consistent with their roles, and we do not authorize them to use your matter content for their own unrelated purposes. [Confirm against actual DPAs.]
4. How We Share Information
We do not sell your personal information. We share it only: with the service providers above; to comply with law or valid legal process; to protect rights, safety, and the integrity of the Service; or in connection with a business transfer (e.g., merger or acquisition), with notice as required.
5. Data Retention
We retain information for as long as your account is active and as needed to provide the Service, comply with legal obligations, resolve disputes, and enforce our agreements. You may request deletion as described below. [Confirm specific retention periods.]
6. Security
We use technical and organizational measures intended to protect your information, including access controls and encryption in transit. No system is perfectly secure, and we cannot guarantee absolute security. [Align claims with actual measures — e.g., Supabase row-level security, encryption at rest — and avoid overstatement.]
Where we must collect a highly sensitive identifier to perform a service you request — for example, a Social Security Number or ITIN to obtain your business's EIN as part of a formation filing — we store it encrypted at rest, display only its last four digits to our team, and decrypt the full number only at the moment it is needed to complete your filing, with each such access recorded.
7. Your Rights and Choices
Depending on your location, you may have rights to access, correct, delete, or port your personal information, and to object to or restrict certain processing.
- California residents (CCPA/CPRA). You have the right to know what personal information we collect, to request deletion or correction, and to opt out of any "sale" or "sharing" of personal information (we do not sell or share personal information as those terms are defined). We will not discriminate against you for exercising these rights. [Counsel: confirm CCPA/CPRA applicability thresholds and required disclosures; add other state-law rights as applicable.]
- How to exercise. Contact us at [privacy@legalnerds.com]. We will verify your request as required by law.
8. Cookies and Tracking
We use cookies for authentication and your preferences. For analytics, we run our own first-party measurement: we do not embed Google Analytics or any third-party tracker, we do not store your IP address, and unique-visitor counts use an anonymous, daily-rotating hash rather than a persistent tracking identifier. Analytics runs on our public marketing pages only, not inside your dashboard. You can control cookies through your browser settings. [Counsel: confirm whether a cookie banner/consent mechanism is required for your audience given this first-party, no-third-party-tracker posture.]
9. Children's Privacy
The Service is not directed to anyone under 18, and we do not knowingly collect information from children. If you believe a child has provided us information, contact us and we will delete it.
10. Other Important Notices
- No confidentiality/privilege. Because LegalNerds is not a law firm and no attorney-client relationship is formed, information you submit is not protected by attorney-client privilege. Be mindful of what you share. [Counsel: confirm framing.]
- U.S.-based service. The Service is operated in the United States; if you access it from elsewhere, you consent to processing in the U.S.
11. Changes to This Policy
We may update this Policy; material changes will be communicated through the Service or by email, and the "Last updated" date will reflect the change.
12. Contact
[privacy@legalnerds.com / mailing address].