Privacy Policy

1. Overview

LawOffice.AI (“LawOffice.AI”, “we”, “our”, or “us”) provides a case-management platform for law offices, a Microsoft Word add-in, a Microsoft Outlook add-in, a Gmail add-on (the “LawOffice.AI Gmail add-on”), a client-communication platform, optional integrations with services such as Google Workspace, Microsoft 365, and Zoom, an MCP connector and API that let a member connect an outside AI assistant, and related services (the “Service”).

This Privacy Policy explains what information we collect, how we use it, who we share it with, how long we keep it, and the choices you have. It applies to our website, our add-ins and add-ons, and our APIs and backend services.

By using the Service, you agree to this Privacy Policy.

2. HIPAA Compliance

We maintain administrative, physical, and technical safeguards designed to support compliance with the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”). These apply where HIPAA covers our role as a service provider.

If you are a Covered Entity or Business Associate under HIPAA, you decide whether and how to use the Service with Protected Health Information (“PHI”). If your use involves PHI, we can provide (or may require) a Business Associate Agreement (“BAA”). Contact us at support@lawoffice.ai.

3. Information We Collect

3.1 Account Information

• Name
• Email address
• Organization name (if applicable)
• Billing and subscription details. Payment card numbers are collected and processed by our payment processor, Confido Legal, not by us.

3.2 Document Content

When you use the Microsoft Word add-in, you may choose to send document content to our servers so we can perform the action you requested. This may include:

• Full document text
• Selected text
• Document structure or metadata needed to complete your request

Documents may contain sensitive information, such as legal matter details, financial information, or medical information. We do not access your documents unless you start an action in the add-in that requires processing.

3.3 Email Content (Outlook Add-in and Gmail Add-on)

The Outlook add-in and the Gmail add-on let a law office member file an email into a case or contact record in LawOffice.AI. Email content is collected only when you open an email and click Save to Case, Save to Contact, or Save & Add Case Note. For that one email we receive:

• Subject, sender, recipients (To and Cc), date, and the email's Message-ID
• The message body
• Attachments, which are stored as files in the case or contact you chose

When you first open an email, the add-on reads the subject line and the sender's address to suggest a matching case (by file number) or contact (by email address). Nothing is stored from that lookup unless you click Save.

While you are writing an email, the Drafting Assistant can insert case or contact details from LawOffice.AI into your draft, add recipients, or add text to the subject line. This only writes to the draft you are editing. We do not read, send, or store your drafts, and we do not read any other message in your mailbox.

3.4 Client Contact and Case Information

If your law office uses our platform, we may store the information the law office enters about its clients. This may include names, contact details, mobile phone numbers, appointment dates, case status notes, and documents sent for review or signature.

3.5 USCIS Receipt Numbers

For immigration matters, a law office may enter the USCIS receipt numbers of its filings so the Service can track their status. A receipt number identifies a specific immigration case and the person it concerns. USCIS considers receipt numbers to be Personally Identifiable Information (PII), and we treat them as PII under this policy.

How receipt numbers are used.

• We send each tracked receipt number to the USCIS Case Status API, about once a day, to ask for the current status of that case. That is the only thing we use them for.
• We store the answer USCIS gives: the form type, the status text, the dates USCIS reports, and the history of earlier statuses. This lets the law office see the status in the case file and know when it changes.
• We never use receipt numbers for advertising, analytics, or any purpose other than the status check the law office asked for.

How receipt numbers are stored and protected.

• Receipt numbers and their statuses are stored in our database on Google Cloud Platform, encrypted at rest, with the safeguards described in Section 5.
• They are sent to USCIS only over an encrypted HTTPS connection, authenticated with credentials issued to LawOffice.AI by USCIS. Those credentials are stored as protected server secrets, never in source code or in the browser.
• Only members of the law office that entered a receipt number, with permission to view that case, can see it or its status. Our staff do not access receipt numbers except to fix a problem the law office reports or as required by law.
• Receipt numbers are not shared with any third party other than USCIS itself, and are not included in any de-identified or aggregated data.
• A receipt number may appear in our server logs when a status check fails. Logs are kept for 12 months, then deleted (see Section 10).
• Receipt numbers are kept with the case file until the law office removes them, deletes the case, or closes its account, and are then deleted on the schedule in Section 10.

3.6 Usage and Device Information

We collect information about how you use the Service for security, troubleshooting, and improvement. This includes feature usage, timestamps, approximate location derived from your IP address, browser and device type, and error logs.

3.7 Information We Do Not Collect

We do not collect precise GPS location, your device contacts, genetic information, or biometric data. We do not read your mailbox or calendar contents beyond the scopes described in Section 7.

4. How Document Data Is Transmitted and Processed

When you use a feature of the add-in that requires processing:

1. Document content is sent securely over HTTPS (TLS 1.2 or higher).
2. Content is processed on our backend systems to provide the requested feature.
3. Content may be stored for the period described in Section 10 (“Data Retention”).

We process document content only to provide the feature you requested.

5. Storage, Hosting, and Security

We store and host Service data, including document content, on Google Cloud Platform (“GCP”), including Google Cloud Storage.

Our security controls include:

• Encryption in transit: HTTPS/TLS (TLS 1.2+)
• Encryption at rest: Google Cloud Storage encryption at rest
• Private storage: Access-restricted storage (no public buckets)
• Access controls: Identity and Access Management (IAM) and least-privilege access
• Operational safeguards: Monitoring, logging, and security review practices

We do not make stored documents publicly available.

6. AI Processing, HIPAA BAA, and Zero Data Retention

Some features of the Service use artificial intelligence (“AI”) to generate output you request. When you use an AI feature and submit document content:

• Named AI providers: We send content to OpenAI and Anthropic to generate the output. We do not use any other AI provider without updating this policy first.
• HIPAA-compliant AI processing: We use provider configurations intended to support HIPAA compliance where applicable.
• Business Associate Agreement (BAA): We maintain a BAA with our AI providers for HIPAA-regulated processing, where applicable.
• No training on your data: We do not permit AI providers to train models on Customer Content, including PHI, submitted through the Service.
• Zero data retention for AI: AI providers do not keep content after the request is complete. Limited transient processing is required to deliver the output.

If you do not want document content processed by AI, do not use AI-enabled features.

The commitments in this section cover AI processing LawOffice.AI performs for you. They do not cover an outside assistant a member connects through the MCP connector or an API key; see Section 11.2.

Exclusion for Google user data: Data received from Google Workspace APIs is never sent to an AI provider. It is never used to create, train, or improve any AI or machine learning model. See Section 7.

7. Google Workspace APIs and Limited Use

If you choose to connect your Google Account, we request access through Google’s OAuth consent screen. We only receive the data covered by the scopes you approve. You may revoke access at any time at myaccount.google.com/permissions.

The use of raw or derived user data received from Workspace APIs will adhere to the Google User Data Policy, including the Limited Use requirements. LawOffice.AI does not transfer Google user data to any third-party AI/ML service. No Google user data is used to create, train, or improve any machine learning or artificial intelligence models.

7.1 Scopes We Request and Why

We request only the narrowest scopes needed for the features you choose to use:

• openid, email: to identify the Google Account you connected and display the connected address.
• gmail.send: to send email on your behalf when you send a message from within the Service. We do not use it to read, search, or browse your mailbox.
• calendar.events: to create and manage the calendar events you schedule through the Service, including Google Meet links.
• calendar.calendars.readonly: to read your calendar settings and check whether your account can create Meet links. We do not read your event contents.

Access is incremental. Each feature requests only its own scope. You may decline individual scopes at the consent screen.

7.1.1 LawOffice.AI Gmail Add-on Scopes

The Gmail add-on is a separate Google Workspace Add-on that runs inside Gmail. It requests its own, narrower set of scopes when you install it. It never requests access to your whole mailbox.

• gmail.addons.execute: lets the add-on run inside Gmail and show its panel next to an email or a draft.
• gmail.addons.current.message.readonly: lets the add-on read only the email you currently have open, and only while the add-on panel is open. We use it to suggest a matching case or contact and, when you click Save, to copy that one email and its attachments into the case or contact you selected (see Section 3.3).
• gmail.addons.current.message.metadata: lets the add-on read the subject line of the draft you are writing so the Drafting Assistant can add a file number or matter name to it instead of replacing it.
• gmail.addons.current.action.compose: lets the add-on write into the draft you are editing when you tap a button: insert text into the body, add to the subject, or add an address to To, Cc, or Bcc. Nothing is written unless you tap a button.
• script.external_request: lets the add-on send the email you chose to save, and your search requests, to LawOffice.AI's own servers over HTTPS. Data goes only to LawOffice.AI and to our Google Cloud Storage bucket. It is never sent anywhere else.
• script.storage: lets the add-on remember your LawOffice.AI sign-in session and your recent case and contact searches between visits, stored in Google's per-user add-on storage. We do not store your Google password.

You sign in to the add-on with your LawOffice.AI account, not your Google password. You can sign out of the add-on at any time from its menu, and you can remove the add-on's Google access at myaccount.google.com/permissions. Removing access does not delete emails you already saved to a case; those are part of the law office's case file and are deleted as described in Section 10.

7.2 Limited Use Commitments

For data received from Google Workspace APIs:

• Limited use: We use Google user data only to provide and improve the user-facing features you request.
• No advertising: We do not use Google user data for advertising.
• No sale or transfer: We do not sell Google user data. We do not transfer it to others except to provide or improve the Service, to comply with law, or as part of a merger or sale of assets with notice to you.
• No AI/ML training: Google user data is never sent to any AI or machine learning service. It is never used to create, train, fine-tune, evaluate, or improve any AI model.
• No human reading: We do not allow humans to read Google user data unless one of these applies: you gave us permission for specific items, it is needed for security, the law requires it, or the data has been aggregated and anonymized.

Google user data is protected using the safeguards in Section 5. It is deleted on request or when you disconnect your Google Account, as described in Section 10.

8. Mobile Information and Text Messaging

LawOffice.AI collects your mobile phone number and your consent to receive text messages. We use them to send appointment reminders, case status updates, and document requests about your legal matter with the law office that uses our platform.

No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. All other categories of data are subject to this Privacy Policy. Mobile information may be shared with our messaging provider, Twilio, and with telecommunications carriers only to deliver those messages. Those parties are contractually prohibited from using your information for their own purposes.

You may withdraw consent at any time by replying STOP to any message, by calling (602) 428-4281, or by emailing support@lawoffice.ai. See our Text Messaging Terms & Conditions.

9. How We Use Information

We use information to:

• Provide, operate, and maintain the Service
• Process document content as requested by you
• Authenticate users and manage accounts
• Provide customer support
• Prevent fraud, abuse, and security incidents
• Improve reliability and performance
• Comply with legal obligations

We do not use document content or client information for advertising.

9.1 De-identified and Anonymized Data

We may create aggregated or anonymized statistics about Service usage, such as the number of documents processed per month. This data cannot identify you. We use it only for internal operations and reliability. We do not share de-identified, anonymized, or pseudonymized data derived from your information with any third party.

10. Data Retention and Deletion

10.1 How Long We Keep Data

• Document content: Kept until you delete it or close your account, unless a longer period is required by law.
• Account and client information: Kept while your account is active and for 30 days after closure.
• Usage logs and error logs: Kept for 12 months, then deleted.
• Google user data: Kept only as long as needed to provide the feature you requested. Deleted within 30 days after you disconnect your Google Account.
• Emails saved through the Gmail add-on or Outlook add-in: Once you click Save, the email becomes part of the law office's case or contact file. It is kept until the law office deletes it or closes its account, like any other document in the case file.
• USCIS receipt numbers and statuses: Kept with the case file until the law office removes the receipt, deletes the case, or closes its account, then deleted within 30 days. Status checks stop as soon as a receipt is removed or a case is closed.
• AI processing: Not retained by AI providers after the request completes. See Section 6.

10.2 Dormant Accounts

If your account has no activity for 24 months, we will email you at the address on file. If you do not sign in within 60 days of that notice, we will close the account and permanently delete its data as described in Section 10.3.

10.3 How to Permanently Delete Your Data

You can request permanent deletion of your data at any time in either of these ways:

• Email support@lawoffice.ai with the subject line “Delete my data” from the email address on your account.
• Call (602) 428-4281 and ask us to delete your data.

We will confirm your request within 2 business days. We will permanently delete your data from our active systems within 30 days of your request. Encrypted backups are overwritten within 90 days. We may keep limited records where the law requires it, such as billing records.

If your data is held on behalf of a law office, we may also need to notify that law office. The law office may have its own legal duty to keep certain case records.

10.4 Health Information

If your data includes health information, you may ask us at any time to do one of the following. We will complete your choice within 30 days.

• Securely dispose of the health information.
• Securely transmit it to a provider or person you designate.
• Provide you a secure download of it in a common format.

11. Sharing and Disclosure

11.1 We Do Not Sell Your Data

We do not sell your personal information, document content, or client information. We do not sell it for profit, and we do not exchange it for money or anything else of value. We do not share it with marketers, advertisers, or data brokers.

11.2 Who We Share Data With

We share data only with the following entities, and only for the stated purpose:

• Google Cloud Platform (Google LLC): Hosts and stores Service data. Uses it only to provide hosting.
• OpenAI and Anthropic: Process content you submit to AI features and return the output. They do not retain or train on your content. See Section 6.
• Google Workspace, Microsoft 365, and Zoom: If you connect these accounts, we exchange the data needed to send email, schedule meetings, or create meeting links on your behalf. Each provider uses that data under its own privacy policy for your account.
• AI assistants you connect (MCP connector): A member may connect an outside AI assistant, such as Anthropic's Claude or OpenAI's ChatGPT, to LawOffice.AI through our MCP connector or an API key. When they do, the assistant can read the case, contact, task, calendar, time, invoice and intake records that member can see, and create such records if the member allowed it. The data the assistant requests is sent to the assistant's provider under the member's or firm's agreement with that provider, not under our agreements described in Section 6; the provider's own privacy policy and data-retention terms apply to it. We log every request made through a connection, show the connections on the member's Integrations page, and end a connection the moment the member or an administrator revokes it. We do not send Google Workspace API data through this connector.
• Resend: Delivers transactional email we send, such as account notices. Uses the recipient address and message only for delivery.
• Twilio and telecommunications carriers: Twilio delivers the text messages described in Section 8 through mobile carriers. Twilio receives the mobile number, the message text, and any attached images or files. Replies you send by text also pass through Twilio. They use this data only for delivery.
• Confido Legal: Processes invoice, trust, and subscription payments. Receives the client's name and email address, the matter name, the invoice amount, and any memo or description text the law office enters. Payment card numbers are entered directly on Confido Legal's secure payment form and never pass through our servers. Confido Legal uses this data only to process payments and prevent fraud.
• U.S. Citizenship and Immigration Services (USCIS): Receives the receipt numbers a law office chooses to track, through the USCIS Case Status API, and returns the status of each case. We send nothing else to USCIS. USCIS handles the request under its own privacy policies. See Section 3.5.
• Your law office: If you are a client of a law office that uses our platform, that office can see the information it entered about you and your responses.
• Legal requirements: We may disclose information if required by law, regulation, legal process, or a governmental request.

11.3 Rules for Third Parties

Every third party listed above is bound by written contract to the terms of this Privacy Policy, including its confidentiality and security requirements. Third parties may not use or disclose your information, including de-identified, anonymized, or pseudonymized data, for any reason other than providing their service to us. Any other use or disclosure is prohibited unless you give active, affirmative consent first.

Google user data: Data from Google Workspace APIs is never shared with AI providers. It is handled only as permitted by the Limited Use requirements in Section 7.

12. Your Data-Sharing Choices

You control most sharing described in this policy:

• AI features: Optional. If you do not use them, no content goes to AI providers.
• Google, Microsoft, and Zoom integrations: Optional. You can connect or disconnect them at any time.
• AI assistants you connect: Optional. A member connects an assistant by signing in from it and can disconnect it at any time under My Account › Integrations; an administrator can revoke API keys.
• Text messages: Optional. Reply STOP at any time to end them.

Benefits of sharing: AI features can draft and review documents faster. Integrations let you send email and schedule meetings without leaving the Service. Text messages keep you informed about your matter.

Risks and limitations: Any data sent to a third party leaves our systems. We require strong contracts and security, but no system is perfectly secure. Text messages travel over carrier networks and are not encrypted end to end. AI output can be inaccurate and must be reviewed by a person.

Impact on others: Documents and messages often contain information about other people, such as family members, clients, or opposing parties. Family history, medical history, or genetic information about relatives also describes those relatives. Before you share such information, consider whether you have the right to do so and how it could affect them.

13. Data Breach Notification

If we discover a data breach that affects your personal information, we will notify you by email without undue delay and no later than 72 hours after we confirm the breach. The notice will describe what happened, what information was involved, what we are doing about it, and what steps you can take, such as changing passwords or watching for suspicious activity. We will also notify any regulators the law requires.

14. Closing Your Account

You can close your account at any time in either of these ways:

• Email support@lawoffice.ai with the subject line “Close my account” from the email address on your account.
• Call (602) 428-4281 and ask us to close your account.

We will close the account within 2 business days. Your data is then permanently deleted on the schedule in Section 10.3. If you are a client of a law office, you may also ask that office to remove you from the platform.

15. Change of Ownership or End of Business

If LawOffice.AI is acquired, merged, or sells its assets, or if we end our business, your information may be transferred to the new owner. In that case:

• We will notify you by email at least 30 days before the transfer takes effect.
• The new owner must agree to follow privacy practices that align with this Privacy Policy.
• Before the transfer, you may choose to securely download your data, have it securely transmitted to a provider you designate, or have it permanently deleted. Use the methods in Section 10.3 or 10.4.
• If we end our business, we will permanently delete all remaining data within 90 days.

16. Your Rights and Choices

Depending on where you live, you may have rights over your personal information. These include the right to access it, correct it, delete it, restrict its use, or object to processing. To exercise these rights, contact support@lawoffice.ai. We will respond within 30 days. We will not treat you differently for exercising your rights.

17. California Privacy Rights (CCPA)

If you are a California resident, the California Consumer Privacy Act (“CCPA”) may give you extra rights, to the extent it applies to us. You have the right to:

• Know what personal information we collect, use, and share (see Sections 3, 9, and 11).
• Request deletion of your personal information (see Section 10.3).
• Request correction of inaccurate personal information.
• Opt out of the sale or sharing of personal information. We do not sell or share personal information as those terms are defined by the CCPA, so there is nothing to opt out of.
• Not be discriminated against for exercising these rights.

To make a request, email support@lawoffice.ai or call (602) 428-4281. We will verify your identity using the email address on your account. You may use an authorized agent to make a request on your behalf.

18. Cookies and Analytics

We use cookies and similar technologies to operate our website, remember preferences, and understand usage. You can control cookies through your browser settings.

19. International Transfers

Your information is processed in the United States. Our service providers may also process it in other countries where they operate. By using the Service, you understand that information may be transferred to these locations.

20. Children’s Privacy

The Service is not intended for individuals under 18. We do not knowingly collect personal information from children.

21. Changes to This Policy

We may update this Privacy Policy from time to time. We will not apply a material change to you until you have actively consented to it. Here is how that works:

• We will email you at least 14 days before the change takes effect. The email will include a plain-language summary of what changed and why.
• The next time you sign in, we will show the summary and the full updated policy. You must click “I agree” to continue using the Service.
• If you do not agree, you can keep using the Service under the old policy until the effective date, and you can close your account or export your data before then.
• We will post the updated policy on this page, update the “Last Updated” date, and keep a summary of changes available on request.

Minor changes that do not affect your rights, such as fixing typos or updating contact details, do not require consent. We will still post them here.

22. Contact Us

LawOffice.AI
10105 E Via Linda Ste 103-1816
Scottsdale, AZ 85258
Email: support@lawoffice.ai
Phone: (602) 428-4281