Privacy Notice
1. Scope and roles
This draft describes information handled through the LawFirmAxis pilot service. For account administration, security, support and service operations, the provider may act as a business or controller. For information a law firm places in its workspace, the firm generally determines the purpose of processing and the provider acts on the firm’s documented instructions. Qualified counsel must confirm these roles for every target jurisdiction.
2. Information handled
- Firm and account information, including names, work contact details, roles, permissions, authentication and MFA records.
- Pilot workspace records such as clients, matters, intake, notes, tasks, calendars, documents, imported email, time, billing and data-lifecycle requests.
- Security and technical information such as sessions, IP address, user agent, audit events, request logs and malware-scan results.
- Support communications, feedback and administrative correspondence.
- AI inputs, source records, suggestions and review decisions when AI features are used.
3. Purposes
Information is used to authenticate users, operate firm-specific workspaces, provide requested features, secure and audit the service, prevent abuse and malware, respond to support and data requests, maintain backups and disaster recovery, and improve the pilot using non-confidential feedback. Legal bases and any consent requirements must be completed by qualified counsel.
4. AI processing
AI features assist with summaries, classifications, matches and possible dates. Output requires human review. The final notice and data-processing agreement must identify each AI provider, the information sent, provider retention and training terms, processing locations and available controls before real firm data is approved.
5. Service providers and hosting
The current infrastructure uses Render for application and PostgreSQL hosting, Amazon Web Services S3 for encrypted document storage and malware-scanning support, Google Workspace for business email, and an SMTP email-delivery service configured by the provider. A lawyer-approved subprocessor list must confirm exact entities, regions, transfer mechanisms and contract terms before launch.
6. Security
Controls include tenant-scoped access, individual accounts, MFA support, revocable sessions, encrypted HTTPS transport, private database networking, blocked public S3 access, S3 server-side encryption and versioning, malware scanning, audit records, logical database exports and tested database and object recovery. No system is completely secure.
7. Retention and deletion
Firm administrators may request export or deletion through Account & Plan → Data lifecycle or by contacting support@lawfirmaxis.com. The final notice must state approved retention periods for active records, support records, audit/security logs, database backups and noncurrent S3 object versions. The S3 lifecycle schedule remains pending legal approval.
8. Rights and choices
Depending on location and applicable law, individuals may have rights to access, correct, delete, restrict or object to processing, receive portable data, withdraw consent or complain to a regulator. Requests involving law-firm workspace data should normally be directed to the relevant firm. The final notice must provide verified request procedures, identity checks, response periods and appeal/complaint rights.
9. Cookies and local storage
The application uses browser storage and authentication/session mechanisms needed to keep users signed in and operate security controls. No advertising use is approved for the pilot. Any analytics or optional cookies must be inventoried and disclosed before activation.
10. Children and changes
The service is intended for law-firm personnel and not for children. Material changes to the final notice must be dated, published at a stable HTTPS URL and communicated as required. Customer acceptance must be recorded when applicable.
11. Contact
Until a dedicated, lawyer-approved privacy contact and postal address are published, pilot questions may be sent to support@lawfirmaxis.com. This draft must not be treated as the final legally required notice.