Privacy Policy
Policy version: 2026-08-31
1. Information We Collect
We collect personal information you provide through the intake or review flow, including name, contact information, document details, notes, and preferences. When you submit a document for review, we collect the document content you upload or paste.
2. How We Use Your Information
Your information is used to prepare document summaries, issue flags, review packets, transaction records, and service communications. Documents you submit for review are processed by our AI service provider (Anthropic) to generate your report. We do not use your personal data to train AI models, and our agreement with Anthropic does not permit your documents to be used for model training.
3. Data Storage & Security
Your data is stored using United States Vercel and Supabase infrastructure with encryption in transit and at rest. Account-bound legal work requires an authenticated user, active tenant membership, and the exact purchased grant. Explicit share links are recipient-bound, limited, expiring, revocable, and never replace account ownership.
4. Information Sharing
We do not sell your personal information. We may share information with: (a) licensed attorneys you select for review services, (b) service providers who help us operate the platform — AI processing (Anthropic), payment processing (Stripe), and email delivery (Resend) — each only to the extent needed to provide the service, and (c) as required by law.
5. Data Retention
We use the following schedule. A legal hold, active dispute, fraud investigation, or legal requirement may pause deletion only for the affected records. When content is deleted, minimized financial and integrity records may remain for the periods below without retaining the legal document itself.
| Data class | Retention | Treatment |
|---|---|---|
| Account identity | Account lifetime; removal within 30 days after a verified deletion request | Profile/contact fields are deleted or de-identified unless a legal hold applies. |
| Matter content and work product | Matter lifetime, then up to 7 years after closure; earlier verified deletion requests are completed within 30 days | Source text, drafts, reviews, workspace content, and generated versions are deleted; immutable ledgers retain hashes and minimized facts. |
| Share and intake links | Link expiry or revocation, then up to 90 days of minimized security metadata | Tokens remain hashed; expired/revoked grants stop authorizing immediately. |
| Support and privacy requests | 2 years after resolution | Needed to document the request, response, complaint, refund, or correction. |
| Operational and AI telemetry | 90 days | Counts, model/provider status, latency, cost, and opaque trace IDs only—not prompts, document text, names, emails, or model output. |
| Authentication sessions | 30-day maximum session; revoked/expired session records age out after 30 additional days | Single-session enforcement, 7-day inactivity timeout, and immediate sign-out revocation apply. |
| Purchase, export, and security audit records | 7 years | Retained in minimized form for accounting, chargebacks, fraud prevention, and integrity evidence; legal content is not retained in an export receipt. |
6. Your Rights
Signed-in DraftCounsel users can download their account data and schedule or cancel account deletion from the account privacy center. You may also request access, correction, or deletion through support@draftcounsel.io. We verify the requester before disclosing or deleting account data and complete eligible deletion requests within 30 days.
7. Deletion, Holds & Backups
Account deletion is scheduled with a seven-day cancellation window. Legal holds, active payment disputes, and required firm-data transfers pause deletion without removing data. On completion, access is revoked, the authentication identity is irreversibly soft-deleted, and eligible legal content and identity fields are removed or de-identified. Backup copies are not used for ordinary product access and age out through the managed backup cycle; if a backup is restored, the deletion ledger is reapplied before customer access resumes.
8. Cookies
We use host-only essential cookies for authentication, session security, language, and accessibility preferences. We do not use advertising cookies. Authenticated sessions are time-boxed to 30 days, limited to one active session, and require sign-in again after 7 days of inactivity.
9. Contact
For privacy inquiries: support@draftcounsel.io
LegalDraft Technologies LLC
United States