Privacy Policy

1.1 Account Information

When you create an account, we collect:

• Full name
• Email address
• Password (stored as a salted hash — we never store plaintext passwords)
• Bar number and jurisdiction (if provided)
• Firm name and contact information

1.2 Practice Data

In the course of using the Service, you may enter data related to your legal practice, including but not limited to:

• Client names, contact information, and case details
• Matter information, deadlines, and calendar events
• Trust accounting records and financial transactions
• Time entries, billing records, and invoices
• Documents and file uploads
• Notes, communications, and work product

We refer to this collectively as “Practice Data.” You retain full ownership of all Practice Data.

1.3 Sensitive Financial Information

The Service may store sensitive financial information including Social Security numbers, bank account numbers, and tax identification numbers. This information is encrypted at rest using industry-standard encryption (AES-256 via Fernet) and is only decrypted when explicitly accessed by authorized users. All decryption events are logged in an audit trail.

1.4 Usage Data

We automatically collect certain technical information, including:

• IP address and approximate location
• Browser type and version
• Pages visited and features used
• Timestamps of access
• Error logs and performance data

1.5 Payment Information

Payment processing is handled by Stripe. We do not store credit card numbers or full payment details on our servers. We receive and store only a Stripe customer identifier, subscription status, and payment history metadata. Please review Stripe’s Privacy Policy for information about how they handle payment data.

2.1 Service Operation

We use your information to:

• Provide, maintain, and improve the Service
• Authenticate your identity and manage your account
• Calculate deadlines and generate compliance reports
• Process trust accounting transactions and reconciliations
• Generate invoices and track payments
• Send transactional emails (password resets, deadline alerts, billing notices)

2.2 What We Do NOT Do

• We do not sell your data. Ever. To anyone.
• We do not use your Practice Data to train AI models. Your case data, client information, and work product are never used for machine learning training.
• We do not share your Practice Data with third parties except as necessary to operate the Service (e.g., cloud infrastructure providers) or as required by law.
• We do not serve advertisements or share your data with advertisers.
• We do not access your Practice Data for any purpose other than providing the Service, unless you explicitly request support assistance or as required by law.

3.1 Encryption

• In transit: All data transmitted between your browser and our servers is encrypted using TLS 1.2 or higher.
• At rest: Sensitive financial data (SSNs, bank accounts, tax IDs) is encrypted at rest using AES-256 encryption with versioned keys.
• Database: Our database is hosted on encrypted storage with network-level access controls.

3.2 Access Controls

• Role-based access controls limit data access within your organization.
• All sensitive data access is logged with timestamps and user identifiers.
• Administrative access to production systems is restricted and audited.

3.3 Infrastructure

The Service is hosted on reputable cloud infrastructure providers (Fly.io for backend services, Vercel for frontend delivery) with SOC 2 Type II compliance. Our database is PostgreSQL with automated backups and point-in-time recovery.

5.1 California Privacy Rights (CCPA/CPRA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA), including the right to know what personal information we collect, request deletion, and opt-out of the sale of personal information. We do not sell personal information.

To exercise your California privacy rights, contact us at privacy@docketkeeper.com.