LawFrame Privacy Policy

1. Scope and Our Role

This Privacy Policy applies to personal information LawFrame processes for its own business purposes, including account information, billing information, website information, communications, security information, and operational records.

LawFrame also processes contracts, client information, matter information, and other content on behalf of its business customers. For that information, the Customer generally determines why and how the information is processed, and LawFrame acts as a service provider or processor.

If your information was submitted to LawFrame by a law firm, employer, attorney, or other Customer, including when you answer questions through a link that does not require a LawFrame account, questions or requests concerning that information should ordinarily be directed to that Customer. We will assist the Customer with legally required requests as appropriate.

This Privacy Policy does not apply to third-party websites or services that are not controlled by LawFrame. Stripe’s own privacy policy applies to payment card details entered in Stripe.

2. Information We Collect

2.1 Account and Identity Information

We may collect:

1. first and last name;
2. email address;
3. law-firm or organizational name, and other affiliation information;
4. account role and permissions;
5. whether the person is the firm’s billing contact;
6. invitation, account-activation, and account-status information;
7. password hashes and authentication tokens;
8. password-reset and account-unlock information;
9. sign-in timestamps, failed-login attempts, lock status, and related security information;
10. Terms of Use and Privacy Policy acceptance records, including the versions accepted and the time of acceptance;
11. subscription status, trial end date, and attorney-seat count; and
12. Stripe customer and subscription identifiers. LawFrame does not store payment card numbers.

LawFrame does not store a user’s password in readable form. LawFrame uses OpenAI for AI features. Firms and users do not choose an AI provider.

2.2 Customer Content

Depending on how a Customer uses the Service, Customer Content may include:

1. uploaded contracts and other PDF, DOC, or DOCX files;
2. filenames, file sizes, content types, checksums, malware-scan results, and storage metadata;
3. text extracted from uploaded documents;
4. contract sections, clauses, embeddings, summaries, classifications, risks, strengths, and clause types;
5. party names, counterparties, companies, governing jurisdictions, and contract types;
6. client names, client email addresses, and matter names;
7. the responsible attorney assigned to the matter, and timeline events;
8. client questions, explanations, answer choices, and short contract summaries prepared for a client;
9. the recipient’s name and email address for a client-question link, the optional name the recipient types, selected answers, custom answers, and drafts saved before submission;
10. when a client-question link was last opened, how many times it was opened, and whether it was submitted, withdrawn, replaced, or expired;
11. questions, prompts, chat messages, conversation summaries, citations, and generated answers in Ask This Contract;
12. Firm Knowledge positions and notes an attorney records on a section;
13. approved clause wording, versions of the updated agreement, and Word or text exports; and
14. other information entered, uploaded, generated, or stored by Authorized Users.

Customer Content may contain personal information about clients, counterparties, employees, contractors, witnesses, officers, shareholders, or other individuals. LawFrame does not control which personal information a Customer chooses to include.

2.3 Usage and Search Information

We may collect information about use of the Service, including:

1. features accessed and actions performed;
2. search terms and filters;
3. contract and matter identifiers associated with an operation;
4. document-processing status and error information;
5. AI provider, model, token counts, estimated cost, latency, and operation type;
6. result counts;
7. user and firm identifiers;
8. timestamps; and
9. account limits and usage totals, including Ask This Contract question counts.

LawFrame’s internal AI-usage records are designed to store operational measurements and identifiers rather than complete AI prompts or contract text. Prompts and generated responses may nevertheless be stored as Customer Content in conversations, drafts, matter records, or similar features.

2.4 Device, Network, and Security Information

We may automatically receive:

1. Internet Protocol address;
2. browser and device information;
3. user-agent information;
4. request identifiers;
5. login, logout, and account-security events;
6. session and cookie information;
7. administrative and impersonation activity;
8. error, performance, and diagnostic information; and
9. information used to detect abuse, secure accounts, and enforce usage limits.

The record of a client-question link being opened stores the time and a count. It does not store the visitor’s IP address in that record. Ordinary server and security logs may still contain an IP address.

2.5 Communications

We collect information when you contact us, request support, create an account, respond to an invitation, or otherwise communicate with LawFrame.

Password resets, account invitations, welcome messages, and billing notices are limited to account and billing information. They do not include contracts, client answers, or clause text. A welcome message includes the firm name and trial end date. A notice that an attorney was added or removed includes that attorney’s name, the attorney count, and the resulting subscription price.

When an attorney emails a client-question link, that message includes the firm’s name, the matter or contract title, how many questions there are, when the link expires, and the link. The sending attorney’s email address is the reply-to address. That message does not include clause text, answer choices, or the client’s answers.

After the recipient submits answers, LawFrame emails the attorney. That notice includes the client name if the matter has one, the name the recipient typed, the recipient’s email address, the matter or contract title, each question, the selected answer, any custom note, and the contract language tied to the chosen option. It does not include the link token or the options the recipient did not choose.

When someone creates a firm account or accepts an invitation, LawFrame sends its operators an internal notice with that person’s name, email address, firm name, role, how the account was created, subscription status, and, when the account was created from an invitation, who sent the invitation. That notice is not a marketing message to the new user.

When an Authorized User submits an issue report through the Service, we collect the user’s description of the problem, expected behavior, any suggested correction, the reporting user and firm, identifiers of the related contract, section, conversation, or message, the page on which the report was made, and technical diagnostics. Authorized LawFrame support administrators review issue reports to investigate and resolve them.

2.6 People Who Use a Client-Question Link

An attorney may send questions to a client on a link that does not require a LawFrame account. The page shows the law firm’s name, the questions, explanations, a short summary of the relevant contract language, and the answer choices. Answer choices may include proposed contract wording. The page does not show other files in the firm’s account.

The recipient may type a name, choose an answer, and add a note. Drafts can be saved on the link before submission. Answers are stored on the firm’s matter and are available to Authorized Users who can open that matter. Submitting answers does not create a LawFrame account.

The link token is stored only as a hash. The link expires. The default period is 14 days. An attorney may choose another period the Service offers, up to 90 days, and may withdraw or replace the link. The page does not load Google Analytics. It does load fonts from Google, so Google may receive the visitor’s IP address and browser information.

2.7 Earlier Public-Source Records

The current Service does not collect contracts from public filing systems for customer use, and it does not offer a public-precedent browser.

If older public-source records remain in storage, they are kept separate from a firm’s private content unless a user previously copied material into that firm’s account.

3. How We Collect Information

We collect information:

1. directly from users;
2. from Customer administrators and other Authorized Users;
3. from people who open or submit a client-question link;
4. from files and information submitted through the Service;
5. automatically from browsers, devices, servers, and application activity;
6. from Stripe, for subscription status and related billing events; and
7. from service providers that help us operate and secure the Service.

4. How We Use Information

We use personal information to:

1. create, administer, authenticate, and secure accounts;
2. start and administer trials and subscriptions, including attorney-seat counts;
3. provide contract upload, extraction, classification, search, clause analysis, client questions, wording suggestions, and document export;
4. create embeddings and retrieve relevant contract provisions;
5. generate AI-assisted answers, summaries, analysis, client questions, and wording suggestions;
6. maintain clients, matters, Firm Knowledge, and related workspaces;
7. send client-question links and record the answers;
8. scan uploaded files for malware before processing;
9. deliver invitations, password resets, account-security alerts, billing notices, and other essential service communications;
10. notify LawFrame when an account is created or an invitation is accepted;
11. provide support, investigate issue reports, and troubleshoot errors;
12. monitor performance, reliability, capacity, usage, and cost;
13. prevent fraud, abuse, unauthorized access, and cross-customer access;
14. enforce account, storage, document, and AI-usage limits;
15. maintain audit and security records;
16. comply with law, court orders, professional obligations applicable to us, and valid legal process;
17. protect LawFrame, Customers, users, and third parties; and
18. create aggregated or de-identified operational statistics that do not reasonably identify a Customer, user, client, matter, contract, or other person.

5. Artificial-Intelligence Processing

5.1 Information Sent for AI Features

LawFrame uses OpenAI for analysis, client-question drafts, wording suggestions, search, and embeddings. Firms and individual users do not choose an AI provider or a model.

If OpenAI is unavailable, LawFrame does not send the request to a different AI provider.

Depending on the feature, we may transmit:

1. user questions and instructions;
2. search queries;
3. extracted contract clauses or other relevant excerpts;
4. client-question drafts, including questions, explanations, summaries, and answer choices;
5. proposed and revised clause language;
6. Firm Knowledge positions and notes when a feature uses them; and
7. other text needed to generate the requested result.

LawFrame generally extracts text from an uploaded document before submitting information to OpenAI. Full uploaded PDF or Word binaries are not ordinarily sent to OpenAI.

LawFrame records which OpenAI model produced AI output for certain features, such as wording suggestions and clause analysis.

5.2 Model Training

LawFrame does not use Customer Content to train a general-purpose AI model.

OpenAI states that content submitted through its API is not used to train or improve its models unless its API customer affirmatively opts in. LawFrame does not affirmatively opt Customer Content into model training.

5.3 Provider Retention

Under OpenAI’s standard API data controls, prompts, responses, and embedding inputs may be retained for up to thirty days for abuse monitoring.

OpenAI may retain that information longer when required by law or reasonably necessary to protect OpenAI, its services, or third parties. Different retention may apply if LawFrame enables modified-abuse-monitoring or zero-data-retention controls with OpenAI.

5.4 AI Output

AI output may contain personal information derived from Customer Content. AI output may also be inaccurate or make unsupported inferences. Users must review output before using or disclosing it.

6. When We Disclose Information

We may disclose personal information as follows.

6.1 Within a Customer Account

Customer administrators and Authorized Users may access information according to the Customer’s account configuration and LawFrame’s permissions.

Uploaded contracts and many other firm resources are generally available across the Customer’s firm account. Individual conversation histories may be limited to the user who created them, although underlying firm contracts remain firm resources. Answers submitted through a client-question link are available to Authorized Users who can open the related matter.

Authorized LawFrame administrators may access information when reasonably necessary to provide support, investigate issue reports or security or technical problems, maintain the Service, or enforce our terms, including by temporarily viewing the Service as a user. Such access may be logged.

6.2 Service Providers

We use service providers to operate the Service. Based on the current application architecture, relevant categories include:

1. OpenAI for AI and embedding processing;
2. Heroku and related Salesforce infrastructure for application hosting, databases, deployment, logs, and supporting services;
3. Amazon Web Services for object storage of uploaded files;
4. Redis infrastructure providers for queues, caching, and rate-limit information;
5. Resend for account invitations, password resets, security alerts, client-question emails, billing notices, internal signup notices, and other essential email;
6. Stripe for subscription billing, trials, and payment methods. LawFrame sends Stripe the billing contact’s email address, the firm name, and a firm identifier. Payment card numbers are entered in Stripe’s billing portal and are not stored by LawFrame. Stripe sends its own receipts, trial reminders, and card notices;
7. New Relic for application performance, logs, traces, error monitoring, and AI-service monitoring;
8. Google Analytics 4 for aggregated product and marketing usage measurement; and
9. Google Fonts for delivery of website fonts.

These providers may process information only as needed to provide their contracted services, subject to their agreements and applicable law.

Uploaded files are scanned for malware by a private scanner LawFrame operates before processing continues. That scan does not send files to a public multi-tenant malware-analysis service.

6.3 Application Monitoring

LawFrame uses New Relic for performance and operational monitoring.

New Relic is configured to record AI performance information without recording the content of AI prompts, model responses, or embedding inputs.

6.4 Customer-Directed Disclosures

We disclose information when a Customer or Authorized User directs us to do so, including when a user exports a document, invites another user, or sends a client-question link.

Sending a client-question link discloses, to the recipient and to the recipient’s email provider, the firm’s name, the matter or contract title, the number of questions, the expiration, and the link. Anyone who opens the link can see the questions, explanations, the short contract summary, and the answer choices, which may include proposed contract language.

6.5 Legal and Safety Reasons

We may disclose information when we reasonably believe disclosure is necessary to:

1. comply with law or valid legal process;
2. respond to a lawful government request;
3. enforce our agreements;
4. investigate fraud, abuse, or security incidents;
5. protect the rights and safety of LawFrame, Customers, users, or third parties; or
6. establish, exercise, or defend legal claims.

When legally permitted and appropriate, we will seek to notify the affected Customer before disclosing Customer Content in response to legal process.

6.6 Business Transactions

Information may be disclosed in connection with financing, due diligence, restructuring, merger, acquisition, bankruptcy, or sale of some or all of LawFrame’s business or assets.

Any recipient will be subject to obligations consistent with this Privacy Policy or will provide appropriate notice of materially different practices.

6.7 Professional Advisers

We may disclose information to attorneys, accountants, auditors, insurers, and other professional advisers who require it to provide services and are subject to appropriate confidentiality duties.

7. Cookies and Similar Technologies

LawFrame uses cookies and similar technologies necessary to:

1. maintain authenticated sessions;
2. remember a user when Remember me is on;
3. protect against cross-site request forgery, including on a client-question page;
4. maintain security and administrative-session state;
5. preserve limited workflow state;
6. return a user to the page they were viewing after a session expires; and
7. operate the Service.

Remember me is selected on the sign-in form unless the user turns it off. That cookie lasts 30 days and is extended when it is what signs the user back in. Signing out expires it. If Remember me is off, an idle session ends after 14 days unless LawFrame configures a different limit.

LawFrame also uses a preference cookie to remember a user’s light or dark color theme, and the browser’s local storage to remember interface layout choices such as a collapsed sidebar. These preferences stay in the user’s browser, are not used for advertising, and can be cleared through browser settings.

LawFrame does not use advertising cookies, behavioral-advertising pixels, or a consumer advertising network.

LawFrame loads Google Analytics 4 on the public marketing site, sign-in and account pages, the authenticated attorney workspace, and the admin console. It does not load Google Analytics on the no-account client-question page. Google may set cookies or similar identifiers and receive approximate location and device or browser information. On authenticated pages, LawFrame anonymizes IP addresses, turns off Google signals, scrubs numeric IDs, UUIDs, and long tokens from recorded paths, replaces page titles with a generic path-based label, and drops search and other sensitive query parameters before sending page views. We do not send workspace document contents, matter names, contract titles, or user email addresses to Google Analytics.

Third-party font, analytics, and infrastructure requests may disclose technical information such as an IP address, browser information, and referring page to the applicable provider.

Most browsers allow users to delete or block cookies. Blocking essential cookies may prevent sign-in or interfere with the Service.

Because LawFrame does not currently sell personal information or use it for cross-context behavioral advertising, browser “Do Not Track” signals do not change the operation of essential Service cookies.

8. Sale, Sharing, and Advertising

LawFrame does not sell personal information for money.

LawFrame does not share personal information for cross-context behavioral advertising and does not use Customer Content for targeted advertising.

LawFrame does not disclose Customer Content to data brokers.

Disclosing information to service providers that process it on LawFrame’s behalf is not treated by LawFrame as a sale of personal information.

9. Data Retention

We retain information for periods reasonably necessary to:

1. provide the Service;
2. maintain Customer accounts;
3. satisfy contractual obligations;
4. maintain security and audit records;
5. resolve disputes;
6. comply with law; and
7. protect legal rights.

The Service does not currently implement one universal retention period for every category of information.

9.1 Uploaded Contracts

When an authorized firm administrator deletes a private contract, the Service is designed to delete the primary contract record, its stored file, extracted sections, embeddings, clause analysis, and Firm Knowledge positions tied directly to those sections.

Deleting a contract may not automatically delete every related item. Conversations, messages, citations, matter records, client questions, exports, audit records, or other content that referenced the contract may remain until separately deleted or until the applicable account-retention process occurs.

9.2 Conversations

Ask This Contract keeps a conversation for one user and one agreement. The Service does not currently offer a control that deletes that conversation while the account remains. Deleting the user account is designed to delete that user’s conversations. Deleting the contract does not by itself delete the conversation. Other firm content the user authored may remain, with the user attribution removed, when the user account is deleted.

9.3 Disabled Accounts

Disabling an account prevents access but does not itself delete the account or associated firm content.

9.4 Customer Termination

Following termination, LawFrame may delete or de-identify Customer Content according to the applicable customer agreement, operational retention practices, and legal requirements.

9.5 Backups and Logs

Residual copies may remain temporarily in database backups, object-storage versions, disaster-recovery systems, security logs, and audit records. Such copies are isolated from ordinary use and retained until overwritten or deleted under the applicable retention process.

Audit records may be retained after related users, firms, or records are deleted when reasonably necessary for security, fraud prevention, legal compliance, and system integrity.

9.6 OpenAI

Information submitted through OpenAI’s API may remain with OpenAI for the periods described in Section 5.3.

9.7 Issue Reports

Issue reports are retained while they are open and afterward as reasonably necessary to prevent the problem from recurring and maintain service records.

9.8 Client-Question Links and Billing Records

A client-question link stops working when it expires, is withdrawn, or is replaced. Expiring or withdrawing the link does not by itself delete the questions or the answers already stored on the matter.

LawFrame keeps Stripe customer and subscription identifiers, subscription status, trial dates, and seat counts while the firm account exists, and afterward as needed for accounting, tax, and dispute records. Card details remain with Stripe under Stripe’s retention practices.

10. Data Security

LawFrame uses administrative, technical, and organizational safeguards intended to protect information, including:

1. encrypted HTTPS connections in production;
2. password hashing and account-locking controls;
3. inactivity-based session timeouts, and a separate remember-me cookie when that option is on;
4. public firm signup, with additional firm members added by invitation or by LawFrame;
5. client-question links that expire and are stored only as hashes;
6. malware scanning of uploads by a private scanner before processing;
7. role-based and firm-based access controls;
8. request throttling and abuse controls;
9. filtering intended to keep passwords, tokens, prompts, document text, and similar content out of ordinary application logs;
10. firm-scoped database queries and tenant-isolation controls;
11. restricted administrative access;
12. audit logging for selected security and administrative actions;
13. encrypted storage and transport features made available by infrastructure providers; and
14. monitoring and error-reporting controls.

No security method is perfect. LawFrame cannot guarantee that information will never be accessed, disclosed, altered, lost, or destroyed.

The current Service does not yet provide active multifactor authentication or passkeys. Users should use strong, unique passwords and protect their email accounts.

11. User and Customer Choices

11.1 Account Information

Users may review certain account information through the Service. Requests to correct other account information may be submitted to the Customer administrator or LawFrame.

11.2 Customer Content

Customers and Authorized Users may edit, download, export, or delete certain Customer Content using available Service features. An attorney may withdraw a client-question link. Some actions, including deleting contracts, clients, matters, users, or an entire firm account, are limited to administrators.

11.3 Communications

Account invitations, password resets, account-security notices, welcome and billing notices, client-question messages, and the notice to an attorney after a client submits answers are necessary to provide and secure the Service and are not marketing messages. Stripe may separately email the billing contact about receipts, trials, and cards.

The application does not use email for routine social-network-style notifications. Section 2.5 describes which messages include matter titles, answers, or contract language, and which do not.

11.4 Privacy Requests

Depending on where you live and applicable law, you may have rights to request:

1. confirmation of whether we process your personal information;
2. access to personal information;
3. correction of inaccurate information;
4. deletion of information;
5. a portable copy of certain information;
6. restriction of or objection to certain processing;
7. withdrawal of consent when processing is based on consent; and
8. an appeal from the denial of a request.

To submit a request, contact richard@lawframe.co.

We may need to verify your identity and authority. We may deny or limit a request when permitted by law, including when information must be retained for security, legal, contractual, or evidentiary purposes.

We will not discriminate against a person for exercising an applicable privacy right.

12. Requests Involving Customer-Controlled Information

If LawFrame processes your information on behalf of a Customer, such as your law firm, employer, or attorney, that Customer is generally responsible for responding to your request. That includes information you submit through a client-question link.

If you submit the request directly to LawFrame, we may refer it to the Customer and assist the Customer as required by law or contract.

LawFrame will not disclose another person’s privileged, confidential, or legally protected information in response to a privacy request unless legally required.

13. United States Processing

LawFrame is operated in the United States. Information may be stored and processed in the United States and in other locations where LawFrame’s service providers operate.

If the Customer requires a particular data location, international-transfer mechanism, or data-processing addendum, that requirement must be addressed in a written agreement before the Customer submits affected information.

14. Children

The Service is not directed to children and is not intended for anyone under eighteen years old.

LawFrame does not knowingly collect personal information directly from children through individual user accounts. Customer Content may contain information about minors when submitted by a Customer in connection with legal work. In that circumstance, the Customer is responsible for having a lawful basis and appropriate authority to process the information.

15. Changes to This Privacy Policy

We may update this Privacy Policy from time to time.

If a change is material, we will provide reasonable notice through the Service, by email, or by another appropriate method. The updated policy will identify its effective date. Continued use of the Service may require acceptance of the updated policy.

16. Contact Information

Questions, concerns, and privacy requests may be sent to:
Email: richard@lawframe.co