Privacy Policy

1. Information We Collect

1.1 Information You Provide

When you create an account, contact us, or use our platform, we collect information you voluntarily provide, including:

• Account Information: Name, email address, firm name, bar number, professional title, and billing information.
• Case Data: Case details, client information, documents, notes, time entries, and other data you enter into the platform.
• Communications: Messages you send through the platform, support requests, and feedback.
• Payment Information: Billing details processed securely through our payment processor (Stripe). We do not store full card numbers on our servers.

1.2 Connected Accounts (Optional)

If you choose to connect a third-party account, we process data from that account only to provide the related feature:

• Email (Gmail via OAuth, or IMAP/SMTP): If you connect an email account, we store the email messages and attachments synced through that connection (including sender/recipient addresses, subjects, and message bodies) to provide inbox, threading, and send features. OAuth tokens and any mailbox password are encrypted at rest (AES-256-GCM). You can disconnect an account at any time.
• Calendar and files (Google, Microsoft): If you connect Google or Microsoft, we access the calendar events and files you authorize, to provide scheduling and document features.

1.3 Information Collected Automatically

When you use our platform, we automatically collect:

• Usage Data: Pages visited, features used, time spent, and actions taken within the platform.
• Device Information: Browser type, operating system, IP address, and device identifiers.
• Cookies: See our Cookie Policy for details on how we use cookies and similar technologies. Analytics cookies (Google Analytics) and an advertising cookie (the Meta Pixel, which measures our Facebook and Instagram ads) are set on our public website only with your consent; without it, we use no advertising cookies or cross-site tracking.

2. How We Use Your Information

We use your information to:

• Provide, maintain, and improve the Legience platform and its features.
• Process payments and manage your account.
• Send transactional communications (account verification, billing notices, security alerts).
• Provide customer support and respond to your requests.
• Analyze platform usage to improve features and user experience (using anonymized or aggregated data where possible).
• Comply with legal obligations, including Massachusetts 201 CMR 17.00.

We do not use your Content to train AI models, and we do not sell your data.

3. How We Protect Your Information

We implement robust security measures to protect your data:

• Encryption: TLS encryption in transit for all connections; encryption at rest via AWS KMS at the storage layer, with additional AES-256 field-level encryption for selected sensitive data (e.g., identifiers, financial data).
• 201 CMR 17.00: Our security practices are designed to align with the Massachusetts Standards for the Protection of Personal Information.
• US-Only Data Residency: All data is stored and processed on AWS US-East (us-east-1) infrastructure, with encrypted backup copies in AWS US-East (us-east-2). No offshore processing.
• Role-Based Access: Configurable permissions ensure users only access data relevant to their role, with multi-tenant isolation by organization.
• Audit Logs: Tamper-evident audit logs of key actions — logins, AI calls, and permission and data changes.

4. AI and Your Data

AI Data Protection: When you use LegiSearch™, LegiDraft™, or LegiLyze™, and when Legience automatically reads a document uploaded to a case (for example, to recognize the text in a scan and summarize it):

• AI queries are processed through AWS Bedrock (Claude models and embeddings), which operates under our AWS Business Associate Agreement (BAA), with encryption in transit and at rest, within US AWS regions.
• Your data is never used to train, fine-tune, or improve any AI model, and is not retained by the model provider after processing.
• AI conversation history is stored in our database to provide continuity features. You can delete conversations at any time from within the platform.

Protected Health Information (PHI): If your firm is a Covered Entity or Business Associate under HIPAA and will store or process PHI (for example, medical records in personal-injury matters), a Business Associate Agreement (BAA) with Bostoneo Solutions LLC is required before you upload any PHI — request one at privacy@legience.com with "BAA Request" in the subject line. Do not upload PHI until a BAA is executed. To the extent we process PHI on your behalf, we act as your Business Associate.

5. Data Sharing and Subprocessors

We do not sell your personal information. We share data only with the service providers (subprocessors) below, each bound by a data-protection agreement that limits their use of data to providing their service to us and requires them to give it the same or equal protection as this policy:

• Amazon Web Services (AWS): Cloud hosting, database (RDS/PostgreSQL), and document storage (S3), in US regions — covered by the AWS Business Associate Addendum.
• Amazon Bedrock (AWS) / Anthropic: AI processing using Claude models and embeddings; not used for training, US regions.
• Stripe: Payment processing (card data handled directly by Stripe).
• Telnyx: SMS / text-message and fax delivery.
• BoldSign: Electronic signatures.
• Google & Microsoft: Email, calendar, and file integrations — only when you connect them.
• Transactional email provider: Delivery of system emails (verification, password reset, reminders).
• Apple: Delivery of push notifications to the Legience iPhone app (Apple Push Notification service). Notifications carry no case details.

On our public website, and only if you accept advertising cookies, the Meta Pixel also sends Meta information about your visit (for example, which pages you viewed and whether you submitted an application). See our Cookie Policy.

We may also disclose information: (a) when required by law, subpoena, or court order; (b) in connection with a merger, acquisition, or sale of assets (with notice); or (c) at your direction (for example, sending documents to clients via the Client Portal).

Mobile information is never shared for marketing. No mobile phone numbers or SMS/text-messaging consent obtained through the platform will be shared, sold, or rented to third parties or affiliates for their own marketing or promotional purposes. See the SMS / Text Messaging section below.

6. Data Retention and Deletion

We retain your data for as long as your account is active. Upon account termination:

• A 30-day export window during which you may request an export of your data.
• Production data is then deleted within a commercially reasonable time; copies in our backups and file version history are permanently deleted within 13 months, subject to legal holds and applicable law.
• Audit logs may be retained for up to 2 years, and billing/tax records for at least 7 years, as required by law.
• You may request deletion at any time by contacting privacy@legience.com.

7. Data Breach Notification

In the event of a security incident affecting your data, we will promptly investigate; notify you without undue delay and, where required by law, within the timeframes that law specifies (for example, within 72 hours where the GDPR applies, or within applicable U.S. state breach-notification timeframes); describe the nature of the incident, the data affected, the likely consequences, and the measures taken; and reasonably cooperate with your own notification obligations. Where we act as your HIPAA Business Associate, breach reporting follows the executed Business Associate Agreement. You remain responsible for your own notification obligations to your clients, bar authorities, and regulators.

8. Confidentiality of Legal Information

Data you process through the platform may include attorney-client privileged communications and attorney work product. Our access to your data is limited to what is necessary to provide and support the platform, and our personnel and contractors with access are bound by confidentiality obligations. We are not a law firm and do not provide legal advice; you are responsible for conducting your own privilege analysis when using any third-party technology service, including AI features.

9. SMS / Text Messaging

Legience provides a text messaging (SMS/MMS) capability so that law firms using our platform can communicate with their own clients about their legal matters. When a firm messages you, the firm is the sender and Legience transmits the message on the firm's behalf through our SMS provider (Telnyx). This section describes how the program works and your choices.

• Consent (opt-in): You receive text messages only after providing express consent — for example, by giving your mobile number and agreeing to be contacted by SMS during your firm's intake or through a consent checkbox. Consent to receive text messages is not a condition of purchasing any product or service.
• Message types: Messages may include case updates, appointment and court-date reminders, document requests, and other communications relating to your legal matter.
• Message frequency: Message frequency varies based on your matter and your interactions with your firm.
• Cost: Message and data rates may apply, depending on your mobile carrier and plan.
• Opt-out: You can cancel at any time by replying STOP to any message. After you reply STOP we will send a one-time confirmation, and you will receive no further messages unless you opt in again.
• Help: Reply HELP for assistance, or contact your firm directly.
• No sharing of mobile data: Mobile phone numbers and SMS consent are used solely to deliver the messages described above. We do not share, sell, or rent mobile opt-in information or SMS consent to any third parties or affiliates for their marketing or promotional purposes. Message content is processed by our SMS provider only to transmit messages on your firm's behalf.
• Carrier disclaimer: Mobile carriers are not liable for delayed or undelivered messages.

Texts from Legience. If you give your phone number and tick the SMS box on our contact form, Legience itself texts you about your demo request, early-access application or question, from Legience's own number. Message frequency varies, and message and data rates may apply. Reply STOP to opt out or HELP for help. We keep the record of your consent, and the same no-sharing commitment above applies: your number and consent are never shared, sold or rented for anyone's marketing.

10. The Legience Client App

Law firms that use Legience can invite their clients to the Legience app for iPhone. In the app you can see what your firm shares with you about your matter, message your legal team, send and sign documents, manage your appointments, and view your invoices. Your firm decides what the app shows you and keeps your case file; Legience provides the app and handles this information on your firm's behalf.

10.1 Information the App Collects

• Your profile: your name and email address, which your firm sets, and the phone number and mailing address you can edit in the app.
• What you send your legal team: messages; documents, photos, and videos you choose to upload, including photos you send in a message; documents you sign; appointment requests; and reports you send from the app, such as a new medical provider you saw, someone who contacted you about your case, or a cost or missed work. Depending on your matter, this can include health and financial information.
• Notification registration: if you turn on push notifications, the app sends us the token Apple issues for the Legience app on your iPhone, and our server stores it with your account so it can send your notifications through Apple's Push Notification service. The app may also send that token at other times, such as when you sign out, so our server can remove it.
• Face ID or Touch ID lock: if you turn on the lock, your iPhone creates a security key in its Secure Enclave. Only the public half of that key is sent to us, so our servers can recognize your iPhone when you unlock the app; the private key never leaves your phone.
• Technical information: the app's version and platform (for example, "ios/1.0"), sent with each request so we can recognize the app and tell you when an update is required. Each sign-in attempt records your IP address and a description of your device, and successful sign-ins also appear in your firm's audit log. Our servers also keep standard logs, which can include IP addresses.

10.2 Permissions on Your iPhone

The app asks before it uses the camera, the microphone, Face ID or notifications, and uses each only for the feature you are using. You can change your choices at any time in your iPhone's Settings.

• Camera: to take a photo or video of a document or a scene to send to your legal team.
• Microphone: only while you record a video to send to your legal team.
• Photos: you pick a photo or video you already have in the iPhone's own photo picker, which gives the app only what you pick — the app never asks for access to your photo library. It asks only if you save a copy of a document to your photo library.
• Face ID: to lock the app. The face or fingerprint check is done by iOS on your iPhone; Legience never receives your face, fingerprint, or any other biometric data.
• Notifications: to let you know when something needs your attention. A notification says only what kind of update is waiting — for example, "New message from your legal team" — never a name or a detail of your case, and you open the app to see it.

The app does not ask for access to your location, your contacts, or your calendar.

10.3 What Stays on Your iPhone

• Your signed-in session (never your password) is kept in your iPhone's Keychain, so the app doesn't ask you to sign in each time you open it. The app keeps you signed in on that iPhone with a security key created in the iPhone's own secure hardware, which never leaves it. The key lapses after 90 days without being used, and signing out (on any device), changing or resetting your password, or your account being disabled ends it sooner. With the app's Face ID or Touch ID lock turned on, the key works only after Face ID or Touch ID.
• Screens you have already opened are kept in the app's memory, so you can still read them if you lose your connection. These copies are never saved to your phone's storage, and they are cleared when you sign out or fully close the app.
• While you are signed in, the app keeps your name, email address, and your firm's name in its storage on your iPhone, and removes them when you sign out. A few small markers, such as which case you last viewed and which documents the app has already shown you, stay after you sign out.
• Documents you open are copied to the app's cache on your iPhone so iOS can display them. Signing out does not remove these copies; iOS can clear that space at any time, and deleting the app removes it.

10.4 What the App Does Not Do

• It shows no ads, contains no third-party analytics or advertising code, and does not track you across other companies' apps or websites.
• We do not sell what you share in the app, or use it to train AI models.

If you have chosen to share analytics with app developers in your iPhone's settings, Apple may share crash reports and usage statistics about the app with us. Apple controls that choice, under Settings → Privacy & Security → Analytics & Improvements.

10.5 Who Receives It

What you send in the app goes to your law firm through Legience's servers, hosted by Amazon Web Services in the United States (see Section 3). Push notifications are delivered by Apple's Push Notification service. When your firm asks you to sign a document, the signing page is provided by our electronic-signature provider (see Section 5). Documents and photos you send become part of your case file, and your firm may use Legience features on them to help organize and manage your case.

AI reading of what you send. Right after you sign in, the app asks whether Legience may read what you send with AI, and an upload waits until you answer. If you allow it, Legience automatically reads your messages and each document or photo you send with AI — Claude, from Anthropic, through Amazon Bedrock on Amazon Web Services — under the protections described in Section 4, including any text in photos and scans, to summarize them and note key dates, amounts, and deadlines, to translate messages, and to suggest replies for your legal team; on injury matters, medical records and bills may also be added to your case's medical records. If you don't allow it, nothing you send through the app or the client portal is read by AI automatically, though your legal team may still choose to use AI tools on your case, including on emails you send them. You can change your answer at any time under Your details → Privacy & consent, in the app or in your firm's client portal on the web. Turning it on lets AI read what you sent while it was off, too; turning it off stops the automatic reading from then on, including the scan of medical records, and summaries already made stay with your firm. If you haven't answered — on the web, or in the app if it could not ask you — what you send is read automatically until you turn it off.

10.6 Deleting Your Account

You can delete your account in the app: tap your initials at the top right of the screen (or More → Your details) to open Your details, then choose Delete your account. Your account is deleted right away: your sign-in is deleted, you are signed out on every device, and the app's notification registrations and Face ID or Touch ID keys for your account are revoked. We email you to confirm. Your firm keeps your case file and its own record of you, including what you sent through the app and how to reach you, and anything else the law requires it to keep. We keep the security log of your sign-ins for up to 2 years, as section 6 says, then delete it. Deleting the app from your iPhone does not delete your account. For anything else about your data in the app, contact your firm, or email privacy@legience.com. See also our Support page.

11. Your Rights

You have the right to:

• Access, correct, or delete your personal information.
• Export your data in standard formats (CSV, PDF).
• Opt out of non-essential communications.
• Request information about how your data is processed.

To exercise these rights, contact privacy@legience.com.

12. California Privacy Rights (CCPA/CPRA)

If you are a California resident, you have the right to know, delete, and correct the personal information we hold; the right to opt out of the sale or "sharing" of personal information (we do not sell personal information; the only "sharing" as defined under the CCPA/CPRA is the optional Meta Pixel on our public website, which loads only if you accept advertising cookies and which you can decline in our cookie banner); the right to limit the use of sensitive personal information (we do not use it beyond permitted purposes); and the right not to be discriminated against for exercising these rights. Contact privacy@legience.com to exercise them.

13. Massachusetts Residents

If you are a Massachusetts resident, you have additional rights under Chapter 93H and 201 CMR 17.00, including the right to know what personal information we hold about you and the right to request deletion.

14. International Data Transfers

The platform is operated and hosted in the United States. If you access it from outside the United States, your data will be transferred to and processed in the United States. Where we transfer personal data from the EEA, UK, or Switzerland to a country without an adequacy decision, we rely on appropriate safeguards, including the EU Standard Contractual Clauses and the UK Addendum, as described in our Data Processing Addendum.

15. Children's Privacy

Legience is not intended for individuals under the age of 18. We do not knowingly collect personal information from children.

16. Changes to This Policy

We may update this policy from time to time. We will notify you of material changes via email or in-platform notification at least 30 days before the changes take effect.

17. Contact Us

For privacy-related questions or requests:

• Email: privacy@legience.com
• Mail: Bostoneo Solutions LLC, Malden, MA 02148