Privacy Policy

1. INFORMATION WE COLLECT

When you use LAW, we collect the following information:

• Account information: Name, email address and sign-in details provided at registration or checkout, and the organization you belong to.
• Chat and case content: The questions you ask, the answers you receive, and the matters, documents and notes you create or upload, linked to your account.
• Search queries: The text of queries you submit to LAW search, stored with your account identifier.
• Security and usage data: A shortened IP address (its last part removed), browser type and access timestamps, used for security, abuse prevention and analytics that we run ourselves.
• Orders and payments: Your name, email address and the transaction ID of each order, and the subscription ID for recurring plans. Card details are entered into Authorize.Net’s Accept.js in your browser and sent directly to Authorize.Net; we never receive your full card number.
• Intake and access-request submissions: What you provide in an intake form (name, contact details, description of the matter, parties, evidence) or an access request (email, name, situation, role, jurisdiction). These are emailed to our team.
• Waitlist: Your email address if you join a waitlist.

2. HOW WE USE INFORMATION

We use collected information exclusively for the following purposes:

• To provide and deliver the services you request, including research memos, document audits, filing packages, and intelligence reports.
• To process payments and maintain transaction records.
• To keep the service secure, prevent abuse, and improve search quality and the accuracy of our primary source database.
• To communicate with you about your orders, account status, and service updates.

3. WHAT WE DO NOT DO

Gage Green Group commits to the following:

• We do not sell, rent, or trade your personal data to any third party.
• We do not use your content or queries to train any AI model.
• We do not send your content to model providers for any purpose other than answering your request.
• We do not track you across other websites or applications.
• We do not use your data for advertising, ad targeting, or behavioral profiling.
• We do not use third-party analytics or tracking scripts.

4. WHO PROCESSES YOUR INFORMATION

We use the following service providers to run LAW. Each receives only what it needs for its role:

• Vercel: website hosting.
• Supabase: accounts, sign-in and the records described above.
• Authorize.Net: payment processing.
• Amazon Web Services (SES) and Resend: email delivery.
• Google (Gemini) and Groq: AI model processing for general questions. They receive the text of the request, and for search, the text used to find matching sources, solely to produce the answer.
• Our own servers: questions that belong to one of your matters, which we mark sensitive, are answered on servers we operate and are not sent to Google or Groq. If our servers are unavailable, such a question is declined rather than sent elsewhere.

We may also disclose information where required by law or court order.

5. PAYMENT SECURITY

All payments are processed through Authorize.net using Accept.js technology. This means:

• Your credit or debit card data is tokenized directly in your browser before any data is transmitted. Your full card number never touches our servers.
• Authorize.net is PCI-DSS Level 1 compliant, the highest level of payment security certification.
• We store the transaction ID, your name and email address, and the subscription ID for recurring plans, for record-keeping and dispute resolution.

6. DATA RETENTION

• Account, chat, case and order records are kept for as long as your account is active. Download my data in Dashboard, Settings gives you a copy, any time, as one file. To delete your account, email law@gagegreengroup.com from the address you sign in with and we will act within 30 days; where Delete my account appears in Settings, you can do it yourself after confirming with your password.
• What we keep after you delete your account, and only this:
  • Payment transaction records: the Authorize.Net transaction ID and order number, the amount, status and date of each order, and the subscription and credit-purchase IDs. Your name, email and any other detail are removed from them. Kept for tax, accounting and payment-dispute record-keeping requirements.
  • Security and abuse logs, which are not about your content and in which an account identifier is removed where one is stored. Kept to protect the service and investigate abuse; some of these records are append-only and are not altered.
• Payment records are kept for as long as tax and accounting law requires.
• Security logs are kept for as long as needed to protect the service and investigate abuse. Some security records are append-only and are not altered after they are written.

7. YOUR RIGHTS

You have the following rights regarding your personal data:

• Access: Download a copy of the personal data we hold about you with Download my data in Dashboard, Settings, or request it by email.
• Deletion: Permanently delete your account and associated personal data by email request, or with Delete my account in Dashboard, Settings where it appears.
• Correction: Request correction of any inaccurate personal data.
• Opt-out: Opt out of non-essential communications at any time.
• Portability: The download is a machine-readable JSON file.

To exercise any of these rights, contact us at law@gagegreengroup.com. We will respond within 30 days.

8. COOKIES

LAW uses essential cookies only. These are strictly necessary for the operation of the platform, including your sign-in session and a cookie that remembers your active organization (kept for up to one year).

We do not use tracking cookies, advertising cookies, or third-party analytics cookies. We do not use Google Analytics, Facebook Pixel, or any similar tracking technology.

9. CALIFORNIA PRIVACY RIGHTS (CCPA)

If you are a California resident, you have the following rights under the California Consumer Privacy Act (CCPA):

• Right to Know: You may request disclosure of the categories and specific pieces of personal information we have collected about you.
• Right to Delete: You may request deletion of your personal information, subject to certain legal exceptions.
• Right to Opt-Out: We do not sell personal information. There is nothing to opt out of.
• Right to Non-Discrimination: We will not discriminate against you for exercising any of your CCPA rights.

To exercise these rights, contact law@gagegreengroup.com. We will verify your identity and respond within 45 days.

10. INTERNATIONAL USERS (GDPR)

If you are located in the European Economic Area (EEA), United Kingdom, or Switzerland, you have additional rights under the General Data Protection Regulation (GDPR):

• Legal Basis: We process your data based on (a) your consent, (b) performance of a contract (providing services you requested), and (c) our legitimate interest in improving the platform.
• Right to Restrict Processing: You may request that we limit how we use your data.
• Right to Object: You may object to processing based on legitimate interest.
• Right to Lodge a Complaint: You have the right to file a complaint with your local data protection authority.
• Data Transfers: Your data is stored on servers in the United States. By using LAW, you consent to the transfer of data to the United States.

Data Protection Contact: law@gagegreengroup.com

11. ATTORNEY-CLIENT PRIVILEGE AND CONFIDENTIALITY

LAW is a legal intelligence platform, not a law firm. However, we recognize that users may submit sensitive legal information through intake forms, case management tools, and document generation features.

• Your information is encrypted in transit (TLS). It is stored with our database provider, Supabase, which states that all customer data is encrypted at rest with AES-256.
• Case data can be accessed by you, by people you share a matter with in your organization, by our administrators for support and security, and by the processors named above in the course of providing the service.
• We will not disclose your case data to anyone else except as required by law or court order.
• If you delete your account yourself, or ask us to, we will remove your records, except records we must keep by law (such as payment records) and security records described above.

12. CHILDREN

LAW is not intended for use by individuals under the age of 18. We do not knowingly collect personal information from minors. If we become aware that we have collected data from a user under 18, we will promptly delete that information.

13. CHANGES TO THIS POLICY

We may update this Privacy Policy from time to time. Material changes will be communicated to registered users via email. The updated policy will be posted on this page with a revised effective date. Your continued use of LAW after any changes constitutes your acceptance of the updated policy.