Privacy Policy

B.Legal LLC ("B.Legal", "we", "us") operates the B.Legal software and b.legal website. This policy explains what information we collect, how we use it, and what rights you have. If you have questions, emailprivacy@b.legal.

1. Who controls your data

When you use the B.Legal webapp, native apps, or website, B.Legal LLC is the data controller for your account information (email, name, firm, billing). For client data you store in B.Legal — matter records, time entries, documents, communications — you are the data controller and B.Legal is the data processor. We handle that data only under your instructions.

2. Information we collect

We collect three categories of information:

• Account data. Name, email, firm name, billing address, and billing details for your subscription.
• Usage data. Pages viewed, features used, errors encountered, device type, browser type. Used to improve the product. Never sold.
• Client data you enter. Matters, time entries, clients, contacts, documents, invoices, trust ledger entries, AI prompts. We treat this as privileged and confidential.
• Screen captures (macOS, optional). If you turn on screen capture, B.Legal photographs your entire screen — every open window, not only B.Legal's — together with the titles of up to eight open windows and browser tabs from any app you have running, to infer billable activity. See section 4 for where each capture is sent.

3. How we use it

• To provide and operate the service you signed up for.
• To bill you and send receipts and renewal notices.
• To diagnose technical issues and prevent abuse.
• To send product updates (opt-in only).

We do not sell your data, share it with advertisers, or use it to train AI models. Your client data is never used for any purpose other than providing the service.

4. AI and your data

AI in B.Legal is cloud-based unless you change it. On macOS you can switch the AI backend to a local Ollama model in Settings, and when you do, your prompts and responses never leave your Mac. Ollama is not available in the web app or on iPhone and iPad, where AI is always cloud-based. Cloud prompts are sent to Anthropic under Anthropic's commercial API terms, which do not allow your prompts or outputs to be used for model training. AI drafting and research output is saved to the matter you run it for. If a matter is sensitive enough that its text should not leave your machine, use the macOS app with the Ollama backend, or do not run AI on it.

Screen capture, specifically. A capture and its window titles are analyzed by whichever AI backend is configured on that device — sent to your local Ollama model and to neither B.Legal nor Anthropic if you've switched to Ollama, or otherwise sent to B.Legal's servers and on to Anthropic (or straight to Anthropic if you supply your own API key). B.Legal never writes the image itself to disk; only the matter and activity text the AI infers from it is saved to your matter.

5. Data retention

Active account data is retained for as long as your account exists. Cancelling does not delete anything and does not close your access — you can continue to export your data. We do not delete data automatically after cancellation. You may request permanent deletion at any time by emailing privacy@b.legal; we action it within 30 days and confirm in writing. After deletion, database records may persist for up to 30 days in encrypted daily backups (plus a 7-day point-in-time recovery window), and uploaded files for up to 90 days in file-version history, before they are permanently purged. Where a matter is subject to a legal hold or a professional retention obligation, we retain the affected records until the hold is lifted, and will tell you if that applies to a deletion request.

6. Cookies and local storage

The webapp sets one session cookie (__session) to keep you signed in; it carries no tracking identifier and is not shared with advertisers. We also use your browser's local storage for non-sensitive preferences — theme, layout density, the firm name you typed on the signup form — and to time out an idle session after seven days. We do not use third-party advertising or analytics cookies.

7. Your rights

You have the right to:

• Access all personal data we hold about you.
• Correct any inaccurate data.
• Request deletion of your account and data.
• Export your data in JSON or CSV, plus a PDF report. Self-service export is currently available in the macOS app; if you use only the web or iPhone app, email us and we will produce the export for you.
• Object to processing that's not strictly necessary.
• Withdraw consent at any time.

To exercise any of these rights, emailprivacy@b.legal. We respond within 30 days.

8. Third-party processors

We use a small number of sub-processors to run the service. Separately, B.Legal can connect to accounts you already hold elsewhere; those are listed on their own below, because you choose and authorise them and your own agreement with that provider governs the account.

Sub-processors we engage:

• Google Cloud — hosting, the Firestore database, Cloud Storage for documents, and Firebase Auth. Firebase App Check uses Google reCAPTCHA Enterprise to verify that a request comes from our app, and our web pages load their typefaces from Google Fonts, which receives your IP address when a page loads.
• Cloudflare — CDN, DDoS protection, and the hosting for the website and the API themselves, so web and API traffic is decrypted at Cloudflare's edge on its way to us. Cloudflare Turnstile protects our public forms.
• Anthropic — cloud AI. Whenever an AI feature runs, the prompt and the matter context sent with it go to Anthropic. See section 4 for when that happens and how to keep a matter off it.
• Resend — transactional email, including the invoices we send to your clients on your behalf (client name and email address, invoice number, amounts, and payment instructions).
• Sentry — error monitoring (PII-scrubbed technical diagnostics only).
• LawPay (AffiniPay) — online invoice payments, where you have connected a LawPay account. Creating a pay link sends your client's name and email address, the invoice number and the amount to LawPay, and the payment itself is taken on LawPay's systems. B.Legal never holds card details.
• Stripe — your firm's own B.Legal subscription billing. No client or matter data is sent to Stripe.
• Apple — address suggestions in the web app. When you type into an address field on a client, contact, or firm record, what you type is sent to Apple Maps to return matching addresses.

Accounts you connect yourself:

• Google Workspace — Gmail, Calendar, and Drive. Optional. Once you connect it, B.Legal reads your mailbox to find billable work and filings, creates calendar events for court dates and tasks, and uploads matter documents to your Drive. A mail scan reads every message in the date range you choose unless you narrow it to a single matter, so it can take in correspondence belonging to other clients, to opposing counsel, and to you personally.
• Zoom. Optional. Once you connect it, B.Legal reads meetings, call logs, cloud recordings and their transcripts, voicemails and SMS threads from your Zoom account. Zoom sign-in is completed on our server, which holds the credential for the B.Legal Zoom application; the content itself stays in your Zoom account under your agreement with Zoom.

Each sub-processor is bound by a written agreement limiting its use of your data to providing the service to us. B.Legal has executed a Business Associate Agreement with Google Cloud, which covers the services that hold your matter data at rest — Firestore, Cloud Storage, and Cloud Functions. It does not extend to Gmail, Google Calendar, or Google Drive when you connect your own Google Workspace account. The remaining sub-processors are not covered by a Business Associate Agreement. B.Legal is a practice management tool, not a HIPAA-covered entity, and we do not represent the service as HIPAA compliant. If your practice handles protected health information and requires BAA coverage across every processor, contact us atprivacy@b.legal before storing that information in B.Legal.

9. Children

B.Legal is not directed to anyone under 18. We do not knowingly collect data from minors.

10. International transfers

B.Legal is based in the United States. If you access the service from outside the US, your data will be transferred to the US. We comply with GDPR and CCPA for covered users.

11. Changes to this policy

We'll notify you of material changes at least 30 days before they take effect. Minor corrections are posted without notice.

12. Contact

B.Legal LLC
Attn: Privacy
Brooklyn, New York
privacy@b.legal