Privacy Policy

CasePalm LLC, a Texas limited liability company (“CasePalm,” “we,” or “us”) provides case-synthesis software to licensed attorneys and their staff. The material our customers upload is frequently privileged, and this policy describes exactly how it is handled.

We have written it against what the software actually does rather than from a template. Where we make a security or handling claim, it reflects a control that exists in the product today.

1. Who controls the data

The law firm using CasePalm is the controller of its client data. We act as a processoron that firm's behalf and under its instructions, solely to provide the service.

We do not sell firm or client data. We do not share it with third parties for advertising. We do not use it to build features for other customers.

2. What we collect

Account information. Name, email address, firm affiliation, and role, supplied at signup or by invitation from a firm administrator. Passwords are managed by our authentication provider; we never store or receive raw passwords.

Matter content. Documents, notes, calendar events, tasks, messages, time entries, and other records that firm users create or upload, together with the analyses the product derives from them.

Operational data. Authentication events, request and error logs, and usage counters used to run, secure, and rate-limit the service.

What we do not use. CasePalm runs no advertising trackers, no analytics pixels, and no third-party marketing scripts. The only cookies the application sets are those required to keep you signed in.

3. How matter content is used

Matter content is used to provide the features a firm invokes: indexing documents so they can be searched, extracting facts and citations, identifying contradictions across a record, synthesizing proceeding strategy, and generating drafts. It is not used for any other purpose.

4. Artificial intelligence

Client materials are not used to train external models. When a feature requires an AI model, the text needed for that request is transmitted to our AI provider, processed under commercial API terms that exclude training use, and the result is returned to the firm. We do not train models on firm content, and we do not permit our providers to.

Bring your own key.A firm may store its own Anthropic API key, after which AI requests for that firm route through the firm's own provider account and agreement. Stored keys are encrypted at rest, restricted to firm administrators, never transmitted to the browser, and scrubbed from error reports.

Adverse documents.In litigation a large share of a record is authored by opposing parties. Text drawn from documents is escaped and framed before it reaches a model, so that instructions embedded in an opponent's file are treated as evidence rather than as commands.

5. Where data lives

Matter records, uploaded files, and authentication data are stored with Supabase, running on Amazon Web Services. Application compute is served by Vercel, which processes requests in transit and stores no firm data at rest.

The specific hosting region for your firm's data is available from your firm administrator in the application under Settings → Storage & data. We publish the region there rather than asserting one here, so that the answer you get is the verified configuration rather than a claim in a document.

6. Subprocessors

The following third parties process firm data on our behalf. Each is engaged under terms requiring appropriate confidentiality and security safeguards.

• Supabase (on AWS) — Database, file storage, and authentication. All matter records, uploaded documents, and account data.
• Vercel — Application hosting and compute. Requests are served here; no firm data is stored at rest.
• Anthropic (Claude) — Powers the AI features (Case Strategy, drafting, analysis). Only the document text and matter context needed for a given AI request.
• Voyage AI — Builds the search index that lets AI find relevant passages. Document text, converted to numeric embeddings for retrieval.
• Resend — Transactional email, inbound and outbound. Message contents and recipient addresses for firm email routed through the product.
• Sentry — Error monitoring so we can fix crashes quickly. Technical error details only — not your matter contents.
• Google — Google Drive import, only if your firm connects it. Read-only access to the Drive files the connecting user selects.
• CourtListener and Brave Search — Legal research and web lookups a user initiates. The search or citation query itself; no documents are transmitted.

We will update this list before adding a subprocessor that receives firm data or document text.

7. Security and access controls

Data is encrypted in transit and at rest. Beyond that, access is constrained by controls enforced in the database rather than only in the interface:

• Firm isolation.Every firm-scoped table carries row-level security keyed to the requesting firm. A request cannot read another firm's records even if the client is tampered with.
• Role bands. Firm roles map to permission bands enforced at the application boundary and again by database policy.
• Sealed material. Documents marked sealed-restricted are limited to attorney-level roles. That restriction applies to search, retrieval, and the AI features alike — a staff query cannot return sealed content through any surface.
• File access. Uploaded documents are served through short-lived signed links scoped to the firm, never public URLs.
• Audit. Sensitive actions are recorded to an append-only audit log available to firm administrators.

8. Client portal users

Clients invited to a firm's portal sign in separately and see only the matters shared with them — status, scheduled events, and requests directed to them. Portal users never receive the firm's work product, internal discussion, or document record.

9. Cookies

We set only the cookies required for authentication and session management. We do not use advertising, analytics, or cross-site tracking cookies, so there is no consent banner and nothing to opt out of.

10. Retention and deletion

Firm content is retained for as long as the account is active. Deleted matters enter a recovery state for 30 days before permanent deletion, so an accidental deletion can be reversed; firm administrators can purge sooner from the application.

After an account terminates, firm content is deleted within 30 days, subject to any legal obligation to retain it. We will delete sooner on written request from a firm administrator. Operational logs are retained for a limited period for security and reliability purposes and are not used to reconstruct matter content.

11. Your choices and rights

Firm administrators can manage users and roles, mark material sealed, connect or remove a stored AI provider key, review the audit log, and export matter work product to Word or PDF at any time.

Because the firm is the controller of its client data, requests from a firm's clients to access, correct, or delete their information should be directed to the firm. We will support a firm in responding to any such request. Individual users may contact us directly about their own account information.

Data processing agreement. A DPA is available to firms that require one. Request it at privacy@casepalm.com.

12. International transfers

CasePalm is operated from the United States and its infrastructure providers process data in the United States. If your firm is subject to a data-protection regime that requires a specific transfer mechanism, contact us at privacy@casepalm.com and we will put appropriate terms in place before you upload client material.

13. Children

CasePalm is professional software for licensed attorneys and their staff. It is not directed to children and we do not knowingly collect information from them.

14. Changes to this policy

We will post material changes on this page and update the effective date above. Where a change materially reduces the protections described here, we will give notice to firm administrators before it takes effect.

15. Contact

Privacy questions, data requests, and DPA requests: privacy@casepalm.com. Formal legal notices: legal@casepalm.com.