[Operator name, LLC] ("we", "us") runs LawTime. This policy says what we keep, where, who can see it, and what we do not do.
1. What we keep
- Your firm and its people: firm name and address, each person's name, initials and email, a hashed form of their password, and whether they are an owner.
- Your firm's records: clients, matters, time entries, expenses and receipt images, rates, invoices and their PDFs, payments, and the notes you write in any of them. This includes client names and descriptions of work, which may be confidential. We treat all of it as your firm's confidential information.
- Feedback you send us from the Feedback link, with the page you were on.
- Usage numbers: when each person signs in, the last day each person used the Service, and counts of things such as bills finalized. Not what you looked at.
- Access logs kept by our hosting provider for security: the address your computer connects from and the pages requested, for up to [30] days.
2. What we do not do
- We do not sell, rent or share your data with anyone, except as section 4 says.
- We do not read your firm's records except to support you when you ask or to fix a fault, and we do not look at client names or descriptions of work when we can avoid it.
- We do not use advertising, tracking cookies, or third-party analytics. The only cookie is the one that keeps you signed in.
- We do not use your data to train anything.
3. Where it is and how it is protected
Your data is stored with Cloudflare, in data centres in [the United States]. Cloudflare encrypts stored data and every connection to the Service. Passwords are stored only as salted hashes, so neither we nor Cloudflare can read them. Every request is tied to the firm that is signed in, so one firm cannot see another's data. The database can be rolled back to any point in the previous 30 days if something goes wrong. Sign-in cookies cannot be read by scripts and expire.
No system is perfectly secure. The people who can reach your firm's data are the people in your firm, under the permissions the owner sets, and us as the operator of the Service. Cloudflare, as the host, holds the data under its own privacy policy and security commitments.
4. When we share
- Cloudflare, which hosts the Service and processes every request.
- If the law requires it: a court order, subpoena or lawful government request. We will tell the firm owner before we comply, where the law allows.
- If the Service changes hands: we will tell you before any transfer, and these commitments go with the data.
5. How long we keep it
While your firm's account is open. When the account closes, or on request, we delete the firm's data within [30] days; backups fall away within 30 days after that. Usage numbers that no longer identify anyone may be kept. We keep feedback until it is no longer useful.
6. Your rights
You can see and correct your firm's data in the Service at any time, export all of it, and ask us to delete it. People in a firm can correct their own name and email; the firm owner can remove a person. For anything else, write to [email address].
7. Children
The Service is for professional practices and is not meant for anyone under 18.
8. Changes
We may change this policy. We will post the new version in the Service and email the firm owner at least 30 days before a material change takes effect.
9. Contact
[email address]
Last updated: [date] · [Operator name, LLC]