PrivacyPolicy
Your data, your control. Here's exactly how we handle it.
Effective date: August 2, 2026 | Last updated: September 30, 2026
Ourprivacyprinciples
We never sell your data
Your firm's information is never sold, shared for marketing, or used to train third-party models.
Enterprise-grade security
AES-256 encryption at rest, TLS 1.3 in transit, per-tenant isolation, and immutable audit logs.
Full transparency
You control what data is collected, how it's used, and can export or delete everything at any time.
Data residency options
Choose US or EU data centers to comply with your jurisdiction's requirements.
Our commitment
FernLex processes protected legal information with the same care and confidentiality that attorneys apply to their clients' matters. We are committed to privacy by design—minimizing data collection, enforcing strict access controls, and maintaining full transparency about our practices.
This privacy policy explains what personal information we collect, how we use it, the legal bases for processing, how long we retain it, and the rights you have regarding your data. We comply with the General Data Protection Regulation (GDPR), the California Consumer Privacy Act (CCPA), and other applicable privacy laws.
Data we collect
We collect only what's necessary to operate the platform and deliver AI-powered legal workflows. The table below details each category, its purpose, legal basis, and retention period:
| Category | Data Elements | Purpose | Legal Basis | Retention |
|---|---|---|---|---|
| Account & Identity | Name, email address, firm name, role, permission settings | Account creation, authentication, RBAC enforcement | Contract performance | Duration of account + 30 days |
| Authentication & Security | Password (bcrypt-hashed), 2FA secrets, backup codes, login IP, user agent, geolocation | Account security, fraud prevention, audit logging | Contract performance, legitimate interest | Duration of account + 7 years (audit trail) |
| Client PII (Immigration) | SSN, passport number, alien/A-number, driver's license, visa number, tax ID, DOB, nationality, address | Immigration form processing, case management | Contract performance, legal obligation | Duration of case + 7 years |
| Workspace Data | Matters, documents, contacts, notes, communications | Core platform functionality, AI-powered workflows | Contract performance | Duration of account (user-controlled deletion) |
| Email & Calendar Data | Email content, attachments, calendar events, meeting recordings (via OAuth) | Email intelligence, scheduling, case-linking | Consent (OAuth authorization) | Duration of integration (user can disconnect anytime) |
| Usage & Analytics | Feature interactions, AI activity logs, device/browser info, IP address | Product improvement, performance monitoring, security | Legitimate interest | 12 months (anonymized after 90 days) |
| Payment Information | Billing address, subscription plan, payment status (card numbers handled by Stripe) | Subscription billing, invoicing, trust accounting | Contract performance, legal obligation | Duration of account + 7 years (financial records) |
| Intake Form Data | Prospective client information, document uploads, consent confirmations | Client intake, case assessment, conflict checks | Consent, pre-contractual steps | Until conversion or 90 days (whichever is earlier) |
| OAuth & Integration Tokens | Access/refresh tokens for Gmail, Outlook, Google Calendar, Zoom, Google Drive, Dropbox | Third-party integrations you authorize | Consent | Duration of integration (revocable anytime) |
How we use data
Your data powers your firm's AI employees. We use it to deliver the service and improve your experience:
- Deliver and improve AI-powered legal workflows
- Process documents, emails, and communications you authorize
- Generate matter intelligence, timelines, and risk scores
- Provide customer support and respond to inquiries
- Ensure security through audit logging and anomaly detection
- Comply with legal obligations and enforce terms of service
AI & model training
Your data is never used to train AI models.
AI processing is performed within your isolated workspace using models from OpenAI (routed via OpenClaw gateway). All AI providers are configured with zero data retention—we do not use your documents, communications, or matter data to train or improve general-purpose AI models. PII is minimized and redacted before being sent to AI providers. Any AI signals are processed solely to deliver intelligence to your firm.
Security
We implement multiple layers of security to protect your data:
Encryption at Rest
AES-256-GCM for all PII, OAuth tokens, 2FA secrets, and API credentials with versioned key management
Encryption in Transit
TLS 1.3 for all API communications, HTTPS enforced via HSTS
Audit Logging
Immutable compliance audit trail with checksums, 7-year retention
Access Controls
10-role RBAC, PostgreSQL Row-Level Security on all tables, per-tenant isolation
Authentication
NextAuth JWT sessions, bcrypt password hashing, TOTP-based 2FA with backup codes
Rate Limiting
Redis-based rate limiting on auth endpoints, API routes, and intake forms
Data sharing
We never sell your data. We only share it with service providers that help us operate the platform, and only to the extent necessary to provide their services:
| Service | Provider | Purpose |
|---|---|---|
| Payment Processing | Stripe | Secure payment handling, subscriptions, Connect |
| Email Sync | Gmail API / Microsoft Graph | Bidirectional email and calendar sync |
| SMS Messaging | Twilio | SMS notifications and client communication |
| Cloud Storage | Google Drive / Dropbox | Document storage and sync |
| Video Conferencing | Zoom / Google Meet | Meeting creation and recording |
| Web Analytics | Google Analytics (GA4) | Aggregated site usage statistics — only after you accept analytics cookies |
| Product Analytics | Mixpanel | Product usage insights and session recording — all text and inputs are masked in recordings — only after you accept analytics cookies |
We may also disclose personal information if required by valid legal process, or to protect the rights, property, or safety of FernLex, our customers, or others. We will notify you unless prohibited by law and will challenge overbroad requests.
Data residency
Choose where your data lives
We offer data centers in the United States and European Union, allowing you to comply with jurisdictional requirements like GDPR and state privacy laws. Your firm's data is isolated within your chosen region and is never transferred between regions without your explicit consent.
International transfers
If you access the platform from outside the United States, your information may be transferred to and processed in the United States. We ensure appropriate safeguards are in place for such transfers:
- Standard Contractual Clauses (SCCs) approved by the European Commission for EU/EEA transfers
- Data Processing Agreements (DPAs) with all sub-processors that handle personal data
- Your right to choose EU data residency to avoid cross-border transfers entirely
- All AI processing occurs within your selected data region
Data retention
We retain your personal information only for as long as necessary to fulfill the purposes for which it was collected, or as required by law:
| Data Category | Retention Period | Legal Basis |
|---|---|---|
| Account Data | Duration of active account + 30 days after deletion | Contract performance |
| Client PII | Duration of case + 7 years (legal hold may extend) | Legal obligation, contract performance |
| Audit Trail Events | 7 years (2,555 days), immutable with checksums | Legal obligation (compliance) |
| Financial Records | 7 years (invoices, payments, trust accounting) | Legal obligation (tax/accounting) |
| Intake Forms | Until conversion or 90 days | Consent, pre-contractual steps |
| OAuth Tokens | Duration of integration (revocable anytime) | Consent |
| Support Tickets | 3 years from resolution | Legitimate interest |
Your rights
You have full control over your data. Depending on your jurisdiction, you may exercise the following rights:
Access
Request a copy of all personal data we hold about you
Rectification
Request correction of inaccurate or incomplete data
Erasure
Request deletion of your personal data (subject to legal obligations)
Restriction
Request restriction of processing in certain circumstances
Portability
Export your data in machine-readable, standard formats
Objection
Object to processing based on legitimate interests
Withdraw Consent
Withdraw consent for processing at any time (where consent is the legal basis)
Lodge Complaint
File a complaint with your local data protection authority
To exercise any of these rights, contact us at privacy@fernlex.com. We will respond within 30 days.
Children's privacy
FernLex is not directed to individuals under 18. We do not knowingly collect personal information from children. If we become aware that we have collected personal information from a child, we will delete it promptly.
Business transfers
If FernLex is acquired, merged, or undergoes a business transfer, your personal information may be transferred to the successor entity. We will notify you before your information is transferred and becomes subject to a different privacy policy. Any successor entity will be bound by the terms of this policy unless you consent otherwise.
Changes to this policy
We will notify you of material changes to this policy via email or in-app notification at least 30 days before they take effect. Continued use of the platform after changes take effect constitutes acceptance of the updated policy. If you do not agree to the changes, you may delete your account.
Contact us
For privacy-related inquiries, data requests, or to exercise your rights:
privacy@fernlex.com
We respond within 30 days
If you have an unresolved privacy concern that we have not addressed satisfactorily, you may lodge a complaint with your local data protection authority. For EU residents, a list of authorities is available at https://edpb.europa.eu/about-edpb/our-members_en.
Ready to put AI to work?
Start your free trial and see FernLex transform how your firm operates.