Privacy Policy

1. Who We Are

Legalbit (“we,” “our,” or “us”) operates an AI-powered platform that connects individuals with legal needs to qualified law firms (the “Services”). Legalbit is not a law firm, we are not attorneys, and we do not provide legal or other professional advice.

2. Definitions

This Privacy Policy applies to all users of the Platform. Where a provision applies only to a specific role, that role is named explicitly:

• “Member” — a user of Legalbit who is seeking legal help.
• “Firm”— a law firm or legal professional registered on Legalbit to receive and respond to Members’ legal help requests, also referred to as “leads.”
• “User” — any person who accesses the Platform, including Members, Firms, and visitors.
• “You” or “you” — refers to Users of our Platform and/or Services.
• “Platform” — refers to the internet sites, applications, and other electronic systems, including but not limited to legalbit.ai, through which we offer and provide the Services.

3. Acceptance of Terms

This privacy policy (“Privacy Policy”) explains how we collect, process, store and share personal information you provide to us and to assist you in making informed decisions when using our Platform and/or Services. “You” or “you” refers to users of our Services and/or Platform. This Privacy Policy does not apply to personal information that we collect from employees or job applicants to Legalbit in connection with their employment or potential employment at or with Legalbit.

By accessing or using our Platform or Services, or by providing personal information to us, you acknowledge that you accept our privacy practices and policies outlined below, as well as our Terms of Service, and you consent that we may collect, process, store, and share personal information as described in this Privacy Policy.

4. Information We Collect

4.1 Information Provided by Members

• Account information: email address, full name, and phone number at account creation.
• Case information: legal issue descriptions, follow-up answers, and any details provided during the intake process. Such information may include, but is not limited to, identification information (government issued ID, social security number, passport), employment information, work history, income, insurance policy information, outstanding or previously paid financial obligations, health related information, pictures, videos, messages, recordings, and any other information you choose to provide.
• Communications: messages sent to Firms through the Platform, and any messages sent through the support or help chat system.
• Reviews and feedback: ratings and comments submitted about Firms, and any Platform feedback provided.
• Legalbit collects information directly from Users. Legalbit does not independently verify the accuracy of information submitted by Users and does not guarantee the completeness or reliability of any account or case information.
• Case information submitted by Members may include sensitive personal data depending on the nature of the legal issue. Such information is processed solely for the purpose of facilitating connections with Firms and is subject to the retention and deletion practices described below.
• You are under no obligation to provide personal information to us. However, if you do not provide information required to access the Platform or for us to provide the Services, verify your identity, or process transactions, we may be unable to offer access to the Platform, provide certain Services, or otherwise conduct business with you.

4.2 Information Provided by Firms

• Account information: email address and password at registration.
• Firm profile: firm name, practice areas, jurisdictions served, firm description, fee structure, response SLA, Google Maps URL (used to display Google review ratings), and other profile details.
• Team member information: email addresses of invited team members.
• Payment information: the billing details we use to bill you for our Services, your billing and payment history, and any records relating to any property (real or personal) that we collect in connection with our Services. Firms add a payment method via Stripe. Legalbit does not store credit card numbers.
• Communications: messages sent to Members through the Platform, and any messages sent through the support or help chat system.

4.3 Information Collected Automatically

• Session data:an anonymous session identifier (stored as a browser cookie) is used to track Member intake progress before account creation. This session is linked to the Member’s account if they later sign up.
• Analytics events: aggregated and anonymized usage data (e.g., intake completion rates, feature usage) collected from all Users.
• Device and browser information: information automatically collected through cookies and similar technologies used on our Platform, including but not limited to standard web server logs including IP address with approximate geolocation, operating system, browser type, device information, and referring pages.
• Email verification status:we track whether a Member’s email address has been verified to ensure the integrity of leads sent to Firms.

4.4 Information from Third Parties

• Payment processors: we receive confirmation of payment status from Stripe for Firm billing. We do not store credit card numbers.
• Google Places API:for Firms that provide a Google Maps URL, we retrieve and cache the Firm’s Google review rating and review count. We do not access any Google user data.

5. How We Use Information

5.1 Member Information

• AI-powered case classification:the Member’s legal issue description is processed by our AI system to classify the case, generate follow-up questions, and create a structured case brief.
• Firm matching: the case brief is used to match the Member with qualified Firms based on practice area, jurisdiction, and other relevant factors.
• Communication: to facilitate messaging between the Member and their selected Firm.
• Notifications: to send in-app and email notifications about case updates, Firm responses, and account activity.

5.2 Firm Information

• Lead delivery: Firm profile data (practice areas, jurisdictions, capacity) is used by the matching algorithm to determine which Firms are shown to Members.
• Billing: payment method information is used to charge per-lead fees via Stripe when a Firm sends a substantive first response.
• Notifications: to send in-app and email notifications about new leads, SLA deadlines, billing events, and account activity.

5.3 All Users

• Providing and improving our Services:we process and share limited categories of information, including but not limited to, contact information, professional information, commercial information, internet and device information with approximate geolocation, or other collected information for our internal research and development purposes and to troubleshoot, test, and conduct data analysis, to update and otherwise improve the Platform’s functionality, and to make informed business decisions for the improvement of the Services and the User experience on the Platform.
• Platform improvement: anonymized and aggregated data is used to improve matching algorithms, AI quality, and overall platform experience.
• Support: to respond to help requests submitted through the support chat system.

5.4 Legal Basis for Processing

• We process personal data under the following legal bases: where we have your consent to do so; where we need to comply with a legal obligation; where we need the personal information to perform a contract with you (e.g., responding to an inquiry that may lead to engagement); and where the processing is in our legitimate interests and not overridden by your data protection interests or fundamental rights and freedoms (e.g., for website analytics, security).

6. How We Protect Information

6.1 Encryption

• In transit: all connections use TLS 1.2 or higher.
• At rest: our database provider encrypts all data at rest using AES-256.
• Application-level encryption:sensitive Member personal information (full name and phone number) is encrypted with AES-256-GCM at the application level before storage. This data is only decrypted when needed — for example, when sharing a Member’s contact information with a Firm.

6.2 Member Identity Protection

A Member’s personal contact information (name, phone, email) remains hidden from Firms until both of the following conditions are met:

• The Member explicitly selects a Firm and consents to sharing their case brief.
• The Firm sends a substantive first response, triggering a billing event.

Before these conditions are met, Firms see only the case brief with no personal contact information. Firm names and public profile information (including Google review ratings, where available) are visible to Members during the selection process.

6.3 Access Controls

We use Row Level Security (RLS) policies on all database tables. Members can only access their own data. Firms can only access leads assigned to them. Administrative access is restricted to authorized personnel.

6.4 No Guarantee

Despite our efforts to ensure security, we cannot guarantee or warrant that personal information will not be accessed, acquired, or disclosed for an improper purpose, or otherwise altered or destroyed by an unauthorized person. We cannot guarantee that a breach of our security safeguards or those of our hosting provider or other vendors or service providers will not occur. We cannot ensure the security of any data transmitted to us over the Internet. To the fullest extent permitted by applicable law, we accept no liability for any unintentional disclosure of personal information and encourage you to take adequate precautions to protect your personal information, including but not limited to never sharing your account username or password with others.

7. Artificial Intelligence (AI) Processing

We use AI to process Member legal issue descriptions. Specifically:

• The Member’s description is sent to the AI to generate structured follow-up questions and a case brief.
• The AI classifies the case type, jurisdiction, urgency, and documentation status.
• The AI does not provide legal advice or assess the legal merits of any case. AI-generated outputs are provided for informational and organizational purposes only. Legalbit does not guarantee the accuracy, completeness, or reliability of AI-generated classifications or summaries. Users should not rely on AI-generated content as a substitute for professional legal advice.
• If the AI detects safety concerns (e.g., domestic violence, active threats), crisis resources are displayed to the Member immediately.

8. Information Sharing

8.1 Between Members and Firms

A Member’s case information is shared only with the Firm(s) the Member explicitly selects. The Member’s contact information is shared only after the billing event triggers. Firm profile information (name, practice areas, Google rating) is visible to Members during matching.

8.2 With Service Providers

We use third-party service providers to operate the Platform. Providers that directly process User data include Stripe (payment processing for Firms) and Google (Places API for Firm review ratings). These providers process data according to their own privacy policies and our data processing agreements.

8.3 Legal Requirements

We may disclose information if required by law, subpoena, or court order.

We do not, ever, sell any User’s personal information to third parties.

8.4 Business Transfers

In the event of a merger, acquisition, financing, or sale of assets, User information may be transferred as part of that transaction. We will ensure that any such transfer is subject to appropriate confidentiality protections.

9. Data Retention

Data storage within Legalbit is subject to Legalbit’s data retention policy as described in this section.

9.1 Routine Purging

The retention periods above reflect Legalbit’s routine data minimization schedule, applied uniformly to all accounts. Intake descriptions, AI transcripts, and case information content are automatically and irreversibly purged after 30 days. Structured classification metadata (practice area, jurisdiction, urgency) and billing records are retained as indicated above.

9.2 Legal Hold Exception

If Legalbit receives a legal preservation demand — including a litigation hold notice, subpoena, court order, regulatory inquiry, or other binding legal process — routine purging is suspended for any records specifically identified in that demand. The suspension remains in effect until the hold is formally released or the legal process concludes. This exception applies only to the specific records identified; it does not extend retention for unrelated data. Legalbit will notify affected Users of a legal hold to the extent permitted by law.

10. User Rights

10.1 Access and Correction

All Users can view and update their personal information at any time through their account profile settings.

10.2 Data Deletion

Members can request deletion of their account and all associated data from their account settings page. When a Member requests deletion:

• Personal information (name, phone) is immediately wiped and the account is hidden (soft delete).
• After a 30-day grace period, the account is permanently deleted and the email is anonymized.
• Billing records are retained for 7 years as required by law.
• Anonymized analytics data is retained but can no longer be linked to the Member.

Firms may request account deletion by contacting us at the email address below. Incomplete Firm registrations (accounts that do not complete onboarding within 7 days) are automatically deleted to free the associated email for re-registration.

10.3 Data Portability

Members and Firms may request an export of their data by contacting us at the email address below. Legalbit may require verification of a User’s identity before fulfilling requests to access, delete, or export personal data.

You may submit a request yourself or through an authorized agent. To make a request through an authorized agent, you must provide your authorized agent with a written authorization and specify what requests the authorized agent is authorized to make. We may deny a request by a claimed authorized agent without the proper written proof of authorization.

In some instances, we may not be able to legally or feasibly honor your request. We will advise you in our response if we are not able to honor your request.

You may submit a request using the following method:

• Send an email to: legal@legalbit.ai.

11. State-Specific Privacy Rights

11.1 California (CCPA/CPRA)

If a User is a California resident, the California Consumer Privacy Act (as amended by the California Privacy Rights Act) provides additional rights:

• Right to know: California residents may request the categories and specific pieces of personal information Legalbit has collected, the sources of that information, the business purpose for collecting it, and the categories of third parties with whom it is shared.
• Right to delete: California residents may request deletion of their personal information, subject to certain exceptions (e.g., legal compliance, completing a transaction).
• Right to correct: California residents may request correction of inaccurate personal information.
• Right to opt out of sale or sharing: Legalbit does not sell personal information to third parties, and does not share personal information for cross-context behavioral advertising. Therefore, there is nothing to opt out of.
• Right to non-discrimination: Legalbit will not discriminate against any User for exercising their privacy rights.

Categories of personal information collected(as defined by the CCPA): identifiers (name, email, phone), internet or electronic network activity (session data, analytics), and professional information (for Firm accounts: practice areas, jurisdictions). We do not collect sensitive personal information as defined by the CPRA, except to the extent that a Member’s legal issue description may contain such information, which is subject to the 30-day automatic purge described in Section 9.

To submit a request, California residents may contact us at the email address in Section 15. Legalbit will verify the requestor’s identity before processing the request and will respond within 45 days.

11.2 Texas (TDPSA)

Under the Texas Data Privacy and Security Act, Texas residents have the right to:

• Confirm whether Legalbit is processing their personal data and access that data.
• Correct inaccuracies in their personal data.
• Delete their personal data.
• Obtain a portable copy of their personal data.
• Opt out of the processing of personal data for targeted advertising, the sale of personal data, or profiling that produces legal or similarly significant effects.

Legalbit does not sell personal data, does not engage in targeted advertising, and does not profile Users in a manner that produces legal or similarly significant effects. To exercise any of these rights, contact us at the email address in Section 15. If a request is denied, Texas residents may appeal by contacting us with the subject line “TDPSA Appeal.”

Texas residents may lodge a complaint at https://consumerprotection.texasattorneygeneral.gov/consumercomplaintportal/s/.

11.3 Virginia, Colorado, Connecticut, and Other States

Residents of Virginia (VCDPA), Colorado (CPA), Connecticut (CTDPA), and other states with comprehensive consumer privacy laws have substantially similar rights to those described above, including the rights to access, correct, delete, and obtain a portable copy of personal data, and to opt out of the sale of personal data or targeted advertising. Legalbit does not sell personal data or engage in targeted advertising.

To exercise any privacy right under applicable state law, contact us at the email address in Section 15. We will respond within the timeframe required by the applicable law. If a request is denied, Users may appeal by contacting us with the subject line “Privacy Rights Appeal.”

12. Cookies and Tracking

We use essential cookies for authentication, session management, and anonymous intake tracking (a session identifier cookie links a Member’s intake progress to their account if they later sign up). We use Cloudflare Turnstile for bot protection. We do not use third-party advertising trackers. Users may control cookies through their browser settings. Disabling certain cookies may affect the functionality of the Platform.

13. Children’s Privacy

Legalbit is not intended for use by individuals under 18 years of age. We do not knowingly collect information from anyone under 18 years of age.

14. Changes to This Policy

We reserve the right to amend this Privacy Policy at our discretion and at any time. Any changes will be accompanied by a new “Last Updated” date. We may, but are not required to, provide You with notice of the change in the Privacy Policy via any means we consider reasonable, including but not limited to email. Continued use of the Platform or Services after changes take effect constitutes acceptance of the updated Privacy Policy. We encourage You to visit this page regularly for any changes.

15. Contact Us

If Members, Firms, or other Users have questions about this privacy policy or their data, contact us at:

Email: legal@legalbit.ai

16. International Data Transfers

Legalbit operates in the United States. If Users access the Platform from outside the United States, their information may be transferred to and processed in the United States, where data protection laws may differ from those in their jurisdiction.