Privacy Policy

This Privacy Policy explains how CaseLumen, LLC ("CaseLumen", "we", "us", or "our") collects, uses, and protects information in connection with the CaseLumen legal practice management platform (the "Service"). CaseLumen is built for law firms, so much of the data in the Service is entered by your firm about its clients and matters — this policy explains how we handle it.

We collect information you and your firm provide when you:

• Create an account (name, email, and — where applicable — role, phone, and bar number)
• Set up your firm profile and connect integrations (firm details, Microsoft 365 configuration)
• Enter matter, client, contact, calendar, and financial data into the Service
• Upload documents or send secure client upload links
• Contact us for support

We also collect usage data — such as log files, IP addresses, and browser information — to operate, secure, and improve the Service.

We use your information to:

• Provide, operate, and maintain the Service
• Process billing and subscriptions through our payment processor (Stripe)
• Send transactional email (account notifications, invoices, and upload links)
• Provide AI-assisted features that your firm chooses to enable
• Respond to support requests
• Monitor and improve performance and security

CaseLumen deliberately keeps your most sensitive information in your own environment. Your data lives in a few distinct places:

• Case data in our database. Matter and contact details, dates, parties, damages, financial and trust-ledger entries, user accounts, and activity logs are stored in CaseLumen's database.
• Documents and calendars in your Microsoft 365 tenant. When you connect Microsoft 365, case documents are stored in your firm's own SharePoint libraries and case dates sync to your firm's Outlook calendar. CaseLumen accesses them on your behalf using app-only credentials you provide — we store only references (folder IDs and links), not the files themselves.
• Encrypted backups and temporary staging in Cloudflare R2. Encrypted database backups are stored in Cloudflare R2. Files uploaded through client upload links are briefly staged in Cloudflare R2 before they are moved into your SharePoint and then removed.

CaseLumen offers optional AI features powered by Anthropic's Claude API — for example, extracting requests from a defense discovery PDF, identifying court dates, and analyzing meet-and-confer responses. When you use these features, the relevant document is sent to the Claude API for processing.

• Under Anthropic's API terms, your data is not used to train AI models.
• Every AI draft is reviewed by an attorney before it is finalized.
• AI features can be turned on or off per firm at any time.

We do not sell, trade, or rent your information. We share data only with trusted service providers who help us operate the Service, under confidentiality obligations:

• Stripe — subscription billing (card details are handled by Stripe; we do not store them)
• Resend — transactional email delivery
• WorkOS — authentication and single sign-on
• Microsoft 365 — document storage and calendar in your firm's own tenant
• Anthropic — the Claude API that powers AI-assisted features
• Cloudflare R2 — encrypted database backups and temporary upload staging

We understand that data stored in CaseLumen may include privileged attorney-client communications. We treat all such data as strictly confidential and do not access it except to provide technical support when you expressly authorize us to do so.

We apply layered safeguards, including:

• Encryption in transit (TLS) and encryption of sensitive fields at rest in our database
• Strict per-firm data isolation, so one firm can never see another firm's data
• Role-based access control enforced on every action
• A full activity audit trail of creates, updates, and deletes
• Encrypted database backups

No method of transmission or storage is ever 100% secure, but we work to protect your data at every layer.

We retain your data while your account is active. After cancellation, your firm's data is retained for 90 days to allow for export, after which it may be permanently deleted. Activity-log records are retained for approximately one year, and temporarily staged upload files are removed shortly after they reach your SharePoint.

You may request to:

• Access a copy of your data
• Correct inaccurate data
• Delete your account and associated data
• Export your firm's data in a portable format

To exercise these rights, contact us at privacy@caselumen.com.

We use session cookies required for authentication and application functionality. We do not use tracking or advertising cookies.

We may update this Privacy Policy periodically. We will notify you of significant changes by email or through a notice in the application.

Privacy-related questions should be directed to privacy@caselumen.com.