Privacy Policy

This Privacy Policy explains how CaseLumen, LLC ("CaseLumen", "we", "us", or "our") collects, uses, and protects information in connection with the CaseLumen legal practice management platform (the "Service"). CaseLumen is built for law firms, so much of the data in the Service is entered by your firm about its clients and matters — this policy explains how we handle it.

We collect information you and your firm provide when you:

• Create an account (name, email, and — where applicable — role, phone, and bar number)
• Set up your firm profile and connect integrations (firm details, Microsoft 365 configuration)
• Enter matter, client, contact, calendar, and financial data into the Service
• Upload documents or send secure client upload links
• Contact us for support or sales
• Ask us to email a copy of a public tool result (for example, a settlement disbursement estimate)

We also collect usage data — such as log files, IP addresses, and browser information — to operate, secure, and improve the Service.

We use your information to:

• Provide, operate, and maintain the Service
• Process billing and subscriptions through our payment processor (Stripe)
• Send transactional email (account notifications, invoices, and upload links)
• Provide AI-assisted features that your firm chooses to enable
• Respond to support and sales inquiries, and follow up when you ask us to email a tool result
• Monitor and improve performance and security

Matter data lives in CaseLumen. Case files and calendars live in your Microsoft 365 tenant when you connect it. In more detail:

• Case data in our database. Matter and contact details, dates, parties, damages, financial and trust-ledger entries, user accounts, and activity logs are stored in CaseLumen's database.
• Documents and calendars in your Microsoft 365 tenant. When you connect Microsoft 365, case documents are stored in your firm's own SharePoint libraries and case dates sync to your firm's Outlook calendar. CaseLumen accesses them on your behalf using app-only credentials you provide — we store only references (folder IDs and links), not the files themselves.
• Encrypted backups, cost receipts, and temporary staging in Cloudflare R2. Encrypted database backups are stored in Cloudflare R2. Cost receipts attached to expenses are stored in Cloudflare R2. Files uploaded through client upload links are briefly staged in Cloudflare R2 before they are moved into your SharePoint and then removed.

CaseLumen offers optional AI features powered by Anthropic's Claude API — for example, extracting requests from a defense discovery PDF, identifying court dates, and analyzing meet-and-confer responses. When you use these features, the relevant document is sent to the Claude API for processing.

• Under Anthropic's API terms, your data is not used to train AI models.
• Suggested dates and drafts stay in a review state until someone on your team confirms or finalizes them.
• AI features can be turned on or off per firm at any time.

We do not sell, trade, or rent your information. We share data only with trusted service providers who help us operate the Service, under confidentiality obligations:

• Stripe — subscription billing (card details are handled by Stripe; we do not store them)
• Resend — transactional email delivery
• WorkOS — authentication (SAML single sign-on is on the Enterprise roadmap)
• Microsoft 365 — document storage and calendar in your firm's own tenant
• Anthropic — the Claude API that powers AI-assisted features
• Cloudflare R2 — encrypted database backups, cost receipts, and temporary upload staging

We understand that data stored in CaseLumen may include privileged attorney-client communications. We treat all such data as strictly confidential. Operator access for technical support requires a written reason, is time-limited, and is logged. We do not use firm data for any other purpose.

We apply layered safeguards, including:

• Encryption in transit (TLS) and encryption of sensitive fields (Microsoft credentials, SSN last-4, and SharePoint folder URLs) at rest in our database
• Strict per-firm data isolation, so one firm can never see another firm's data
• Role-based access control enforced on every action
• A full activity audit trail of creates, updates, and deletes
• Encrypted database backups

No method of transmission or storage is ever 100% secure, but we work to protect your data at every layer.

We retain your data while your account is active. After cancellation, your firm's data is retained for 90 days so you can request an export, after which it may be permanently deleted. Activity-log records are retained to support the audit trail while your account is active. Temporarily staged upload files are removed shortly after they reach your SharePoint.

You may request to:

• Access a copy of your data
• Correct inaccurate data
• Delete your account and associated data
• Request an export of your firm's data

To exercise these rights, contact us at privacy@caselumen.com.

We use session cookies required for authentication and application functionality. When you arrive from a campaign link, we store the campaign parameters on the URL (such as utm_source) in your session so we can attribute a later trial or inquiry to that campaign. That is first-party session data, not a third-party advertising cookie.

Advertising conversion tags (for example Google Ads) are off by default. If we enable them to measure paid campaigns, Google may set additional cookies as described in Google's policies. We will not load those tags unless advertising measurement is turned on.

We may update this Privacy Policy periodically. We will notify you of significant changes by email or through a notice in the application.

Privacy-related questions should be directed to privacy@caselumen.com.