Privacy Policy

This Privacy Policy explains how CaseLumen, LLC ("CaseLumen", "we", "us", or "our") collects, uses, and protects information in connection with the CaseLumen legal practice management platform (the "Service"). CaseLumen is built for law firms, so much of the data in the Service is entered by your firm about its clients and matters — this policy explains how we handle it.

We collect information you and your firm provide when you:

• Create an account (name, email, and — where applicable — role, phone, and bar number)
• Set up your firm profile and connect integrations (firm details, Microsoft 365 or Google Workspace configuration)
• Enter matter, client, contact, calendar, and financial data into the Service
• Upload documents or send secure client upload links
• Send data to the Service through the CaseLumen API with a key your firm creates (for example, leads from your firm's website contact form)
• Contact us for support or sales, or book a demo
• Ask us to email a copy of a public tool result (for example, a settlement disbursement estimate)

We also collect usage data — such as log files, IP addresses, and browser information — to operate, secure, and improve the Service.

We use your information to:

• Provide, operate, and maintain the Service
• Process billing and subscriptions through our payment processor (Stripe)
• Send transactional email (account notifications, invoices, and upload links)
• Provide AI-assisted features that your firm chooses to enable
• Respond to support and sales inquiries, and follow up when you ask us to email a tool result
• Monitor and improve performance and security

Matter data lives in CaseLumen. Case files and calendars live in your firm's Microsoft 365 tenant or Google Workspace when you connect one. In more detail:

• Case data in our database. Matter and contact details, dates, parties, damages, financial and trust-ledger entries, user accounts, and activity logs are stored in CaseLumen's database, on servers we run at Vultr.
• Documents and calendars in your Microsoft 365 or Google Workspace. When you connect Microsoft 365, case documents are stored in your firm's own SharePoint libraries and case dates sync to your firm's Outlook calendar; CaseLumen accesses them on your behalf using app-only credentials you provide. When you connect Google Workspace, case documents are stored in a Shared Drive and case dates sync to a Google Calendar that your firm shares with CaseLumen's service account. Either way, we store only references (folder, file and event IDs and links), not the files themselves, except as described in the next item.
• Encrypted backups, cost receipts, Counsel Exchange downloads, and temporary staging in Cloudflare R2. Encrypted database backups are stored in Cloudflare R2. Cost receipts attached to expenses are stored in Cloudflare R2. Files uploaded through client upload links are briefly staged in Cloudflare R2 before they are moved into your SharePoint or Google Drive and then removed. When you share a Counsel Exchange package, its "Download all" ZIP — and, for firms on Google Workspace, a copy of each shared file — is stored in Cloudflare R2 so opposing counsel can download it, and is deleted after the package expires or is revoked.

CaseLumen offers optional AI features powered by Anthropic's Claude API — for example, extracting requests from a defense discovery PDF, identifying court dates, and analyzing meet-and-confer responses. When you use these features, the relevant document is sent to the Claude API for processing.

• Under Anthropic's API terms, your data is not used to train AI models.
• Suggested dates and drafts stay in a review state until someone on your team confirms or finalizes them.
• AI features can be turned on or off per firm at any time.

We do not sell, trade, or rent your information. We share data only with trusted service providers who help us operate the Service, under confidentiality obligations:

• Stripe — subscription billing (card details are handled by Stripe; we do not store them)
• Resend — transactional email delivery
• WorkOS — authentication (SAML single sign-on is on the Enterprise roadmap)
• Microsoft 365 — document storage and calendar in your firm's own tenant, when you connect it
• Google Workspace — document storage and calendar in your firm's own Google Workspace, when you connect it
• Anthropic — the Claude API that powers AI-assisted features
• Cloudflare R2 — encrypted database backups, cost receipts, Counsel Exchange downloads, and temporary upload staging
• Vultr — hosting for the servers that run the Service and its database
• Laravel Forge — server provisioning and deployment for those servers

Our public marketing website also uses:

• Umami — privacy-friendly website analytics (page views and button clicks, without cookies or cross-site tracking)
• Cal.com — scheduling, when you book a demo; Cal.com receives the details you enter in the booking form
• Bunny Fonts — web font delivery, which sees your IP address when it serves a font

We understand that data stored in CaseLumen may include privileged attorney-client communications. We treat all such data as strictly confidential. Operator access for technical support requires a written reason, is time-limited, and is logged. We do not use firm data for any other purpose.

We apply layered safeguards, including:

• Encryption in transit (TLS) and encryption of sensitive fields (Microsoft credentials, SSN last-4, and document folder links) at rest in our database
• Strict per-firm data isolation, so one firm can never see another firm's data
• Role-based access control enforced on every action
• A full activity audit trail of creates, updates, and deletes
• Encrypted database backups

No method of transmission or storage is ever 100% secure, but we work to protect your data at every layer.

We retain your data while your account is active. After cancellation, your firm's data is retained for 90 days so you can request an export, after which it may be permanently deleted. Activity-log records are retained to support the audit trail while your account is active. Temporarily staged upload files are removed shortly after they reach your SharePoint or Google Drive. Counsel Exchange files and ZIPs stored for opposing counsel are deleted within a day after the package expires or is revoked.

You may request to:

• Access a copy of your data
• Correct inaccurate data
• Delete your account and associated data
• Request an export of your firm's data

To exercise these rights, contact us at privacy@caselumen.com.

We use session cookies required for authentication and application functionality. When you arrive from a campaign link, we store the campaign parameters on the URL (such as utm_source) in your session so we can attribute a later trial or inquiry to that campaign. That is first-party session data, not a third-party advertising cookie. Our website analytics (Umami) do not set cookies. If you open the demo booking window, Cal.com may set cookies as described in its own privacy policy.

Advertising conversion tags (for example Google Ads) are off by default. If we enable them to measure paid campaigns, Google may set additional cookies as described in Google's policies. We will not load those tags unless advertising measurement is turned on.

We may update this Privacy Policy periodically. We will notify you of significant changes by email or through a notice in the application.

Privacy-related questions should be directed to privacy@caselumen.com.