Privacy Policy

1. Information We Collect

1.1 Account Information

When you create an account, we collect:

• Required: Email address, password (stored only in hashed form using PBKDF2 with 600,000 iterations)
• Optional: Display name, phone number (for two-factor authentication)
• Professional credentials: Utah State Bar number (for attorney verification, if provided)
• Organization information: Firm name, role (optional)

1.2 Documents and Case Materials

To provide our legal intelligence services, we process:

• Legal documents you upload to case silos (motions, oppositions, pleadings, exhibits)
• Text content submitted for citation verification, drafting, or analysis
• Case metadata including case numbers, court information, and party names
• Notes, annotations, and work product you create within the platform
• BenchSlap-generated responses and drafted documents

1.3 Usage Information

We automatically collect certain technical information:

• Device data: Browser type, operating system, device identifiers
• Log data: IP addresses, access times, pages viewed, referring URLs
• Feature usage: Which tools you use, frequency and patterns of use
• Performance data: Response times, error logs, crash reports
• Session data: Duration, timestamps, authentication events

1.4 Payment Information

Payment processing is handled by Stripe. We do NOT store complete credit card numbers. We receive only:

• Last 4 digits of card number (for display purposes)
• Card expiration date and type
• Billing address
• Transaction history and subscription status

2. How We Use Your Information

3. Data Storage and Security

3.1 Infrastructure

Your data is stored on secure, enterprise-grade cloud infrastructure:

• Hosting: DigitalOcean production servers (US-based data centers)
• Database: DigitalOcean Managed PostgreSQL with automated backups
• File Storage: DigitalOcean Spaces with encryption at rest
• Caching: Redis with encrypted connections

3.2 Silo Isolation

Each case silo is cryptographically isolated. Documents in one silo cannot be accessed by other users or used in queries for other cases. This ensures complete separation of your matters.

3.3 Data Breach Notification

In the event of a data breach affecting your personal information, we will notify you within 72 hours via email and, if required by law, relevant regulatory authorities. We maintain incident response procedures to quickly identify, contain, and remediate any security incidents.

4. Third-Party Services

4.1 Processing Infrastructure

BenchSlap is a verification-first legal system built on a closed corpus of primary-source court opinions with deterministic citation validation. Within that engineered pipeline, specific analytical and drafting steps are carried out by secure third-party artificial-intelligence (large-language-model) providers, which operate strictly as processing components — their output is checked by our own deterministic verification layer against primary sources before it reaches you:

• Primary analytical engine for document analysis, drafting, and verification
• Commission verification engine for consensus analysis and cross-referencing
• Supplementary verification engine for independent validation
• Image analysis engine (for visual document processing) — images are transmitted securely, analyzed, and immediately discarded; only the text report is retained

Because these steps involve transmitting the content you submit to third-party AI providers, we disclose that plainly here, and by using the affected features you consent to that processing. The following protections govern it:

• Content you submit is transmitted solely to generate responses to your own queries — for no other purpose
• Your data is never sold and is never used to train any third-party model — enterprise data-processing agreements contractually prohibit it
• AI-assisted output is never treated as authoritative on its own: every citation is validated against our closed corpus of primary court opinions, and any claim without a verifiable source is flagged as unsupported rather than relied upon
• All data transmission uses encrypted connections (TLS 1.3)
• We maintain a data-processing agreement with each provider

4.2 Legal Database Access

For citation verification, we query official court records and legal databases:

• Utah Courts public records (utcourts.gov)
• Utah State Legislature (le.utah.gov)
• Official state and federal court and legislature publications (verified .gov sources)
• U.S. Supreme Court official records (supremecourt.gov)

These queries contain only citation information, not your full documents or identity.

4.3 Other Service Providers

• Email Services: Transactional email delivery for account notifications
• Payment Processing: Stripe for secure payment handling (PCI-DSS compliant)
• Error Monitoring: Anonymous error tracking for service reliability

5. Your Rights

5.1 Access and Portability

You have the right to:

• Access your personal information stored in our systems
• Download your documents and case materials at any time
• Export your data in standard, machine-readable formats (JSON, PDF)
• Request a copy of all personal data we hold about you

5.2 Correction

You may:

• Update or correct your account information at any time through Settings
• Modify or delete individual documents within your silos
• Request correction of any inaccurate personal information

5.3 Deletion

You have the right to:

• Delete individual documents or entire case silos
• Request deletion of your entire account and associated data
• Be forgotten - we will remove your data from our active systems

Selecting Delete account disables access and revokes active sessions immediately. We first cancel and confirm any active subscription so deletion cannot leave recurring charges behind. We then erase documents, conversations, credentials, device tokens, reports, direct profile identifiers, and account-linked application audit logs. A pseudonymous internal key and narrow Stripe customer/subscription identifiers, cancellation evidence, and transaction records may be retained only for tax, accounting, fraud, chargeback, or other legal obligations; no document or conversation content is retained in that ledger.

5.4 Data Retention

6. Cookies and Tracking

6.1 Essential Cookies Only

We use only essential cookies necessary for the Service to function:

• Session cookies: Maintain your authenticated session
• CSRF tokens: Protect against cross-site request forgery attacks
• Preference cookies: Remember your settings (theme, layout preferences)

6.2 What We Do NOT Do

• We do NOT use advertising or marketing cookies
• We do NOT use third-party tracking pixels or beacons
• We do NOT share browsing data with advertisers
• We do NOT build behavioral profiles for ad targeting
• We do NOT use Google Analytics or similar third-party tracking services

6.3 Analytics

We collect anonymized, aggregated analytics to improve our Service. This data cannot be used to identify individual users and includes only general usage patterns and performance metrics. You may opt out of analytics by contacting us.

7. Children's Privacy

BenchSlap is designed for legal professionals and is not intended for use by individuals under 18 years of age. We do not knowingly collect personal information from children. If we learn that we have collected information from a child under 18, we will delete that information promptly. If you believe a child has provided us with personal information, please contact us immediately.

8. International Data Transfers

The Service is operated from the United States. If you access from outside the US, your data will be transferred to and processed in the United States, which may have different data protection laws than your country of residence.

When we transfer your information internationally, we ensure appropriate safeguards are in place:

• Standard contractual clauses with service providers
• Data processing agreements that meet applicable legal requirements
• Encryption of data in transit and at rest

By using the Service, you consent to this transfer and processing of your data in the United States.

9. California Privacy Rights (CCPA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA):

• Right to Know: You may request disclosure of the categories and specific pieces of personal information we have collected about you
• Right to Delete: You may request deletion of your personal information, subject to certain exceptions
• Right to Opt-Out: You may opt out of the sale of personal information (note: we do NOT sell personal information)
• Right to Non-Discrimination: We will not discriminate against you for exercising your privacy rights

To exercise these rights, contact privacy@benchslap.pro with "CCPA Request" in the subject line. We will verify your identity before processing your request.

10. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. When we make changes:

• We will post the updated policy on this page with a new effective date
• For material changes, we will send an email notification to registered users at least 30 days before the changes take effect
• We may display a prominent notice within the Service

Your continued use of the Service after any changes indicates your acceptance of the updated Privacy Policy. We encourage you to review this policy periodically.

11. Contact Us

If you have questions about this Privacy Policy, our data practices, or wish to exercise your privacy rights, please contact us:

For urgent privacy concerns or suspected data breaches, please include "URGENT" in your email subject line. We aim to respond to all privacy inquiries within 30 days, and urgent matters within 72 hours.