Legal
Privacy Policy
FamilyCase.AI Inc. (“FamilyCase,” “we,” “us”) provides software to law firms. This policy explains what we collect, how we use it, and the choices you have. Because our customers are law firms, most matter data we process is handled on their behalf as a service provider / processor. Notices: privacy@familycase.ai; legal notices: legal@familycase.ai.
1. Who we are & roles
The controller for FamilyCase business, marketing, and account data is FamilyCase.AI Inc. (Delaware). When a law firm stores matter or client data in the product, the firm is the controller and FamilyCase is the processor / service provider under our Data Processing Addendum. Portal end-users receive privacy disclosures where the portal processes personal information.
2. Information we collect
Account details (name, work email, firm name, role); billing contact and payment tokens processed by Stripe; product usage, device, and security log data; cookie/consent choices on the marketing site; and the case and client data your firm chooses to store in the platform (which may include sensitive personal information and references to minors as part of family-law matters).
3. Customer data (matter content)
Evidence, documents, messages, and case facts are your firm's confidential data. We process them only to provide the service, under your instructions, and never to train public AI models. AI processing is described in the AI & Data Use Schedule.
4. How we use information
To operate, secure, and improve the service; authenticate users and enforce tenant isolation; provide support; process subscription payments; send transactional email; send transactional SMS/text messages where a firm or user has provided consent; and meet legal obligations. We do not sell personal information and do not share personal information for cross-context behavioral advertising.
5. SMS/text message consent
FamilyCase may send transactional SMS/text messages for family-law client reminders, case updates, appointment reminders, portal invitations, security notices, and support follow-up only where the recipient has provided consent through a law-firm intake form, retainer process, portal checkbox, or similar documented workflow. Message frequency varies. Message and data rates may apply. Reply STOP to opt out and HELP for help. Opting out of SMS does not prevent legally required notices or service messages from being delivered through another approved channel. FamilyCase does not use SMS consent for marketing blasts and does not sell or share mobile opt-in data.
6. AI processing
AI features draft and organize content for attorney review (including through Amazon Bedrock). Inputs and outputs are processed within your tenant and are not used to train models outside your firm.
7. Sharing & subprocessors
We share information with subprocessors under contract: Amazon Web Services (hosting, storage, networking, and AI via Bedrock in us-west-2), Stripe (subscription billing / payment tokenization), Resend (transactional email), Google (OAuth sign-in profile/email), and PostHog (consent-gated product analytics and masked session replay, under an executed data processing agreement). We may also disclose information when required by law or in a business transfer. See the Subprocessor List for the current public register.
8. Product analytics & session replay
On the marketing website, we use PostHog product analytics only after you accept analytics in the cookie banner; the default is essential-only and no analytics requests are sent without consent. If you consented on the marketing site and then sign up, an anonymous PostHog identifier (ph_id) may carry through the signup link into the application so we can connect your visit to your signup; it contains no name, email, or other directly identifying information. Inside the authenticated application, we collect a limited allowlist of usage events (for example, that a matter was created — never its title or contents) and may record session replay with all text, inputs, and element attributes fully masked before anything leaves your browser, so client, matter, financial, and document content is never captured. Replay is never recorded on sign-in screens. Analytics events exclude matter content, client names, and message or document text by design.
9. Security
Encryption in transit and at rest, per-tenant isolation (including database row-level security in database mode), access controls, and an immutable audit log. See the Trust Center for evidence-backed detail.
10. Data retention
Firm matter data: for the life of the account plus any legal-hold or retention settings the firm configures; ordinarily returned or deleted within 30 days after the applicable wind-down period unless law or firm instructions require longer. Account and business-contact data: while the relationship is active and about 24 months after last interaction for prospects. Billing, tax, and financial records: about 7 years. Security and operational logs: ordinarily up to 12 months.
11. Your rights (GDPR / US state privacy)
Where EU/UK GDPR applies, you may request access, rectification, erasure, restriction, portability, and objection, and you may withdraw consent where processing is consent-based. Where CCPA/CPRA or similar US state laws apply, you may request know/access, delete, correct, opt out of sale/sharing, and limit use of sensitive personal information; we do not sell or share personal information as those terms are defined. Submit requests via Privacy Rights or privacy@familycase.ai. For firm-controlled matter data, we typically refer the request to the firm and assist under the DPA.
12. International transfers
Production systems run primarily on AWS in us-west-2 (United States). Where EU, UK, or Swiss personal data is transferred to the United States, we rely on appropriate safeguards including the European Commission Standard Contractual Clauses and the UK International Data Transfer Addendum where applicable, together with technical and organizational measures such as encryption.
13. Children
FamilyCase is a business tool for law firms and is not directed to children. Case data may reference minors as part of a family-law matter; that data is handled as firm case data under the firm's instructions and this policy's safeguards.
14. Contact & changes
Privacy questions: privacy@familycase.ai. We may update this policy; material changes are posted with a new version and effective date, and we provide additional notice where required.