Privacy Policy
Last updated (draft): September 28, 2026
Who we are
Counted Legal is practice software published for law firms. It is not a law firm and does not give legal advice. Privacy contact: [PRIVACY CONTACT NAME, EMAIL AND MAILING ADDRESS — counsel to complete]. During the local pilot, contact the firm administrator who deployed this instance.
What this pilot stores
- Account data: firm name, user names, emails, roles, password hashes, authenticator secrets (encrypted), recovery codes (encrypted).
- Practice data the firm enters: matters, time entries, invoices (earned operating only), documents (encrypted at rest per firm), calendar connection tokens (encrypted; dry-run in this build).
- Operational logs: an append-only, hash-chained audit log of security and billing events.
What we do not do in this local pilot
- No live payment processing (Stripe is test-shape / dry-run; LawPay is stubbed).
- No court filing from the app.
- No marketing or advertising cookies. The local build sends no analytics.
- Trust / IOLTA funds are never accepted by card.
Website analytics
The public website (countedlegal.com) uses Cloudflare Web Analytics to count page views and page performance. It does not set cookies or build advertising profiles; Cloudflare receives the page address, referrer, browser type and approximate country. Signed-in app pages are not part of this measurement.
AI providers
AI features (for example the intake assistant's call summaries and the Carina help assistant) send the text needed for that task to an AI model provider: [AI MODEL PROVIDER NAME(S) AND DATA-USE TERMS — counsel to complete]. Firm and client data is not used to train models under the terms we will require. AI output is labeled, is not legal advice, and must be reviewed by the firm.
Security measures (pilot)
Passwords use PBKDF2-SHA256. Sessions are HttpOnly cookies. Two-factor authentication is required. Documents and sensitive fields use AES-256-GCM with a per-firm data key wrapped by a master key held only on the host. Audit entries are hash-chained and append-only.
Your choices
Firm owners can revoke staff and client access, download an encrypted backup, and restore from backup. Clients see only their matter. For a hosted deployment, retention, subprocessors, and breach notice language must be completed by counsel before go-live.
Trust accounting, court filing, calls and texts (pilot features, DRAFT)
Trust accounting. If a firm uses trust accounting, we store its trust and operating account names (last 4 digits only), client ledger entries, bank statement lines the firm imports (CSV/OFX) or later syncs through a bank-data provider such as Plaid, reconciliation results, and sign-off names. We never store full bank account numbers or bank passwords. No money moves through Counted Legal.
Court filing preparation. Draft bankruptcy packages can contain full Social Security numbers in the restricted Statement of SSN (Form B121), which is kept apart from the public files. Nothing is filed with a court from this pilot.
Calls and texts. If a firm turns on the intake assistant, callers are told they are speaking with an AI assistant, hear a recording notice, and are asked for consent before any recording starts. If a caller says no, nothing is recorded or transcribed; only the caller ID and call time are kept so the firm can call back. We store phone numbers, call summaries, encrypted transcripts (only with consent), text messages, a record of each client's text-message consent (when and how it was given or withdrawn), and opt-out status. Non-urgent texts are sent only between 8am and 9pm in the recipient's local time. Replying STOP (or UNSUBSCRIBE, CANCEL, END, QUIT, STOPALL, REVOKE or OPT OUT) ends texts; HELP returns the firm's contact details. Message and data rates may apply. Carriers and our phone provider (for example Twilio or Telnyx) process call and message data to deliver it.
Counsel to complete: retention periods, list of subprocessors (Cloudflare, including Web Analytics; Stripe; Google; Twilio/Telnyx; Plaid; the AI model provider), state recording-consent language, and SMS consent terms.
Children
This product is for law-firm business use, not for children under 13.