Data Processing Addendum

1. Roles and instructions

The firm is the controller (or "business") of Customer Personal Data; Brennick is its processor (or "service provider" and "contractor" under the California Consumer Privacy Act). Brennick processes Customer Personal Data only on the firm’s documented instructions, which are the Terms, this Addendum and the firm’s use of the Service, and only for the business purpose of providing the Service.

2. CCPA service-provider terms

Brennick will not: sell or share Customer Personal Data; retain, use or disclose it for any purpose other than providing the Service (including any commercial purpose other than the business purpose specified here) or outside the direct business relationship with the firm; or combine it with personal information Brennick receives from or on behalf of another person, except as the CCPA permits.

Brennick will comply with the CCPA as applicable to it, provide the same level of privacy protection the CCPA requires of the firm, notify the firm if it determines it can no longer meet its obligations, and permit the firm to take reasonable and appropriate steps to stop and remediate unauthorized use. Brennick certifies that it understands these restrictions.

Requests from consumers about Customer Personal Data that reach Brennick are forwarded to the firm, and Brennick will assist the firm in responding.

3. Confidentiality and security

Access to Customer Personal Data is restricted to authorized persons bound by confidentiality: Brennick personnel who need it to operate, secure or support the Service, and sub-processors to the extent their task requires. Brennick maintains technical and organizational measures including encryption in transit and at rest, per-tenant access control enforced in the database, an append-only audit log, least-privilege internal access, and logging that excludes document content and personal details.

4. Sub-processors

The firm authorizes Brennick’s use of sub-processors. The current list, with each sub-processor’s purpose and location, is published at brennick.ai/legal/subprocessors. Brennick will give at least 30 days’ advance notice by email to firm administrators before adding or replacing a sub-processor that processes Customer Personal Data, during which the firm may object; if the objection cannot be resolved, the firm may terminate the affected Service without penalty. Brennick imposes data-protection terms on each sub-processor no less protective than this Addendum and remains responsible for them under it. Sub-processors are independent contractors of Brennick, not its agents or employees.

5. Assistance, breach notice and audits

Brennick will assist the firm with consumer and data-subject requests and with impact assessments, and will make available information reasonably necessary to demonstrate compliance. Once in any twelve months, on request, Brennick will answer the firm’s reasonable written security questionnaire within 30 days and will provide, under confidentiality, any third-party security assessment or audit report it then holds. If those do not reasonably demonstrate compliance with this Addendum, the firm may audit Brennick’s processing of Customer Personal Data once in any twelve months, on 30 days’ written notice, during business hours, at the firm’s expense, through Brennick or an independent auditor bound by confidentiality, and in a way that exposes no other customer’s data; the firm gives Brennick a copy of the result.

Brennick will notify the firm without undue delay, and in any case within 72 hours after discovery, of a breach of security affecting Customer Personal Data. A breach is discovered when it is known to any Brennick employee or officer, including when Brennick receives notice of it from a sub-processor. Brennick will give the firm the details reasonably available to it (what happened, which data and which clients are affected, and what Brennick has done) within 30 days after discovery, or, for details that depend on a sub-processor, promptly after Brennick receives them from that sub-processor.

6. Return and deletion

While the subscription is active, the firm’s data is kept for the life of the subscription, and the firm can export all of it at any time.

After cancellation, the firm’s data is kept for 90 days so the firm can export it. Brennick sends export reminders to the firm’s administrators at cancellation and 30, 60 and 83 days after it. A legal hold pauses deletion.

After 90 days, Brennick permanently deletes the firm’s data from its database, its file storage (every stored version), its client sign-in service, its e-signature provider and its SMS provider’s message logs, and removes the firm’s staff accounts that belong to no other firm.

Deleted data leaves database and file backups within 7 days after deletion. Backups are restored only for disaster recovery.

After deletion Brennick keeps only: billing and invoice records for 7 years (tax); SMS consent and opt-out records (the phone number, when consent was given and to which text, and when it was withdrawn) for 4 years; trial-abuse markers (a one-way hash of the email domain and the payment card fingerprint) for 24 months; an audit skeleton (event types, times, actor identifiers and case identifiers, with no content) for 6 years; and a record that the deletion happened, with counts only, for 6 years. Each is deleted on its own date.

Some providers keep copies Brennick cannot delete on request: the AI model provider retains inputs and outputs for up to 30 days by default (and flagged content longer under its own policy), and the SMS provider may keep message bodies in its backups for up to 30 days. Data a firm chose to send to its own third-party accounts (for example Clio or Google Calendar) stays in those accounts.

A firm administrator can permanently delete an individual case at any time, except while a legal hold is in place; a record that the case was deleted, without its contents, remains in the firm’s audit log.

On request within six years after the firm’s data is deleted, Brennick gives the firm written confirmation of the deletion, with its date and the counts of records and files removed.

7. Health information and substance-use records

Customer Personal Data may include medical records that the firm’s clients authorize their providers to release to the firm for the clients’ own matters. Section 5A of the Terms applies: Brennick is not a business associate under HIPAA, and the firm does not use the Service for protected health information it holds as a HIPAA covered entity or business associate.

Records identified as subject to 42 CFR Part 2 (by the Service’s pattern detection, or by Customer at intake) are flagged, and no document in a matter so flagged is sent to any AI model, and no scanned page of it to text recognition, until an attorney at Customer has recorded in the Service that the client’s written Part 2 consent is on file, its type and date, and whether the class of recipients it names covers Brennick and its subcontractors. Pages that pattern detection does not flag may be reviewed by an AI classifier to detect 42 CFR Part 2 content that the patterns missed.

A firm user can turn off AI processing for any matter. While it is off, documents in that matter are stored and paginated but sent to no AI model and no text-recognition service; only an attorney at Customer can turn it back on.

Mailing address