Privacy Policy

Who this covers, and Brennick’s role

This policy covers two groups of people: (1) the staff of law firms that subscribe to Brennick ("firm users"), and (2) the clients and prospective clients of those firms who use a firm’s intake page or client portal, or whose information a firm puts into the Service ("portal clients").

For firm users and for running our own business, Brennick LLC decides how personal information is used. For portal clients, the law firm decides: Brennick processes that information only on the firm’s behalf and under its instructions, as a service provider (see the Data Processing Addendum).

Categories of personal information we collect

Firm users: name, work email, role and attorney bar number where the firm records it (with who at the firm recorded it and when), sign-in and security events, and billing contact details (payment card numbers are held by our payment processor, never by us). A firm may also enter its contact details and letterhead, including the name and title of the person who signs its letters. We keep our own account and support notes about a firm; they are visible to Brennick staff only.

Portal clients: contact details (name, email, phone); what you tell the firm about your matter on its intake page, in your own words (what happened and where, your injuries and treatment, your insurers with policy and claim numbers, the other people involved and their roles, whether a government body is involved, whether substance use disorder treatment records are involved, and how you heard about the firm); documents and recordings you or the firm upload (which may include medical and other sensitive records; we extract and store the text of documents, and the firm’s records of your case, such as its timeline and its ledger of medical bills, are built from them; audio and video are stored for the firm to review and are never transcribed or sent to an AI model); messages with the firm; e-signature records (the signer’s name and email, the signed document, the signature, the signer’s IP address and the e-signature provider’s audit trail; the signed authorization is kept with your case); the consents and acknowledgments you give on the intake page, with the exact words shown, the time, a one-way hash of your IP address and a description of your browser; and your portal sign-in email.

Other people named in a matter: the names and roles of parties, witnesses, insurers and employers that a client or a firm enters for conflict checks; medical providers and their contact details; lienholders; and people named inside uploaded documents. They are processed on the firm’s instructions and we do not contact them.

People who write to us: the name, firm, email, number of attorneys and message sent through our website’s contact and Enterprise forms are emailed to us and are not stored in the Service.

Technical information: IP address and browser information used for security, rate limiting and bot protection; request identifiers; security logs; and, on our public website only, cookieless page-view analytics that set no cookie and identify no visitor. Our application logs carry identifiers, not document content, names, phone numbers or medical information.

How we use it

To provide the Service to the firm; to secure it; to bill for it; and to meet legal obligations. We do not sell or share personal information, we do not use it for advertising or cross-context behavioral advertising, and we do not use it to train AI models.

Bot protection and rate limiting on the intake page

A law firm’s intake page uses Cloudflare Turnstile to tell people from automated abuse. Turnstile runs in your browser and sends Cloudflare information about your browser and device, and your IP address; Cloudflare’s own privacy policy covers that information. Turnstile does not receive what you type into the intake form.

To limit abuse, we count requests from each IP address. Your IP address is converted to a one-way hash before it reaches our rate-limiting service, so that service never receives the address itself.

Third parties we disclose it to

We use service providers (sub-processors) to host and operate the Service: cloud hosting, database, file storage and document text recognition; an AI model provider that analyzes documents for the firm; e-signature; email and text-message delivery; client and staff sign-in; payment processing; rate limiting; and bot protection. Each receives only what its task needs and is bound by contract to protect it. The AI model provider may keep the text it receives for up to 30 days to operate and secure its service, then deletes it. The current list, with each provider’s purpose and location, is published at brennick.ai/legal/subprocessors. Firm administrators are notified by email at least 30 days before a provider that processes their clients’ data is added or replaced, and may object under the Data Processing Addendum.

If a firm connects its own third-party account (for example Clio or Google Calendar), the firm directs us to send the data shown on the integrations screen to that account.

We may also disclose information if required by law, or to protect the rights and safety of people and the Service. When legal process requires us to disclose a law firm’s data, we tell the firm first where the law allows, so it can object.

We do not share mobile phone numbers or SMS opt-in data with third parties for marketing purposes.

Retention

While the subscription is active, the firm’s data is kept for the life of the subscription, and the firm can export all of it at any time.

After cancellation, the firm’s data is kept for 90 days so the firm can export it. Brennick sends export reminders to the firm’s administrators at cancellation and 30, 60 and 83 days after it. A legal hold pauses deletion.

After 90 days, Brennick permanently deletes the firm’s data from its database, its file storage (every stored version), its client sign-in service, its e-signature provider and its SMS provider’s message logs, and removes the firm’s staff accounts that belong to no other firm.

Deleted data leaves database and file backups within 7 days after deletion. Backups are restored only for disaster recovery.

After deletion Brennick keeps only: billing and invoice records for 7 years (tax); SMS consent and opt-out records (the phone number, when consent was given and to which text, and when it was withdrawn) for 4 years; trial-abuse markers (a one-way hash of the email domain and the payment card fingerprint) for 24 months; an audit skeleton (event types, times, actor identifiers and case identifiers, with no content) for 6 years; and a record that the deletion happened, with counts only, for 6 years. Each is deleted on its own date.

Some providers keep copies Brennick cannot delete on request: the AI model provider retains inputs and outputs for up to 30 days by default (and flagged content longer under its own policy), and the SMS provider may keep message bodies in its backups for up to 30 days. Data a firm chose to send to its own third-party accounts (for example Clio or Google Calendar) stays in those accounts.

Reviewing and correcting your information; your rights

Portal clients: your law firm controls your information. To see, correct or delete it, contact the firm (you can message it from your portal). If you contact us, we will pass your request to the firm and help it respond.

Firm users can review and correct their account details in the Service or by writing to privacy@brennick.ai.

Anyone can submit a request at brennick.ai/legal/data-request, which confirms your email address with a one-time code before anything is filed, or by writing to privacy@brennick.ai.

Your California privacy rights (CCPA/CPRA)

This section is for California residents and uses the words of the California Consumer Privacy Act as amended by the California Privacy Rights Act.

What we collect, from where, and why. In the preceding twelve months we have collected the categories of personal information listed under "Categories of personal information we collect": identifiers and contact details, professional information (a firm user’s role and bar number), commercial information (billing contact details), internet activity (IP address and browser information used for security), and, for a law firm’s clients, the sensitive personal information in the documents and messages the client or the firm provides, which may include medical and other health information. We collect it from you, from the law firm you work with, and from your browser. We use it for the purposes under "How we use it". We use sensitive personal information only to provide the Service to the firm, to secure it and as the law requires, which are purposes the CPRA permits without a right to limit.

No sale or sharing. We have not sold or shared personal information in the preceding twelve months, we do not sell or share it now, and we do not use it for cross-context behavioral advertising. We have no actual knowledge that we sell or share the personal information of anyone under 16.

Your rights. You have the right to know what personal information we hold about you and to receive a copy of it; to correct it; to delete it; to opt out of sale or sharing (there is none); to limit the use of sensitive personal information (we already limit it as above); and not to be discriminated against for exercising any of these rights.

How to exercise them. Submit a request at brennick.ai/legal/data-request or write to privacy@brennick.ai. We verify a request by confirming the email address it comes from (the request page sends a one-time code) and, where the request concerns an account, by matching it to the account’s email. An authorized agent may submit a request for you with your written permission; we may ask you to confirm it directly. We answer within 45 days, or tell you within that time if we need up to 45 more.

Whose request it is. For a client of a law firm, the firm is the business and Brennick its service provider: your request is forwarded to the firm, which answers it, and Brennick helps the firm respond. For a firm user, the firm’s administrator can export or delete the firm’s data in the Service; your own account details can be changed in the Service or on request. For anyone who only wrote to us, we answer the request ourselves.

Do Not Track and similar signals

We do not track you across other websites, and we run no advertising pixels, no session recording and no analytics that set a cookie or identify a visitor, so we do not change our behavior in response to a browser’s Do Not Track signal: there is no cross-site tracking for it to stop. We do not sell or share personal information, so there is nothing for a Global Privacy Control signal to opt you out of.

Security

Information is encrypted in transit and at rest; each firm’s data is isolated by access controls enforced in the database; and every AI generation and human review is recorded in an append-only audit log. No method of transmission or storage is perfectly secure, and we will notify affected firms of a breach as our agreements and the law require.

Changes to this policy

When we change this policy we update the effective date above and, for material changes, notify firm administrators in the Service and by email before the change takes effect. Firms are asked to accept the new version.

Contact

privacy@brennick.ai.

Mailing address