Legal

Privacy Policy

Effective Date: April 21, 2026

This Privacy Policy describes how 2ndCounsel LLC, a Washington State limited liability company ("2ndCounsel," "we," or "us"), collects, uses, and protects information in connection with 2ndCounsel — Attorney Intelligence Platform (the "Service"). By using the Service, you agree to the practices described in this policy. 2ndCounsel LLC is not a law firm and does not provide legal services.

1. Information We Collect

1.1 Data You Authorize

To provide the Service, you authorize 2ndCounsel LLC to access the following data sources via secure OAuth connections:

  • Microsoft Outlook calendar events, including titles, times, attendees, and locations
  • Email metadata, including sender, recipient, subject, timestamp, and importance flags, plus limited content previews of up to 255 characters
  • Sent email metadata
  • Document activity metadata, including filename, file path, last modified timestamp, and file size

We do not store full email bodies or document contents on our servers.

1.2 Account Information

When you create an account, we collect your name, email address, firm name, and billing information necessary to provide and invoice the Service.

1.3 Usage Data

We collect technical data about how you interact with the Service, including server logs, IP addresses, browser type, and feature usage patterns, for the purpose of operating, securing, and improving the Service.

2. How We Use Your Information

We use the information we collect solely to:

  • Provide and operate the Service
  • Generate draft time entries for your review
  • Send transactional communications, including invoices and service notifications
  • Respond to support requests
  • Improve the Service using aggregated, anonymized usage data that cannot reasonably identify you or your clients

We do not use your data to train AI models. We do not use your data for advertising or marketing to third parties.

3. AI Processing and Third-Party AI Vendor

3.1 Anthropic API

The Service uses the Anthropic API to generate time entry drafts. When you use the Service, metadata and content previews from your authorized data sources are transmitted to Anthropic's API for processing.

3.2 Anthropic API Data Retention

Under Anthropic's current API terms, prompts and outputs sent via the API are automatically deleted within 7 days of processing. Anthropic does not use API inputs or outputs for model training without express customer permission. 2ndCounsel LLC has not granted Anthropic such permission.

3.3 Anthropic's Policies

Anthropic's data handling is governed by Anthropic's Privacy Policy and API terms, available at anthropic.com. 2ndCounsel LLC is not responsible for Anthropic's data practices beyond what is described in this section.

3.4 Policy Changes

If Anthropic's data retention or training policies change materially, 2ndCounsel LLC will update this Privacy Policy and notify Subscribers.

4. How We Protect Your Information

  • All data transmitted between your device and the Service is encrypted using HTTPS/TLS.
  • The Service is hosted on Railway and Vercel, which operate on AWS-backed cloud infrastructure.
  • Access to Subscriber data is restricted to authorized 2ndCounsel LLC personnel on a need-to-know basis.
  • We do not currently maintain formal audit logs of individual data access events. We are working to implement structured access logging as part of our security roadmap. Subscribers with specific audit requirements should contact support@2ndCounsel.com.
  • In the event of a data breach materially affecting your information, we will notify you within 72 hours of becoming aware, to the extent required by applicable law.

5. Subprocessors

We rely on the following third-party service providers (subprocessors) to operate the Service. Each is bound by confidentiality and data protection obligations:

Provider Purpose
Railway Backend hosting and managed database (AWS infrastructure)
Vercel Frontend hosting (global CDN)
Anthropic AI processing via API (7-day retention, no training use)
Resend Transactional email delivery
Microsoft Graph API Calendar, email, and document metadata access (governed by Microsoft's terms)
Clio API Matter and billing data sync for Clio subscribers (governed by Clio's terms)

We do not sell data to any subprocessor or permit subprocessors to use your data for their own purposes.

6. Data Retention and Deletion

6.1 Retention

We retain your data for as long as your subscription is active and as needed to provide the Service.

6.2 Deletion on Termination

Upon termination of your account, your data will be deleted from active systems within 30 days. Backup copies may persist for up to an additional 30 days before purge. Aggregated, anonymized data that cannot identify you may be retained indefinitely.

6.3 Deletion Requests

You may request deletion of your data at any time by contacting support@2ndCounsel.com. We will confirm completion of deletion within 30 days of a verified request.

7. Your Privacy Rights

7.1 General Rights

You may request access to, correction of, or deletion of your personal data at any time by contacting support@2ndCounsel.com. We will respond to verified requests within 30 days.

7.2 California Residents

If you are a California resident, you may have additional rights under the California Consumer Privacy Act (CCPA/CPRA), including:

  • The right to know what personal information we collect and how it is used
  • The right to delete personal information
  • The right to correct inaccurate personal information
  • The right to opt out of the sale or sharing of personal information

We do not sell or share personal information. To exercise your rights, contact support@2ndCounsel.com with sufficient detail to verify your identity. We will respond within 45 days as required by law.

7.3 Other US Residents

We honor applicable privacy rights under US federal and state privacy laws. If you believe your rights have not been respected, please contact us at support@2ndCounsel.com.

8. Attorney-Client and Professional Data

You are solely responsible for ensuring your use of the Service complies with your professional obligations, including applicable bar rules, ethics opinions, and client confidentiality requirements in your jurisdiction. 2ndCounsel LLC processes data as a service provider acting on your instructions and does not independently control or assert rights over client data you provide through the Service. You represent that you have authority to connect any accounts containing client or third-party data to the Service.

9. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes at least 30 days before they take effect. Continued use of the Service after the effective date constitutes acceptance of the updated policy.

10. Contact and Data Requests

For questions about this Privacy Policy, to exercise your privacy rights, or to request a Data Processing Addendum, contact:

2ndCounsel LLC
support@2ndCounsel.com