Our Privacy Policy

This privacy policy ("Privacy Policy") describes the types of personal information that Deliberately Incorporated ("Deliberately.ai," "we," "our," and/or "us") collects, uses, and discloses from individuals ("you" or "your") who use our website (including https://deliberately.ai/) (our "Website") and the Deliberately.ai software-as-a-service platform (the "Platform," and together with the Website and our related services, our "Services").

Who this policy covers. Our Services are used by family-law firms and the attorneys, paralegals, and staff who work within them ("Firm Users"); by individual clients of those firms ("Client Users"); and by visitors to our Website. This Privacy Policy applies to all of them. Where we process personal information on behalf of a firm (for example, case data a firm or its client uploads), we do so as a service provider/processor to that firm, and the firm's own agreements and privacy notices may also apply. By using our Services, you agree to the collection, use, disclosure, and procedures described in this Privacy Policy.

Personal Information We Collect

We may collect a variety of personal information from or about you or your devices from various sources, as described below.

A. Personal Information You Provide to Us

• Sign Up / Account Creation. When you sign up or create an account, we ask for your name, email address, company or firm name, password, and any information you choose to provide.

• Communications. If you contact us directly, we may receive information about you, such as your name, email address, the contents of a message or attachments that you may send to us, and other information you choose to provide. When you communicate with us online, third-party vendors receive and store these communications on our behalf. When we send you emails, we may use embedded pixels or other technologies to track information about your receipt and interaction with our emails (such as whether and when you open them, whether you access links, and your Location and Device Information described below) to improve our Services.

• Careers. If you apply for a job with us, we collect the contact information and resume content you choose to provide, including through LinkedIn.

B. Personal Information We Collect When You Use Our Website

• Location Information. We infer your general location, for example from your IP address.

• Device Information. We receive information about the device and software you use, including IP address, device type and identifiers, browser type and version, and operating system version.

• Usage Information. We automatically receive information about your interactions with our Website, such as the pages you view, referrer information, and the dates and times of your visits.

• Information from Cookies and Similar Technologies. We and our third-party partners collect information using cookies, pixel tags, and similar technologies. See Cookies and Analytics below for the specific tools we use.

C. Personal Information We Collect Through the Deliberately.ai Platform

When you create an account and use the Platform, we collect additional personal information:

• Account Information. Your name, email address, password, firm/organization, role, and other information necessary to establish and maintain your account.

• Case Information. Information about the legal matter you provide to the Platform, including case-participant information (names, email addresses, roles), case documents, timeline events, notes, financial documents, and other case-related information you choose to store in the Platform.

• Connected-Account and Integration Information. When you connect a third-party account (email or cloud storage; see Third-Party Integrations and Connectors below), we collect and store data from that account as needed to provide the features you enable, and we store the OAuth access/refresh tokens required to maintain the connection (encrypted; see How We Store and Protect Your Data).

• Payment Information. When you purchase or subscribe to our Services, we collect billing information such as your billing address and use a third-party payment processor to process your payments.

• Support Information. When you contact us for support, feedback, or inquiries, we may collect your name, email address, phone number, and any other information you provide.

Third-Party Integrations and Connectors

You may choose to connect third-party accounts to the Platform. We access these accounts only after you authorize the connection through the provider's consent screen, and we request only the permissions needed for the features you use. Our email integrations (Gmail and Outlook) use read-only access, and we do not request permissions to send, modify, or delete your email. Our cloud-storage integrations currently use read-only access; as we release features that let you save documents from the Platform back to your connected storage, we will request write access to Google Drive and Microsoft OneDrive/SharePoint, and only after you authorize it at the provider's consent screen. The consent screen always shows the exact permissions in effect.

The connectors and the data we ingest are:

• Gmail (Google): read-only access (gmail.readonly). We ingest email messages, metadata, and attachments, limited to configured case participants (see Email Integration Data below).

• Outlook / Microsoft 365 mail: read-only access (Mail.Read). We ingest email messages, metadata, and attachments, with the same case-participant filtering.

• Google Drive: read-only access today, with write access added for features that let you save documents from the Platform back to your Drive (you authorize this at the Google consent screen). We ingest documents and files you select for a case.

• Dropbox: read-only access. We ingest documents and files you select for a case.

• Box: read-only access. We ingest documents and files you select for a case.

• Microsoft OneDrive / SharePoint: read-only access today, with write access added for features that let you save documents from the Platform back to your storage (you authorize this at the Microsoft consent screen). We ingest documents and files you select for a case.

• Clio (legal practice management): read-only access. We ingest matter, contact, and document data you select for a case.

For each connector we store per-user OAuth tokens (encrypted) so we can retrieve the data you choose to bring into your cases. You can disconnect any connector at any time (see Your Control Over Your Data), which stops future synchronization and revokes our access.

Email Integration Data (Gmail and Outlook)

When you connect a Gmail or Outlook account, we collect and process:

• Email Messages: subject lines, message body (text and HTML), and email headers.

• Email Metadata: sender and recipient addresses (To/Cc/Bcc), timestamps and dates, and message/thread IDs for synchronization.

• Email Attachments: files attached to emails, including content, filenames, and file types.

• Synchronization Data: history IDs and push-notification data to enable timely updates.

Filtered collection. We only collect and process emails that involve participants you have explicitly configured as relevant to your case (for example, the opposing party, attorneys, mediators, court personnel, and other case-relevant contacts you specify). We do not collect emails that do not involve these configured participants. Historical sync is limited to the past 90 days by default (configurable).

How We Use the Personal Information We Collect

We use the personal information we collect to:

• Provide, maintain, improve, and enhance our Services;

• Organize and categorize your case information, construct case timelines, enable search, and process documents within your cases;

• Provide AI-powered case analysis, knowledge-graph organization, document understanding, and personalized guidance based on the content and context of your case-related information and communications (see AI Processing and AI Subprocessors below);

• Understand and analyze how you use our Services and develop new features;

• Communicate with you, provide updates and information you request, and provide customer support;

• For marketing and advertising of our own Services (we do not use your case data or email-integration data for marketing; see restrictions below);

• Generate de-identified or aggregate data for any lawful purpose;

• Detect and prevent fraud and abuse and respond to trust-and-safety issues;

• For compliance purposes, including enforcing our legal rights or as required by law; and

• For other purposes for which we provide specific notice at the time of collection.

AI Processing and AI Subprocessors

Our Services use artificial-intelligence and machine-learning models to deliver core features such as case analysis, knowledge-graph entity extraction, document understanding, semantic search, and chat-based guidance. To provide these features, case content and content derived from your connected email and documents are processed by third-party AI services acting as our subprocessors. Specifically:

• Embeddings and relevance ranking: text is processed by OpenAI to generate vector embeddings (used for semantic search and retrieval) and to perform relevance reranking.

• Knowledge-graph entity extraction: text is processed by Anthropic (Claude) to identify and organize the entities and relationships in your case.

• Chat and AI-generated guidance: text is processed by Anthropic's Claude models, which we access either through Amazon Web Services (AWS) Bedrock (where the models run within our AWS cloud environment) or through Anthropic's API directly, depending on our configuration. In either case the content is handled by a third-party AI service under the protections described below.

• Product observability: to operate and improve the quality of these AI features, our AI request and response data may be processed by our observability provider (LangSmith) as a subprocessor under the same protections.

These providers and services process your content solely to provide the features you use within the Platform. Our agreements with them:

• prohibit them from using your content to train or improve their generalized or foundation AI/ML models;

• prohibit them from using your content for their own purposes or for advertising; and

• require appropriate confidentiality and security protections.

We do not use your email-integration data or case data to train generalized or public AI/ML models, and we do not sell it. A current list of the AI and other subprocessors we use is available in our Subprocessors section below or upon request.

How We Disclose the Personal Information We Collect

• Vendors and Service Providers (Subprocessors). We disclose information to vendors and service providers that help us operate the Services, under contractual data-protection obligations. See Subprocessors below.

• Partners and Affiliates. We may disclose information to current or future affiliates for the purposes described in this Privacy Policy.

• As Required by Law and Similar Disclosures. We may access, preserve, and disclose your information if we believe doing so is required or appropriate to comply with law-enforcement requests and legal process, to respond to your requests, or to protect rights, property, or safety.

• Merger, Sale, or Other Asset Transfers. We may transfer information in connection with a corporate transaction such as a merger, acquisition, financing, or sale of assets.

• With Your Consent. We may disclose your information with your permission.

Subprocessors

We use third-party subprocessors to provide our Services. These include, by category:

• Cloud infrastructure and hosting: Amazon Web Services (AWS), Google Cloud Platform.

• Content delivery and network security: Cloudflare.

• Database and knowledge graph: Neo4j.

• Authentication: Auth0.

• AI / machine-learning model providers: OpenAI, Anthropic, Amazon Web Services (AWS Bedrock).

• AI observability / tracing: LangSmith.

• Monitoring and logging: Datadog.

• Document processing: LlamaParse.

• Legal/court data: UniCourt.

• Financial data: Plaid.

• Workflow orchestration: Temporal Cloud.

• Product analytics, support, and in-app guidance: PostHog, Intercom, Product Fruits.

• Customer relationship management (CRM): HubSpot.

• Billing / subscription management: Salesbricks and our payment processor.

The third-party integrations you connect (Gmail, Outlook, Google Drive, Dropbox, Box, Microsoft OneDrive/SharePoint, and Clio) are accounts you authorize and control; we access them as data sources on your instruction, as described under Third-Party Integrations and Connectors above.

Cookies and Analytics

We and our third-party partners use cookies and similar technologies. The third-party browser tools we use are:

• PostHog: product analytics, to understand how the Services are used and improve them.

• Intercom: in-product support messaging.

• Product Fruits: in-app onboarding and guidance.

We do not use Google Analytics. Essential cookies enable core site functionality (such as keeping you signed in); analytics and functional cookies help us understand usage and remember your preferences. You can manage or reject cookies through your browser settings, though some features may not work properly if you do.

Do Not Track. There is no accepted standard for responding to Do Not Track signals, and we do not respond to them.

What We Do NOT Do With Your Email-Integration and Case Data

• We do not sell your data to third parties, advertisers, or data brokers.

• We do not use your email-integration data or case data to train generalized or public AI/ML models.

• We do not send marketing communications using your email-integration data.

• We do not send, modify, or delete messages in your connected email accounts; our access to Gmail and Outlook is read-only.

• We do not change your connected cloud storage in the background; we save a document to your storage only when you explicitly initiate it.

• We do not provide other Deliberately.ai users access to your data unless you explicitly authorize it.

How We Store and Protect Your Data

• Encryption: Data is encrypted at rest using AES-256 and in transit using TLS 1.3 or higher. OAuth refresh tokens are encrypted separately from content.

• Access controls: Data is stored with user/tenant isolation and strict access controls. Access requires authentication through Auth0 with optional multi-factor authentication. Administrative access is logged, monitored, and limited to authorized personnel with a legitimate business need.

• Infrastructure security: Infrastructure is hosted on SOC 2-aligned cloud platforms (AWS and Google Cloud Platform), with security monitoring, vulnerability assessment, patch management, and incident response.

Your Control Over Your Data

• Disconnect a connector. You can disconnect any connected email or cloud-storage account at any time in Settings > Connected Accounts, or (for Google/Microsoft) through the provider's own account-permissions page. Disconnecting stops future synchronization and revokes our access; previously synced data remains in your account subject to Data Retention below.

• Delete specific items. You can delete individual emails, documents, or threads within the Platform; deletions take effect within 24 hours and do not affect the originals in the source account.

• Delete all synced data. Contact support@deliberately.ai to request deletion of all synced data; we will delete it within 30 days.

• Delete your account. In Settings > Account > Delete Account; all associated data is permanently deleted within 30 days. This is irreversible.

• Export your data. In Settings > Data Export, you can download synced data in standard formats (.eml or JSON), including metadata, content, and attachments.

Data Retention

• Active connection: Synced data is retained while your connection and account remain active.

• After disconnection: Synced data remains accessible for 30 days, is then archived, and is permanently deleted after 90 days.

• Immediate deletion: Available on request at support@deliberately.ai.

• Account deletion: All data permanently deleted within 30 days, with no recovery.

Google API Services User Data Policy Compliance

Deliberately.ai's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Specifically:

• Minimum necessary scopes. We request the minimum scopes necessary for the features you use. For email we request only read-only access (Gmail gmail.readonly; Outlook Mail.Read) and do not request scopes that would let us send, modify, or delete your email. For cloud storage we currently use read-only access; features that let you save documents back to your storage will request write access to Google Drive or Microsoft OneDrive/SharePoint, only with your authorization at the consent screen.

• Disclosed use. Google user data is used only for the features and purposes disclosed in this Privacy Policy and presented to you during the OAuth consent process.

• Limited transfer. We transfer Google user data only as disclosed in this Privacy Policy: to service-provider subprocessors under data-protection agreements (including the AI subprocessors described in AI Processing and AI Subprocessors, which process content solely to provide the features you use and do not use it to train generalized AI/ML models), to comply with law, or with your consent.

• No selling. We do not sell Google user data.

• No advertising. We do not use, transfer, or sell Google user data to serve advertisements, including personalized, retargeting, or interest-based advertising.

• No credit or lending use. We do not use Google user data for determining creditworthiness or for lending purposes.

• No training of generalized AI/ML models. We do not use Google user data, and we do not permit our AI subprocessors to use it, to develop, improve, or train generalized or foundation AI/ML models.

• Human review. Human review of Google user data occurs only with appropriate safeguards: when you request support for a sync issue, for security/abuse investigations, or when required by law. Such access is logged, limited to authorized personnel, and bound by confidentiality.

Your Choices

• Marketing communications. You can unsubscribe from promotional emails via the link provided in those emails. You will still receive administrative messages.

Third-Party Links

Our Website may contain links to third-party sites we do not control. This Privacy Policy does not apply to those sites; review their privacy policies before providing information.

Children's Privacy

We do not knowingly collect personal information from children under 18, and no part of our Services is directed to children. If you believe a child has provided us personal information, contact support@deliberately.ai.

International Visitors

Our Services are hosted in the United States and intended for U.S. users. If you use our Services from outside the U.S., you are transferring your personal information to the U.S. for storage and processing, and you consent to that transfer.

Changes to This Privacy Policy

We will post changes to this page; the revised version is effective when posted. If we materially change how we use or disclose previously collected personal information, we will notify you through the Services, by email, or by other communication.

Contact Information

For privacy-specific inquiries: privacy@deliberately.ai.
For general questions: support@deliberately.ai.