Privacy policy
This policy explains what Firmviz collects, why, how long it is kept and what rights you have. Firmviz is operated by [Company legal name], [address] ("Firmviz", "we"). It covers this website, the demo-request form and the Firmviz service used by law firms.
1. Two roles: the firm's data and our data
When a law firm uses Firmviz, the firm decides what client and matter information goes into it and why. For that information the firm is the controller and Firmviz is its processor: we act only on the firm's instructions, under the Data processing addendum. For the information we collect for our own purposes (accounts, billing, this website) Firmviz is the controller. The sections below say which is which.
2. What we collect
2.1 Account information (Firmviz as controller)
- Name, work email address, role in the firm and the firm's name, given by the firm's administrator when an account is created.
- Sign-in records: a password hash (never the password), passkey public keys and their labels (never biometrics; those stay on your device), session identifiers, the time and network address of sign-ins and of approvals that needed a passkey.
- Preferences kept in your browser (theme, language, the assistant's position); these never leave your browser.
2.2 Firm data (the firm as controller)
- Clients, parties, matters, deadlines, time entries, invoices, trust-account entries, documents, memos, communications logs, the Court Map of each case and the audit log of every action, all entered by the firm's people or produced by the service from what they entered.
- Voice recordings made for memos or commands, which are transcribed on the server the firm uses and sealed at rest; the browser's speech recognition is never used.
2.3 Demo requests and correspondence (Firmviz as controller)
- What you type into "Book a demo": name, firm, email, phone if given, firm size and your message, with the time and network address of the request; and any email you later exchange with us.
2.4 Technical records (Firmviz as controller)
- Server logs with request paths, times, network addresses and browser type, used to run and secure the service. There is no analytics or advertising tracking on this website or in the service. See the Cookie notice.
3. Why we use it and on what basis
- To provide the service the firm has contracted (performance of a contract): accounts, sign-in, the firm's records, support.
- To keep the service secure and prove what happened (legitimate interest, and the firm's own professional obligations): the audit log, sign-in records, rate limits, scanning of uploads.
- To answer a demo request (the steps you asked us to take before a contract): we use your details to write back and for nothing else.
- To bill and to keep accounts (contract and legal obligation).
- To comply with the law, including requests from authorities that we are required to honour; where the request concerns a firm's data we tell the firm first unless the law forbids it.
We do not sell personal information, do not use it for advertising and do not use it to train any artificial-intelligence model.
4. Artificial intelligence
Firmviz's optional drafting features are off by default. A firm's administrator must turn them on. When they are on, client details are replaced by placeholders before any text is sent to the provider the firm chose, the exact text sent is shown and kept, and every output is marked as a draft until an attorney approves it. With the feature off, nothing is sent to any AI service.
5. Who else sees it
- Sub-processors that host or support the service, listed in the Data processing addendum: [hosting provider and region], [email provider for notices]. Each is bound by a written contract at least as protective as this policy.
- The firm: the firm's administrators can see the accounts and audit log of their own firm, never another firm's.
- Operator support access: Firmviz's operator can look at a firm's data only after the firm approves a time-limited support grant, and every such view is written to the audit log the firm can read.
- Authorities, when the law requires, as described above.
Each firm's data sits in its own fence: the application and the database's own row-level security both prevent one firm from reading another's records.
6. How long we keep it
- Firm data: for as long as the firm's contract lasts, then according to the firm's own retention settings; closed matters are kept for the period the firm sets, nothing is disposed of without an attorney's approval, and a legal hold blocks disposal. At the end of the contract the firm exports its data and we delete our copies within [90] days, except backups that expire on their own schedule and records we must keep by law.
- Account and sign-in records: for the life of the account and [12] months after.
- Demo requests: [12] months after our last exchange.
- Server logs: [90] days.
- The audit log: for the life of the firm's contract and [7] years after, because it is the firm's evidence of what happened.
7. Security
Uploads, memos and backups are encrypted at rest with a key per firm; connections use TLS; passwords are stored as scrypt hashes; approvals of money movements and access changes need a passkey; every action is written to a hash-chained audit log anchored outside the database; uploads are scanned before they are stored. The Security and technology page describes this in full. No system is perfectly secure; if we learn of a breach affecting your information we will tell the firm (or you, where we are the controller) without undue delay and within [72 hours] of confirming it.
8. Where it is kept
The service runs in [country / region], or on a server the firm itself controls where that is what the firm chose. If information is transferred to another country we rely on [standard contractual clauses / other mechanism].
9. Your rights
Depending on where you live you may have the right to access, correct, delete or receive a copy of your personal information, to object to or restrict certain uses, to withdraw consent where consent is the basis, and to complain to a supervisory authority. Where the information is a firm's data, send the request to the firm; we help the firm answer it. Where we are the controller, write to [privacy@firmviz.example]; we answer within [30] days and never charge for a first request. Residents of California may ask what categories of information we hold and may not be treated differently for exercising a right; we do not sell or share personal information for cross-context behavioural advertising.
10. Children
The service is for law firms and their staff. We do not knowingly collect information from anyone under 18.
11. Changes
When this policy changes we post the new version here with a new date; for changes that matter to firms we also write to their administrators at least [30] days before they take effect.
12. Contact
[Company legal name] · [address] · [privacy@firmviz.example]. [If a data-protection officer or EU/UK representative is required, name them here.]