Privacy Policy

1. Information We Collect

In the course of providing the Service, we collect certain information necessary to operate, maintain, and improve OpenCase. This information falls into the following categories:

• Account information: Your email address, name, and any profile information you provide during registration or account management.
• Usage data: Pages visited, queries submitted, timestamps, interactions, and device and browser information collected through your use of the Service.
• Uploads and queries: Any text, documents, or legal queries you submit to the platform for processing.
• Cookies and similar technologies: We use session cookies, analytics cookies, and similar tracking technologies to operate the Service, remember your preferences, and analyze usage patterns. You may manage cookie preferences through your browser settings.

2. How We Use Your Information

We use the information we collect for the following purposes:

• To operate, maintain, and provide the features and functionality of the Service
• To analyze usage patterns and improve the quality, reliability, and performance of the Service
• To personalize your experience, such as preserving past queries and autofilling preferences
• To communicate with you regarding Service updates, new features, or relevant legal industry developments
• To enforce our Terms of Service and protect against misuse, unauthorized access, or fraudulent activity

We process your information on the basis of contractual necessity (to provide the Service you have requested), legitimate interest (to improve and secure the Service), and, where applicable, your consent.

We may also use anonymized or aggregated data that cannot reasonably be used to identify you for research, analytics, and business purposes.

3. Disclosure of Information

OpenCase does not sell your personal information.

We may disclose information to the following categories of recipients:

• Service providers and vendors: Third-party providers of hosting, analytics, AI infrastructure, and other operational services, each of whom is bound by contractual obligations to process your information only as directed and to maintain appropriate security measures.
• Legal authorities: Government agencies, law enforcement, or regulatory bodies when disclosure is required by applicable law, subpoena, court order, or regulatory inquiry, or when necessary to protect the rights, safety, or property of OpenCase, our users, or the public.
• Business transfers: In connection with a merger, acquisition, reorganization, or sale of assets, your information may be transferred to the acquiring entity. We will provide notice of any such transfer and the choices available to you.

4. AI Processing and User Inputs

When you use the Service, your queries and submitted content are processed by large language models and other machine learning technologies to generate responses. We may review inputs and outputs, both in aggregate and on an individual basis, to evaluate and improve the accuracy, safety, and performance of the Service.

All user inputs are treated in accordance with the confidentiality obligations described in our Terms of Service, including the protections applicable to attorney-client privileged and work-product materials. We do not use individually identifiable user inputs to train general-purpose AI models. Any analysis conducted for service improvement purposes uses aggregated or de-identified data wherever practicable.

5. Third-Party Integrations

OpenCase allows you to connect third-party accounts (including Google Drive, Gmail, Clio, and Dropbox) to import documents, read mail you ask about, and synchronize data. The following applies to all supported integrations:

How We Access: We use each provider’s OAuth API to access only the files, folders, or data you explicitly select or authorize. We also access basic account information (such as your email address) to identify your connected account. For Google Drive and Dropbox, access is read-only. For Gmail, access is read-only — we read your messages only to fulfill requests you make to the OpenCase AI assistant (such as finding or summarizing emails you ask about); we never send, modify, label, or delete mail. For Clio, we access only the permissions you approve (e.g., calendar entries and/or documents).

How We Use: We use your connected account data solely to provide user-facing features within OpenCase, including importing legal documents, syncing folders, synchronizing calendar events (Clio), and processing documents for AI research. We access only data you explicitly select or synchronize.

How We Store: We securely store OAuth tokens (encrypted at rest) to maintain your connection. When you import files, we download copies to your OpenCase workspace. We store minimal metadata, such as your account email address or identifier, to identify your connected account.

How We Share: We do not sell or share your integration data with advertisers or data brokers. We may share data with service providers (under contract) for storage and processing, or as required by law. In the case of business transfers, we transfer integration data only with your explicit consent.

Your Control: You may disconnect any integrated account at any time through OpenCase settings or the relevant feature (e.g., file manager, calendar). You may also revoke access through the provider’s own account settings (e.g., Google Account permissions or Dropbox connected apps). Upon disconnection, we immediately delete OAuth tokens and cease accessing the provider’s services.

Data Retention: OAuth tokens are deleted upon disconnection. Imported files are subject to our standard retention policy. Connection metadata is retained only while your account remains connected.

Google Workspace Limited Use Compliance: OpenCase’s use and transfer of information received from Google APIs (Google Drive and Gmail) adheres to the Google API Services User Data Policy, including the Limited Use requirements. This data is used only to provide user-facing features within OpenCase; it is not used for advertising or to develop, improve, or train generalized AI/ML models; it is not transferred to others except to provide or improve those features, comply with applicable law, or as part of a merger or acquisition with your consent; and our personnel do not read it except for security purposes, to comply with applicable law, or with your explicit consent.

6. Your Rights and Choices

You have the following rights with respect to your personal information:

• Access and portability: You may request a copy of the personal information we hold about you in a commonly used, machine-readable format.
• Correction: You may request that we correct inaccurate or incomplete personal information.
• Deletion: You may request that we delete your account and all associated personal information by contacting support@opencase.com.
• Marketing opt-out: You may opt out of marketing communications at any time by using the unsubscribe link in any marketing email or by contacting us directly.

We will respond to requests regarding your personal information within thirty (30) days of receipt. We retain personal information for as long as reasonably necessary to provide the Service, fulfill our contractual obligations, comply with applicable legal requirements, and resolve disputes.

7. Data Security

OpenCase employs industry-standard technical and organizational measures to protect your information against unauthorized access, alteration, disclosure, or destruction. These measures include encryption of data at rest and in transit, access controls limiting data access to authorized personnel, and regular security assessments of our systems and infrastructure.

While we are committed to maintaining the security of your information, no method of electronic transmission or storage is completely secure. In the event of a data breach that affects your personal information, we will notify you in accordance with applicable law.

8. Changes to This Policy

We may revise this Privacy Policy from time to time. If we make material changes, we will provide at least thirty (30) days advance notice through the Service, via email to your registered email address, or through other reasonable means before the revised policy takes effect. Non-material changes, such as formatting corrections or clarifications, may be made without advance notice.

Your continued use of the Service following the effective date of any revised Privacy Policy constitutes your acceptance of those changes. If you do not agree with the revised policy, you may terminate your account before the changes take effect.

The "Last updated" date displayed on this page will always reflect the most recent revision.

9. Contact Information

If you have questions regarding this Privacy Policy or our data practices, please contact us at support@opencase.com.