DocketBuddy Privacy Policy

We collect only the categories needed for the selected service:

Information comes from users and their authorized firm staff or clients. It may also come from a connected service, a public court or agency source, or normal website use. Do not provide information about another person unless you have authority to do so.

• Provide authentication, client intake, matter management, document storage, deadlines, billing, communications, and support.
• Retrieve USCIS, EOIR, court, and other official information requested by a user.
• Generate user-requested drafts, analyses, summaries, and search results. AI output remains subject to attorney review.
• Process payments and operate integrations that the user chooses to connect.
• Secure the service, prevent abuse, investigate errors, keep audit records, and meet legal obligations.
• Improve reliability and usability through limited operational measurements and user feedback.

We do not use client or matter data to train a third party's general AI model. We do not use that data to serve other customers or for advertising.

We may create aggregated or de-identified measurements for security, reliability, capacity planning, and product quality. We remove direct identifiers and do not try to re-identify this information. We do not sell it or provide it to marketers.

Provider handling of aggregated or de-identified information depends on the applicable service terms. The provider-specific limits below also apply to this information; removing identifiers does not establish training exclusion or zero retention.

Information is shared only as needed with these entities:

• Supabase: Authentication, database, and private file storage. Account, firm, client, matter, and stored-file data needed to operate the workspace. Relationship: required service provider.
• Railway: Backend application hosting and delivery. Requests sent to the backend, response metadata, and operational logs. Relationship: required service provider.
• Vercel: Website hosting and delivery. Web requests, delivery metadata, and operational logs. Relationship: required service provider.
• Anthropic: Selected AI-assisted analysis, drafting, and Preflight extraction. The prompts, client or matter context, and authorized document text needed for the feature the user runs. Relationship: selected feature or integration.
• Google Gemini API: Ready document and public voicemail processing. Authorized Ready files or public voicemail audio and the instructions needed for the requested classification, extraction, transcription, or file-quality work. Relationship: selected feature or integration.
• Resend: Transactional email and account notices. Recipient addresses, names, delivery metadata, and email content. Relationship: required service provider.
• Stripe: Subscription and invoice processing. Account billing details, payment status, and transaction records; DocketBuddy does not store full payment-card numbers. Relationship: required service provider.
• Sentry: Error detection, security diagnostics, and reliability monitoring. Error and performance reports. The main application removes request bodies, cookies and authorization headers; worker diagnostics may still contain filenames, storage paths and account identifiers.. Relationship: required service provider.
• Voyage AI: Search within material a firm deliberately adds to its knowledge base. Knowledge-base text and the search terms entered in that feature; structured client records and ordinary client-file uploads are not added automatically. Relationship: selected feature or integration.
• Twilio and Telnyx: Text messaging when a firm enables that channel. Sender and recipient phone numbers, message content, and delivery metadata. Relationship: selected feature or integration.
• LawPay/AffiniPay: Firm-enabled client payment processing. Payer, invoice, payment, and transaction details needed for the payment the user authorizes. Relationship: selected feature or integration.
• DocuSign: Electronic signatures when a firm connects the integration. Documents sent for signing, signer name and email address, and envelope status. Relationship: selected feature or integration.
• Google Calendar, Clio, and QuickBooks: Calendar, practice-management, and accounting functions a user chooses to connect. Connection tokens and the specific calendar, matter, contact, invoice, or accounting data needed for the authorized action. Relationship: selected feature or integration.
• Microsoft Clarity and Vercel Analytics: Limited usage and performance analytics on public marketing pages and the no-signup demo. Public-page interaction, referral, device, and performance data; signed-in attorney workspaces are excluded from Clarity session replay. Relationship: public-site analytics.
• USCIS and EOIR: Official immigration case-status and agency information requested by a user. The receipt number, case identifier, or credentials needed for the lookup or monitoring the user requests. Relationship: user-directed source.
• CourtListener/RECAP and PACER-related services: Court and docket information requested through bankruptcy and litigation features. The docket number, court identifier, search terms, or connected-service credentials needed for the requested court-data action. Relationship: user-directed source.

Provider contracts and terms govern their processing. Anthropic’s commercial API and Google’s paid Gemini API exclude submitted data from general model training. We have not confirmed Voyage’s production training setting and cannot promise training exclusion or zero retention for knowledge-base documents or searches. Use non-confidential reference material only for that feature. The retention table below describes the current limits. Government sources and user-directed integrations have their own terms.

We do not sell personal information, client data, matter data, or de-identified data. We do not exchange it for money or any other valuable consideration. We have not sold this information in the preceding 12 months. We do not share personal information for cross-context behavioral advertising. We do not provide it to data brokers, marketers, or ad networks.

• Required processing: Hosting, authentication, security, and storage are necessary to operate an account. The account cannot operate without them.
• Optional integrations: A user chooses whether to connect services such as Clio, Google Calendar, QuickBooks, DocuSign, or LawPay. The user may disconnect them in account settings.
• Agency and court lookups: We send a receipt number or case ID to the selected official source. We do so only when the user requests a lookup or turns on monitoring.
• Communications: Users may manage optional email and text preferences. Security, billing, and account notices cannot be disabled while an account is open.
• New uses: We will request active consent before disclosing information for a materially different purpose.

Sharing can make status checks, calendars, payments, and case work faster. It also gives another provider the minimum information needed to perform that task. Disabling a connection reduces that exposure, but the connected feature will stop working or become less useful.

Legal matters may contain information about clients, relatives, or dependents. They may also name medical providers, witnesses, opposing parties, or other contacts. Sharing family history, health information, or genetic information can reveal facts about relatives. It can also reveal facts about the person named in the record.

The person or firm entering that information must consider those effects and obtain any required permission. Provider processing is subject to the terms and limitations described above, including the unresolved knowledge-base training setting.

We use encryption in transit and at rest. We also use tenant-level database controls, sign-in checks, optional multi-factor authentication, access limits, monitoring, backups, and secret controls. No system can guarantee perfect security.

If we confirm a breach that affects a user's information, we will give notice as required by law. We will do so without unreasonable delay. The notice will explain what happened, the information involved and the steps we took. It will list actions the user should consider and how to contact us. We will also notify law firms when their client or matter data is affected so they can meet their own duties.

Account and matter information is retained while the account is open, including when an open account is dormant. We do not delete an open account solely because the user has not signed in. This lets law firms maintain continuity and meet record-keeping duties.

A user may permanently close an account at any time. In the attorney workspace, open Settings, choose Security, and select Delete account. Confirm the account email, enter DELETE, and accept the deletion warning. A user may also emailhello@docketbuddy.org.

The account is disabled when the request is submitted. The user has seven days to cancel through support. Permanent deletion runs within 24 hours after that period, so deletion is completed within eight days of the request. It removes the authentication account and client or matter records. It also removes stored files, connection tokens, and other account-linked data.

Before requesting deletion, the user must export records that professional rules require the user to keep. The user must also return or transfer any client trust funds. We may retain a minimal record only when law requires it. We may also keep a minimal record to prove deletion, prevent fraud, resolve a dispute, or enforce an agreement. Such records are isolated, not used for the service, minimized, and deleted when the legal need ends.

We will notify users before client or matter information is transferred. This applies to a sale, merger, closure, or change of control. A successor must agree in writing to protections that align with this policy. We will not transfer the information for a materially different use without active consent.

Before a transfer, users will be offered a reasonable way to export their information or request permanent deletion. Health and medical information may be securely downloaded or destroyed. It may also be sent to a destination chosen by the lawful controller. We will notify users when the ownership change takes effect and identify the new responsible entity.

Users may ask to know, access, correct, or export their personal information. They may request deletion or limit use of sensitive information. They may also object to a sale or advertising share. We do not sell or share information for advertising. We will not discriminate against a user for exercising a privacy right.

These choices are available whether or not the California Consumer Privacy Act currently applies to Buddy Labs. California residents may also use an authorized agent and may appeal a denied request by replying to our decision. We honor browser-based opt-out signals when applicable. This includes Global Privacy Control, even though we do not sell or share data for advertising.

Submit a request through account settings, emailhello@docketbuddy.org, or write to the address below. We verify requests to protect the account. We respond within the time required by applicable law and explain any request we cannot complete.

We show registered users a plain-language summary before a material privacy policy or terms change takes effect. The user must open the notice and check an acceptance box. The user must then select Accept and continue. We record the policy versions and acceptance time. Continued use alone is not treated as active consent to a material change.

A user who does not accept may stop using the service and request export or deletion. Minor changes, such as correcting a typo or updating contact details, may be posted without a new acceptance request.

DocketBuddy accounts and public tools are not directed to children under 18. A legal matter may contain information about a minor. An authorized adult or legal professional must provide it for that matter.

Buddy Labs LLC, d/b/a DocketBuddy
1445 Woodmont Ln NW #613
Atlanta, GA 30318
hello@docketbuddy.org

See the DocketBuddy Terms of Service.