Privacy Policy

1. Introduction

CounselAudit.ai ("we," "us," or "our") is committed to protecting the privacy and security of our users. This Privacy Policy describes how we collect, use, disclose, and safeguard information when you use our legal bill review platform and related services (the "Service").

2. Information We Collect

Account Information

When you create an account, we collect your name, email address, organization name, and role within your organization. Authentication is handled by our identity provider (Clerk).

Legal Billing Data

When you upload invoices, fee estimates, or outside counsel guidelines, or forward invoices to your organization's intake email address, we process and store this data to provide our services. This may include law firm names, timekeeper information, billing descriptions, amounts, matter details, and related correspondence.

Information from Your Outside Counsel

Where you use our work-in-progress (WIP) collection features, we send requests on your behalf to the law firms you designate and receive their responses, whether submitted through a link we provide or by reply email. Such responses may include the email address of the individual responding and any name or other details they include in their message, the network (IP) address from which a submission is made (which we use to prevent abuse), unbilled fee and disbursement amounts, expected invoice dates, notes and attachments. We process this information solely on your behalf and on your instructions, as your processor, and it may be processed by our AI sub-processor to extract the reported figures for your review.

Usage Data

We collect information about how you interact with the Service, including pages visited, features used, and actions taken. This is logged in our audit trail for compliance purposes.

Payment Information

When you subscribe to a paid plan, our payment processor (Stripe) collects your payment card details and billing address directly. CounselAudit.ai does not store or have access to full payment card numbers. We receive only a transaction reference, subscription status, plan type, and the last four digits of your card for display purposes.

3. How We Use Your Information

• To provide and maintain the Service, including invoice parsing, guideline enforcement, and billing analysis
• To process invoices using AI-powered analysis (see Section 6 below)
• To manage your account and organization settings
• To send invitation emails when you invite team members
• To send work-in-progress requests, reminders and receipts to law firms you designate
• To generate reports, track spend, and calculate savings
• To communicate with you about service updates, security alerts, and support
• To ensure security and prevent unauthorized access

4. Data Security

We implement industry-standard security measures to protect your data, including:

• AES-256 encryption at rest and TLS 1.3 encryption in transit, provided by our infrastructure partners (Supabase, Vercel, Anthropic)
• Multi-tenant data isolation: every record is organization-scoped and queries are constrained accordingly, enforced in the application layer
• Authentication via Clerk with support for multi-factor authentication
• Comprehensive audit logging of all user actions
• Configurable data retention policies with secure deletion
• Data hosted in US-East region (AWS infrastructure)

For a full description of our security controls and sub-processor certifications, visit our Security page.

5. Data Retention

You control how long we retain your billing documents. CounselAudit.ai offers configurable retention policies:

• Retain — documents kept indefinitely
• Wipe after review — source documents deleted after processing, structured data retained
• Wipe, keep structured — source documents deleted, only parsed line items and metadata retained

You may request deletion of your account and all associated data at any time by contacting privacy@counselaudit.ai.

6. Artificial Intelligence & Automated Processing

CounselAudit.ai uses artificial intelligence to assist with:

• Parsing uploaded invoices to extract line items, timekeepers, and amounts
• Flagging potential billing guideline violations and anomalies
• Drafting outside counsel guideline clause language
• Generating review letters for outside counsel communication
• Extracting rules from uploaded guideline documents
• Extracting reported figures from law firms' work-in-progress responses
• Answering visitor questions through the chat assistant on this website

Website chat assistant: the chat widget on this website is an AI assistant. Messages you type into it are sent to our servers and processed by Anthropic's Claude API to generate a reply. We log chat questions and answers (with a random per-tab conversation identifier, not your identity) to improve our answers and our website content. Your contact details are stored only if you choose to submit them through the chat's contact form. The conversation itself is kept in your browser's session storage and is cleared when you close the tab. Nothing is sent to our servers until you actively send a message.

Important: AI-generated content is provided as a tool to assist human decision-making and should always be reviewed for accuracy. CounselAudit.ai is not a law firm and does not provide legal advice. All AI outputs are suggestions that require human review and approval before action is taken.

We use Anthropic's Claude API for AI processing. Anthropic does not use API inputs or outputs to train its models. Anthropic deletes API data within 30 days, except where it must keep data longer to comply with law or because its trust and safety systems flagged it (up to 2 years). Enterprise customers can request Zero Data Retention (ZDR) through privacy@counselaudit.ai.

7. Data Sharing

We do not sell your data. We share data only with:

• Service providers who assist in operating the Service (hosting, authentication, email delivery, AI processing, payment processing)
• Within your organization — team members you invite can access shared organizational data based on their role permissions
• Legal requirements — if required by law, subpoena, or government request

8. Your Rights

Depending on your jurisdiction, you may have the right to:

• Access your personal data
• Correct inaccurate data
• Request deletion of your data
• Export your data in a portable format
• Opt out of certain data processing
• Withdraw consent for data processing

To exercise any of these rights, contact privacy@counselaudit.ai.

9. Cookies & Analytics

The CounselAudit.ai application (app.counselaudit.com) uses essential cookies for authentication and session management.

Our public marketing website (www.counselaudit.com) uses two analytics services:

• Google Analytics 4 provides aggregate site analytics with IP anonymization, and with Google Signals and ad-personalization data sharing disabled. It sets cookies, so it loads only after you grant consent via our cookie banner. Google Privacy Policy.
• Vercel Web Analytics provides aggregate page-view and referrer counts. It is cookieless and sets no identifiers on your device, so it runs for every visitor, whether or not you answer the banner. Vercel Privacy Policy.

We do not use any third-party visitor-identification or de-anonymization services on our website.

Legal basis & control: for Google Analytics, consent, recorded via the cookie banner. It does not load until you click "Accept analytics", and choosing "Reject" keeps it off. Vercel Web Analytics counts page views without cookies or identifiers and is not affected by the banner. You can withdraw consent at any time on the cookies page.

10. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of significant changes via email or an in-app notice. Continued use of the Service after changes constitutes acceptance.

11. Contact Us

If you have questions about this Privacy Policy or our data practices, contact us at:

CounselAudit Inc.
Email: privacy@counselaudit.ai
Support: support@counselaudit.ai