Introduction
TwinCounsel Inc. ("we") understands that for lawyers, confidentiality is not just a preference—it is an ethical obligation. This Privacy Policy describes how we handle your data and, crucially, how we separate your client's secrets from our AI training.
1. Information We Collect
1.1 Integration Data (Email, Drive, Calendar)
To provide the Service, we require access to your connected accounts (e.g., Google Workspace, Microsoft 365). We access:
- Communications: Email headers, bodies, and attachments to identify tasks and deadlines.
- Files: Documents stored in Google Drive, OneDrive, or SharePoint relevant to an active matter.
- Calendar: Events and schedules to check for conflicts and schedule court dates.
Note: We do not store a permanent mirror of your full cloud storage. We store extracted structured data (the "Matter Graph") necessary to power the automation.
1.2 Usage Data
We collect technical logs regarding your interaction with the platform (e.g., latency, error rates, features used) to maintain system stability.
1.3 Website setup requests and product guide
When you request assisted setup, we collect your name and work email through our form-processing provider to respond and arrange onboarding. The request does not create an account, charge a card or connect an inbox. Spam-prevention providers help prevent automated submissions.
The optional AI product guide processes the speech and topics you choose to share through our AI conversation and real-time media providers. Audio/video recording and research transcript collection are disabled. Captions are shown during the conversation. Technical session metadata is used for access control, usage limits and troubleshooting; it is separate from conversation content. Please do not provide client details or case files to the website guide.
Heap analytics runs for all visitors to measure page visits and website interactions, including URLs and browser/device information. Text capture is disabled on pages with Cookie preferences. Optional product-demo analytics requires your choice and sends allowlisted events, not conversation content, form values or raw query strings. You can change your product-demo analytics choice through Cookie preferences.
2. How We Use Your Data
2.1 Service Delivery
We use your data to:
- Identify tasks, deadlines, and conflicts.
- Generate draft documents (subpoenas, emails, filings).
- Create the "Audit Trail" linking facts to sources.
2.2 AI Personalization vs. Training (Crucial Distinction)
We distinguish between Personalization and Global Training:
PERSONALIZATION (YES): We use your feedback (e.g., when you edit a draft) to learn your workspace-level preferences — writing style, templates, and matter patterns. This personalization operates entirely within your sandboxed environment and never crosses into other customers' contexts. No upstream AI model is modified by this process.
GLOBAL TRAINING (NO): We DO NOT use your Confidential Client Information or User Content to train, fine-tune, or improve foundational AI models shared with other customers.
3. Data Retention
Different records have different retention periods under Terms §§6.4, 7.3 and 7.4:
- Active matters: We retain practice context needed to provide the service.
- Raw matter files after closure: Emails, documents and files remain exportable for 90 days, after which they may be permanently deleted from active servers. We provide written notice before permanent deletion.
- Structured audit records: The Audit Graph is retained for at least five years from matter closure, or longer where required by the applicable professional rules, customer configuration or a legal hold. The Terms require advance notice before its permanent deletion.
- Deletion requests and evaluations: You may request deletion. Applicable audit-retention obligations and legal holds still apply. Evaluation content that does not convert to a continuing engagement follows the 30-day deletion provision in Terms §6.4.
- System logs: Anonymized system logs are retained for up to 12 months for security analysis.
4. Data Sharing & Sub-Processors
We do not sell your data. We share data only with:
- AI Providers: We transmit data to these providers solely to generate responses. We maintain executed Zero Data Retention (ZDR) agreements with each provider, under which they do not retain your inputs beyond a single request and do not train on your data. See twincounsel.com/subprocessors to request the full sub-processor list.
- Cloud Infrastructure: Hosting, storage and compute to operate the Service.
The marketing website also uses providers described in the website and product-guide disclosure and available-on-request register for hosting, setup requests, spam prevention and live product conversations. A product-guide conversation does not connect to your practice.
5. Security
We implement industry-standard security measures, including encryption in transit (TLS 1.2+) and at rest (AES-256). However, no method of transmission over the Internet is 100% secure.
6. API Disclosures (Google & Microsoft)
6.1 Google API Disclosure
TwinCounsel's use and transfer to any other app of information received from Google APIs will adhere to Google API Services User Data Policy, including the Limited Use requirements.
6.2 Microsoft Graph API Disclosure
TwinCounsel's use of information received from Microsoft Graph APIs will adhere to the Microsoft Publisher Agreement and applicable data usage policies. We process Microsoft user data solely to provide the user-facing features of the TwinCounsel application.
7. Your Rights
You have the right to:
- Access your personal information
- Correct inaccuracies in your data
- Request deletion of your data
- Export your data in a machine-readable format
- Object to certain types of data processing
8. State Privacy Rights
8.1 California (CCPA/CPRA)
California residents have additional rights including the right to know what personal information is collected, the right to delete personal information, and the right to non-discrimination for exercising privacy rights.
8.2 Other States (Virginia, Connecticut, Colorado)
Residents of Virginia, Connecticut, and Colorado have similar rights to access, correct, delete, and port their personal information, as well as opt out of certain data processing activities.
9. International Users
If you access the Service from outside the United States, your information may be transferred to and processed in the United States. For users in the European Economic Area, our legal basis for processing includes contract performance, legitimate interests, legal compliance, and your consent where required.
10. Changes to This Policy
We may update this Privacy Policy periodically. We will notify you of material changes by posting the updated Policy on our website and sending email notification for significant changes.
Contact Us
For privacy concerns or to request a data export, please contact us. We will respond to privacy requests within 30 days (or as required by applicable law).
Email: privacy@twincounsel.com
Address:
TwinCounsel, Inc.
84 W Santa Clara Street, 7th Floor
San Jose, CA 95113