Privacy Policy

FLIS · Last updated: September 12, 2026

1. Two kinds of information, and who controls each

Firm data. Everything a subscribing firm puts into FLIS or connects to it: matters, clients, documents, billing records, emails, calendar entries, and the analysis FLIS produces from them. The firm controls this data. We process it only to provide the service to that firm, and only as the firm directs. Where privacy law distinguishes a controller from a processor, the firm is the controller and we are the processor.

Account data. What we need to run the service itself: the name and email address of each person with a login, their role at the firm, sign-in timestamps, and records of administrative actions. We control this data.

2. What we collect

From a firm and its users:

• Account information: name, email address, role, and firm.
• Firm content: matters, documents, notes, time entries, invoices, client records, and anything else a user enters or uploads.
• Connected account content, if the firm chooses to connect one: calendar events, and email messages the firm directs FLIS to read. See section 4.
• Service records: sign-in events, actions taken in the application, and technical logs necessary to operate and secure the service.

We do not collect information from people who are not users of FLIS, except where a firm's own client or counterparty submits information through a form or portal the firm sends them. That information belongs to the firm and is treated as firm data.

We do not buy information about you from anyone, and we do not sell information about you to anyone.

3. What we do with it

We use firm data only to provide FLIS to the firm that owns it: to display it, organize it, search it, analyze it at the firm's request, generate documents and reports from it, send messages the firm asks us to send, and keep it secure and backed up.

We use account data to authenticate users, enforce access rules, provide support, bill the firm, and monitor the health and security of the service.

4. Google account data

If a firm connects a Google account, FLIS requests only the permissions it needs for the features the firm turns on, and asks for the narrowest version of each:

• Calendar (read only). To show the day's events alongside the firm's matters. FLIS does not create, change, or delete calendar events.
• Sign-in (name, email address, profile). To identify the user.

Where a firm enables the mail features, FLIS requests read access to the connected mailbox in order to associate messages with matters, and the ability to create drafts. FLIS does not send email from a connected mailbox; a draft is created for a person to review and send.

FLIS's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Specifically:

• Google user data is used only to provide or improve the features the firm has enabled.
• Google user data is not transferred to others except as necessary to provide those features, to comply with law, or as part of a merger or acquisition in which the firm receives notice.
• Google user data is not used for advertising.
• Google user data is not used to train generalized artificial intelligence models. Where a firm's mail or calendar content is analyzed to produce an answer for that firm, that analysis is performed under agreements that prohibit the provider from training on it.
• No human at FLIS reads Google user data except where the firm asks us to in order to resolve a support issue, where we are required to by law, or where it is necessary to investigate a security incident or abuse.

A firm can disconnect its Google account at any time from within FLIS, and can revoke access at any time from its Google account settings. On disconnection, FLIS deletes the stored authorization and stops accessing the account.

5. Service providers

FLIS runs on Google Cloud Platform and Firebase (hosting, database, storage, authentication, and computing), in the United States.

To provide specific features, FLIS sends content to these providers:

• Anthropic and OpenAI, to analyze documents and draft text at the firm's request. Content sent for analysis is not used to train their models.
• Twilio SendGrid, to deliver email the firm asks FLIS to send, and to receive mail addressed to a firm's FLIS address.
• Dropbox Sign, for electronic signature, where the firm uses that feature.
• AssemblyAI, to transcribe audio a firm uploads, where the firm uses that feature.
• Google Maps and Google Document AI, for address lookup and document text extraction.

Each receives only what is necessary for its function. We do not authorize any of them to use firm data for their own purposes.

6. Where the data lives

Firm data is stored in the United States. We do not move it elsewhere.

7. Security

Access to firm data is controlled by the firm. Each firm's data is separated from every other firm's at the database level, and access rules are enforced by the database itself rather than by the application alone. Data is encrypted in transit and at rest. Administrative actions are logged.

We do not access a firm's data as a matter of course. Where we need access to resolve a support issue, a firm administrator grants it for a limited period, and every access under that grant is recorded.

No system is perfectly secure. If a breach affects a firm's data, we will notify the firm without undue delay and cooperate with its own notification obligations.

8. How long we keep it

We keep firm data for as long as the firm's account is active. A firm can export its data at any time, and can ask us to delete it. On termination, a firm may request deletion, and we delete the data within thirty days except where law requires us to retain it. Backups roll off on their own schedule, within ninety days.

Account data and administrative logs are kept as long as the account is active, and for a reasonable period afterward for security and legal purposes.

9. Your rights

Depending on where you live, you may have the right to access, correct, delete, or receive a copy of personal information about you, and to object to or restrict certain processing.

If you are a user at a subscribing firm, that firm controls your firm data; ask the firm first, and we will assist the firm in responding. For account data, or if you cannot reach the firm, write to bfaino@fainolaw.com and we will respond within thirty days.

We do not sell personal information, and we do not share it for cross-context behavioral advertising.

10. Children

FLIS is software for law firms. It is not directed to children, and we do not knowingly collect information from anyone under 16.

11. Changes

If we change this policy in a way that materially affects how firm data is handled, we will notify subscribing firms before the change takes effect. The date at the top of this page shows when it was last revised.

12. Contact