Privacy Policy

1. Information We Collect

In the course of providing the Service, we collect certain information necessary to operate, maintain, and improve OpenCase. This information falls into the following categories:

• Account information: Your email address, name, and any profile information you provide during registration or account management.
• Usage data: Pages visited, queries submitted, timestamps, IP addresses, interactions, and device and browser information collected through your use of the Service.
• Uploads and queries: Any text, documents, or legal queries you submit to the platform for processing.
• Connector data: What an AI app such as ChatGPT sends when you use the OpenCase connector (see section 5).
• Cookies and similar technologies: We use session cookies, analytics cookies, and similar tracking technologies to operate the Service, remember your preferences, and analyze usage patterns. You may manage cookie preferences through your browser settings.

2. How We Use Your Information

We use the information we collect for the following purposes:

• To operate, maintain, and provide the features and functionality of the Service
• To analyze usage patterns and improve the quality, reliability, and performance of the Service
• To personalize your experience, such as preserving past queries and autofilling preferences
• To communicate with you regarding Service updates, new features, or relevant legal industry developments
• To enforce our Terms of Service and protect against misuse, unauthorized access, or fraudulent activity

We process your information on the basis of contractual necessity (to provide the Service you have requested), legitimate interest (to improve and secure the Service), and, where applicable, your consent.

We may also use anonymized or aggregated data that cannot reasonably be used to identify you for research, analytics, and business purposes.

3. Disclosure of Information

OpenCase does not sell your personal information.

We may disclose information to the following categories of recipients:

• Service providers and vendors: Third-party providers of hosting, AI models, search, legal databases, analytics and advertising measurement, error monitoring, payment processing, and email delivery, each of whom is bound by contractual obligations to process your information only as directed and to maintain appropriate security measures.
• Legal authorities: Government agencies, law enforcement, or regulatory bodies when disclosure is required by applicable law, subpoena, court order, or regulatory inquiry, or when necessary to protect the rights, safety, or property of OpenCase, our users, or the public.
• Business transfers: In connection with a merger, acquisition, reorganization, or sale of assets, your information may be transferred to the acquiring entity. We will provide notice of any such transfer and the choices available to you.

4. AI Processing and User Inputs

When you use the Service, your queries and submitted content are processed by large language models and other machine learning technologies to generate responses. Except for the connector described in section 5, we may review inputs and outputs, both in aggregate and on an individual basis, to evaluate and improve the accuracy, safety, and performance of the Service.

All user inputs are treated in accordance with the confidentiality obligations described in our Terms of Service, including the protections applicable to attorney-client privileged and work-product materials. We do not use individually identifiable user inputs to train general-purpose AI models. Any analysis conducted for service improvement purposes uses aggregated or de-identified data wherever practicable.

5. OpenCase Connector for ChatGPT and Other AI Apps

When you use OpenCase inside an AI app such as ChatGPT or Claude:

• What it receives: only what the AI app sends for the tool you use, such as text or a document to check, a legal question, citations or quotations to verify, or a docket search. If the AI app sends a link to a file you shared, we download the file to read it for that request and do not keep it. The connector does not request or read your chat history.
• What it returns: the result of that tool, such as verified citations, the text of a legal authority, how later cases treated a case, docket filings, or an answer with its sources.
• What we keep: we do not store the text the AI app sends or the results we return. We keep a record of each tool call (the tool, the AI app, the outcome, the time and duration, and your account ID), a daily count of calls to enforce usage limits, and the citations looked up, without any link to you. Our servers log the time and IP address of each request. If a request fails, an error report can include a short excerpt of the text being processed.
• Who receives it: the service providers in section 3 needed to run the tool you use. The AI app receives the results, and its own privacy policy governs them.
• Signing in: the connector needs an OpenCase account, which you sign in to through the AI app. The app then holds a token that identifies your OpenCase account; we never receive your password for the AI app.
• Your controls: you can disconnect the connector in the AI app's settings at any time, and ask us to delete your data.

6. Third-Party Integrations

OpenCase allows you to connect third-party accounts (including Google Drive, Gmail, Clio, and Dropbox) to import documents, read mail you ask about, and synchronize data. The following applies to all supported integrations:

How We Access: We use each provider’s OAuth API to access only the files, folders, or data you explicitly select or authorize. We also access basic account information (such as your email address) to identify your connected account. For Google Drive and Dropbox, access is read-only. For Gmail, access is read-only — we read your messages only to fulfill requests you make to the OpenCase AI assistant (such as finding or summarizing emails you ask about); we never send, modify, label, or delete mail. For Clio, we access only the permissions you approve (e.g., calendar entries and/or documents).

How We Use: We use your connected account data solely to provide user-facing features within OpenCase, including importing legal documents, syncing folders, synchronizing calendar events (Clio), and processing documents for AI research. We access only data you explicitly select or synchronize.

How We Store: We securely store OAuth tokens (encrypted at rest) to maintain your connection. When you import files, we download copies to your OpenCase workspace. We store minimal metadata, such as your account email address or identifier, to identify your connected account.

How We Share: We do not sell or share your integration data with advertisers or data brokers. We may share data with service providers (under contract) for storage and processing, or as required by law. In the case of business transfers, we transfer integration data only with your explicit consent.

Your Control: You may disconnect any integrated account at any time through OpenCase settings or the relevant feature (e.g., file manager, calendar). You may also revoke access through the provider’s own account settings (e.g., Google Account permissions or Dropbox connected apps). Upon disconnection, we immediately delete OAuth tokens and cease accessing the provider’s services.

Data Retention: OAuth tokens are deleted upon disconnection. Imported files are kept until you delete them or your account. Connection metadata is retained only while your account remains connected.

Google Workspace Limited Use Compliance: OpenCase’s use and transfer of information received from Google APIs (Google Drive and Gmail) adheres to the Google API Services User Data Policy, including the Limited Use requirements. This data is used only to provide user-facing features within OpenCase; it is not used for advertising or to develop, improve, or train generalized AI/ML models; it is not transferred to others except to provide or improve those features, comply with applicable law, or as part of a merger or acquisition with your consent; and our personnel do not read it except for security purposes, to comply with applicable law, or with your explicit consent.

7. Your Rights and Choices

You have the following rights with respect to your personal information:

• Access and portability: You may request a copy of the personal information we hold about you in a commonly used, machine-readable format.
• Correction: You may request that we correct inaccurate or incomplete personal information.
• Deletion: You may request that we delete your account and all associated personal information by contacting support@opencase.com.
• Marketing opt-out: You may opt out of marketing communications at any time by using the unsubscribe link in any marketing email or by contacting us directly.
• Connections: You may disconnect the OpenCase connector in your AI app, and any integration in OpenCase settings, at any time.

We will respond to requests regarding your personal information within thirty (30) days of receipt.

8. Data Retention

• Account information: while your account is open, and deleted within 30 days of a deletion request.
• Chats: until you delete them. A deleted chat is permanently removed 30 days later.
• Uploaded and imported files: until you delete them or your account.
• Logs of questions and answers in the OpenCase web app and add-ins: 30 days in our main database, then in an encrypted archive used to evaluate quality, deleted after 2 years.
• Text sent to the connector and the results it returns: not stored.
• Connector call records and usage counts: while your account is open. Daily call counts for calls made without signing in: 90 days.
• Connector sign-in tokens: access tokens expire after 1 hour and refresh tokens after 30 days.
• Error reports: up to 90 days. Server request logs: up to 30 days.
• Billing records: as long as tax and accounting law requires.

We may keep information longer when the law requires it, or to resolve disputes.

9. Data Security

OpenCase employs industry-standard technical and organizational measures to protect your information against unauthorized access, alteration, disclosure, or destruction. These measures include encryption of data at rest and in transit, access controls limiting data access to authorized personnel, and regular security assessments of our systems and infrastructure.

While we are committed to maintaining the security of your information, no method of electronic transmission or storage is completely secure. In the event of a data breach that affects your personal information, we will notify you in accordance with applicable law.

10. Changes to This Policy

We may revise this Privacy Policy from time to time. If we make material changes, we will provide at least thirty (30) days advance notice through the Service, via email to your registered email address, or through other reasonable means before the revised policy takes effect. Non-material changes, such as formatting corrections or clarifications, may be made without advance notice.

Your continued use of the Service following the effective date of any revised Privacy Policy constitutes your acceptance of those changes. If you do not agree with the revised policy, you may terminate your account before the changes take effect.

The "Last updated" date displayed on this page will always reflect the most recent revision.

11. Contact Information

If you have questions regarding this Privacy Policy or our data practices, please contact us at support@opencase.com.