Privacy Policy

1. Who this covers

Two groups, with different data. If you only visit this site or book a call, sections 2 and 3 apply to you. If your firm uses the RFE Assist product, sections 4 to 6 also apply.

Your firm remains the controller of your clients’ information. We process it to provide the service and for no other purpose.

2. When you visit this website

We set one cookie, named rfea_attribution. It records how you arrived — a Google Ads click identifier and any campaign parameters in the link you followed. It lasts 90 days and is not used to build a profile of you or shared with anyone other than Google Ads when a booking is made.

This site loads Google’s tag script on every page, which is how Google Ads measures whether an ad led to a booking. Google receives the information it ordinarily collects through that script, under its own policies.

The booking form is protected by Google reCAPTCHA, which assesses whether a submission is automated. Submitting the form sends a token and the page’s hostname to Google for that check.

3. When you book a call

We ask for your name, work email, firm name, and optionally how many RFEs your firm handles each month. We store these along with the time you chose, which of our sites you booked from, and the attribution cookie’s contents if one is present.

• A calendar event is created in Google Calendar, which means Google receives your name and email address as an invitee.
• Confirmation, reschedule and cancellation emails are sent through Resend, our email provider.
• Your booking link contains a single-use token so you can reschedule or cancel without an account.
• If you arrived from a Google ad, the fact that a booking occurred is reported to Google Ads. The booking’s identifier is sent; your name and email are not.

We keep booking records so we can honor the meeting and follow up about it. Ask us to delete yours and we will.

4. When your firm uses RFE Assist

Accounts hold an email address, a display name, an optional profile photo, and a role within your firm. Signing in records the time, the method used, the IP address and the browser user-agent string, so that your firm can review account access and we can investigate suspicious activity.

Payment card numbers never reach our systems. Our payment provider holds the card; we store only the last four digits, the brand, the expiration month and year, and a reference token used to charge it.

Each firm’s data is scoped to that firm. Records carry a firm identifier and queries are restricted to it, so one firm cannot read another’s matters.

5. Documents you upload, and the AI analysis

This is the part worth reading closely, because it is the part a firm is accountable for.

• Uploaded PDFs are stored in Google Cloud Storage. The text is extracted and kept in our database alongside the file.
• Before any text is sent to an AI model, patterned identifiers are removed from a copy of it: Social Security numbers, A-numbers, passport numbers, and dates of birth where a date-of-birth label precedes them.
• That redacted copy is what the model receives. The original extracted text is retained in our database, unredacted, so the document remains usable in the workspace.
• Redaction is based on recognizing patterns. It does not remove names, addresses, telephone numbers, employer names, or an identifier written in an unusual format. Assume the model sees the rest of the document’s text.
• Analysis is performed by Anthropic’s Claude API. Anthropic processes the text to return the analysis and does not use it to train models.
• Analysis runs once per upload and is stored. We do not re-send documents to a model unless you ask for a re-analysis.

We do not use your documents, your clients’ information, or your firm’s analyses to train any model, and we do not sell or share them for advertising.

6. Who else processes your data

We use the following providers. Each is bound to process data only on our instructions.

7. How long we keep things

• The attribution cookie expires after 90 days.
• Booking records are kept until you ask us to remove them.
• Account records are kept while your firm has an account, and are marked inactive rather than erased when a user is removed, so that the firm’s own audit trail stays intact.
• Documents and analyses are kept for as long as your firm’s matter is open. We do not currently delete them automatically; if your firm needs a defined retention period, tell us and we will agree on one in writing.

8. How it is protected

• Data is encrypted in transit and at rest.
• Calendar access tokens are encrypted with AES-256-GCM before being stored.
• Session tokens are stored as hashes, so a copy of our database does not yield usable sessions.
• Access to each firm’s data is restricted to that firm, and sign-ins are logged.

No system is immune. If a breach affects your data we will tell you, and we will not wait to be asked.

9. Your choices

You can ask us for a copy of what we hold about you, ask us to correct it, or ask us to delete it. You can refuse the attribution cookie by blocking cookies for this site; the site works without it.

Requests about a firm’s client data should come through that firm, since the firm — not us — decides what happens to its clients’ information.

10. Contact

Write to [email protected]. A person reads it, and we aim to respond within five business days.

If we change this policy we will update the date at the top. If a change materially affects firms using the product, we will tell them directly rather than relying on this page.