Privacy Policy

1. Information We Collect

Personal Information

• Name and contact information (email, phone number)
• Professional information (firm name, title, billing rates)
• Account credentials
• Payment information (processed securely through third-party providers)

Activity Data

• Calendar events and meeting data
• Email metadata (sender, recipient, subject, timestamp)
• Time entry narratives and billing codes
• Document access logs and file names

2. How We Use Your Information

• Provide and maintain the Service
• Generate time entries and billing narratives
• Process transactions and billing
• Send administrative updates
• Provide customer support
• Improve our services

3. Data Security

We implement industry-standard security measures to protect your data:

• 256-bit encryption for data in transit and at rest
• Regular security audits and penetration testing
• Strict access controls and authentication
• 24/7 security monitoring

4. Your Rights

• Access and receive a copy of your personal information
• Correct inaccurate or incomplete information
• Delete your personal information (subject to legal requirements)
• Data portability - receive your data in a structured format
• Opt-out of marketing communications

5. Data Retention

We retain your data only as long as necessary to provide our services and fulfill the purposes outlined in this policy. Upon account termination, we will delete your data within 30 days, unless legally required to retain it.

6. Third-Party Services

We use the following third-party services to operate our products. Each is bound by data processing agreements and is only permitted to use your data to provide services to us:

• Microsoft 365: Authentication, email, calendar, and file integrations
• OpenAI: AI analysis and transcription
• Mistral: AI analysis and audio transcription
• Render: Infrastructure, hosting, and database
• Supabase: File and document storage
• Resend: Transactional email delivery
• PostHog: Product analytics (anonymized usage data only)
• Radar: Geolocation and travel time calculations
• CourtListener: Public judicial data
• Apple: App distribution and subscription billing (Depositions app)

7. Addendum: Serva Depositions

The following additional terms apply to users of the Serva Depositions iOS application.

Additional Data We Collect

• Microsoft 365 account credentials (via OAuth—we never see your password)
• Audio recordings of depositions captured through the App
• Transcriptions generated from audio (on-device and cloud-processed)
• AI-generated analysis including summaries, contradiction reports, and Q&A results
• Deposition titles, dates, participant names, tags, notes, and annotations
• Subscription status and billing identifiers (managed by Apple)
• Device type, operating system version, app version, and crash reports

On-Device vs. Cloud Processing

Serva Depositions uses a hybrid processing model:

• On-device: Initial audio capture and real-time transcription occur on your device. This data remains local until you choose to use cloud features.
• Cloud processing: When you use AI analysis features (contradiction detection, executive summaries, interrogation), audio and transcript data are transmitted to our secure servers for processing. Data is encrypted in transit and at rest.

AI Provider Data Practices

Our AI sub-processors (OpenAI and Mistral) do not use data submitted through their APIs to train or improve their models. This is guaranteed by their respective API terms of service. Both providers may retain inputs and outputs for up to 30 days solely for abuse and safety monitoring, after which data is deleted. Neither provider uses your deposition content for any purpose other than generating the requested output and complying with their safety obligations.

8. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any material changes by posting the new policy on this page and updating the effective date.