Privacy Policy

1. Introduction

Cardboard Intelligence, Inc., a Delaware corporation (“Cardboard,” “we,” “our,” or “us”), provides Cardboard Legal, an AI-powered operations platform for solo and small law practices (the “Service”). This Privacy Policy explains what information we collect, process, and share when you and your firm use the Service, and the choices and rights you have.

This Policy applies to the Service across web, desktop (Windows, macOS), and mobile platforms. Capitalized terms not defined here have the meaning given in our Terms of Service.

2. Our Privacy Architecture

2.1 Firm-Isolated Infrastructure

Each law firm using Cardboard Legal operates on a dedicated virtual machine (the “Firm VM”). Your client data, matter records, documents, communications, and time entries are stored within your Firm VM and are not accessible to or shared with other firms.

2.2 What Leaves Your Firm VM

The following limited categories may be transmitted to Cardboard: (a) account and authentication data; (b) billing data processed by our payment provider; (c) diagnostic and crash telemetry; and (d) any data you voluntarily send us, such as support messages. We do not receive copies of client files, matter content, or attorney-client communications in ordinary operation.

2.3 Desktop Observer

The optional desktop application captures the name of the active application on your machine and the duration of use (e.g., “Westlaw — 47 minutes”). It does not capture window titles, file names, document contents, email content, or screenshots. This data is processed locally within your Firm VM to generate time entry suggestions for your review.

2.4 No Training on Client Data

We do not use your client data, matter records, documents, or communications to train any shared AI models. AI features are powered by foundation models accessed via API; your matter content is used only to generate responses for you in the moment and is not retained by us or used to train models for other users.

3. Information We Process

4. How We Use Information

• To provide the Service: provision and maintain your Firm VM, power AI features, sync connected accounts, generate time entry suggestions.
• To secure the Service: detect abuse, unauthorized access, and security incidents.
• To support you: respond to questions, troubleshoot issues, and communicate about the Service.
• To improve the Service: analyze aggregated, de-identified diagnostic data to improve reliability and features.
• To comply with law: meet legal, regulatory, and contractual obligations.

5. Audit Trail

The Service maintains a tamper-evident audit log of actions taken within your Firm VM — who approved a time entry, who sent an invoice, who modified a permission. Audit logs are retained for seven (7) years within your Firm VM. Cardboard does not access audit logs except as necessary to investigate a support request you initiate or as required by law.

6. How We Share Information

• With service providers: vetted vendors (hosting, payment processing, email delivery) under confidentiality and security obligations. They do not receive matter or client data.
• With Third-Party Services you connect: when you authorize Clio, Filevine, Google, or Microsoft integrations, data flows according to the scopes you approve.
• For legal reasons: to comply with legal obligations, enforce our Terms, or protect rights and safety.
• In business transfers: in connection with a merger, acquisition, or sale of assets.

We do not sell personal information or share it for cross-context behavioral advertising.

7. Attorney-Client Privilege

Cardboard Legal is designed to support attorneys without compromising privilege. The Service does not disclose matter content, client communications, or attorney work product to third parties except at your direction (e.g., when you use the Clio or Filevine sync features). You are responsible for ensuring your use of the Service complies with your applicable rules of professional conduct regarding client confidentiality and data security.

8. Data Retention

• Matter and client data: retained in your Firm VM under your control. You may export or delete it at any time.
• Audit logs: retained 7 years within your Firm VM per Section 5.
• Account data: retained while your account is active and for a limited period after closure for legal and billing purposes.
• Diagnostics: retained for 30–90 days then deleted or de-identified.

9. Your Privacy Rights

Subject to your jurisdiction, you may have the following rights. Contact us at support@getcardboardai.com. We will respond within the timeframes required by law.

10. Security

We implement encryption in transit and at rest, access controls, least-privilege provisioning, and regular security reviews. Each firm’s Firm VM is isolated from all other firms. Because matter data lives within your Firm VM in ordinary operation, the most sensitive data never passes through Cardboard’s central systems.

11. International Transfers

Cardboard is based in the United States. Where required, we rely on Standard Contractual Clauses or equivalent safeguards for transfers from the EEA, UK, or Switzerland.

12. Contact Us

13. Changes to this Policy

We may update this Policy from time to time. Material changes will be communicated through the Service or by email before taking effect.

— End of Privacy Policy —