Privacy Policy

1. Information We Collect

We collect the following categories of information:

• Account and Firm Information. When you create an account or are invited to a workspace, we collect your name, email address, phone number, profile photo, law firm name, and role within the organization.
• Workspace and Membership Data. Information about workspace configuration, user roles (owner, admin, member), workspace invitations, and membership status.
• Case Data. Information you enter about legal cases, including case details, case objects (plaintiffs, defendants, opposing counsel, medical providers, physicians, medical visits, and incidents), notes, contacts, and other structured case information.
• Uploaded Files. Documents, medical records, images, audio files, video files, emails, and other files you upload to the platform. This may include files containing Protected Health Information (PHI), attorney-client privileged communications, and other sensitive legal materials.
• AI Chat Messages. Messages you send to and receive from the AI assistant, including conversation history, file references, and search queries. Chat history is stored in our database.
• Beta Application Data. If you apply for early access, we collect your name, email, phone number, law firm name, website URL, firm size, caseload volume, and any messages you provide.
• Transaction and Billing Information. Payment information for subscription fees. We use third-party payment processors and do not store full payment card numbers on our servers.
• Automatically Collected Information. IP address, browser type, operating system, device identifiers, pages visited, features used, timestamps, and interaction patterns.
• Cookies and Session Data. We use cookies and session tokens to authenticate users, maintain your session, and ensure platform security.

2. How We Use Your Information

We use the collected information for the following purposes:

• To provide, operate, and maintain our case management platform, including file storage, case management, and real-time collaboration features
• To process your files for viewing, including text extraction and format conversion
• To generate AI-assisted analysis, summaries, and responses using your case data
• To extract text and generate search embeddings from uploaded documents for AI-assisted retrieval
• To process and manage your subscription and billing
• To send transactional communications such as workspace invitations, password resets, and security alerts
• To provide customer support and respond to inquiries
• To improve the platform, develop new features, and analyze usage trends
• To detect, prevent, and address fraud, security issues, and technical problems
• To comply with legal obligations and enforce our terms

3. AI Data Processing and Transparency

Tort uses artificial intelligence to assist legal professionals with case analysis, document summarization, medical records extraction, web-based research, and other tasks. The following describes how your data is processed in connection with AI features:

AI Processing. When you use the AI assistant for case-related queries, your case data (including chat messages, file contents, and case object data) is processed by our AI infrastructure under contractual agreements that prohibit the retention or use of your data beyond processing each request. Your data is not stored, logged, retained, or used for model training by AI processors. Your AI conversation history is stored in Tort’s own database.

Web Search Privacy. When web search is enabled, the AI may search the public internet for research purposes. Before any search query is transmitted externally, it passes through privacy safeguards designed to exclude client-identifying information. Only sanitized, de-identified queries are transmitted to search providers. Please note that this sanitization process can only check against information that has been entered into your case records.

AI Transparency. AI outputs — including summaries, analyses, citations, and extracted data — are generated using AI technology and may be inaccurate, incomplete, or misleading. All AI-generated content must be independently verified by a qualified professional before reliance. We do not use your data to train AI models.

4. File Storage and Processing

• Files you upload are stored in encrypted cloud object storage with workspace-level tenant isolation, meaning one organization’s files are logically separated from another’s.
• File metadata (name, type, size, folder structure, permissions) is stored in a separate cloud database.
• Text may be extracted from uploaded documents (such as PDFs and images) to enable AI-assisted analysis, search, and retrieval functionality.
• Vector embeddings may be generated from extracted text to enable semantic search and AI context retrieval.
• Files are accessed via time-limited, expiring secure URLs. These URLs cannot be used after expiration.
• Case data — including contacts, party records, case associations, and other structured case information — is stored in a separate cloud database with workspace-level tenant isolation.
• Tort is not a backup service. You are responsible for maintaining independent copies of all files, case data, and contact information on the platform.

5. Information Sharing and Third-Party Service Providers

We do not sell, trade, or rent your personal information to third parties. We do not share mobile phone numbers or SMS opt-in data with third parties for marketing or promotional purposes. We may share your information with the following categories of service providers who assist us in operating the platform:

• Cloud Database Provider. Stores structured data including user accounts, case data, case objects, and chat history.
• Cloud Object Storage Provider. Stores uploaded files and user avatars with encryption and tenant isolation.
• AI Processing Provider. Processes AI requests under contractual agreements that prohibit the retention or use of your data beyond processing each request.
• Email Delivery Provider. Sends transactional emails such as workspace invitations and password resets.
• Web Search Provider. Receives only sanitized, de-identified search queries when web search is enabled. Never receives client-identifying information.
• Frontend Hosting Provider. Hosts and serves the web application.
• Backend Hosting Provider. Hosts the API server and real-time collaboration infrastructure.

We may also disclose information if required by law, court order, or government request, or to protect our rights, safety, or property, or that of our users or others. In the event of a merger, acquisition, reorganization, or sale of assets, your information may be transferred as part of the transaction.

6. Data Security and Confidentiality

We understand the sensitive nature of legal case data, including attorney-client privileged information and Protected Health Information. We implement technical and organizational security measures to protect your information, including:

• Encryption of data in transit (TLS) and at rest
• Workspace-level tenant isolation (each organization’s data is logically separated)
• Case-level permission controls (owner, editor, and viewer roles)
• Secure authentication and session management
• Exclusion of client case data from application error logs and analytics

Attorney-Client Privilege. Tort is a software provider, not a law firm. You are solely responsible for evaluating whether your use of the Service — including the transmission of data through AI features — is consistent with your obligations regarding attorney-client privilege, work-product protection, and confidentiality under applicable rules of professional conduct in your jurisdiction. We process your data solely as a service provider.

Security Disclaimer. No method of transmission over the internet or electronic storage is 100% secure. While we strive to protect your information, we cannot guarantee its absolute security.

7. Protected Health Information (PHI)

The Service may be used to store and process documents containing Protected Health Information (PHI) as defined by the Health Insurance Portability and Accountability Act (HIPAA). When Tort handles PHI on your behalf, we act as a business associate. The handling of PHI is governed by a separate Business Associate Agreement (BAA) where applicable. It is your responsibility to determine whether a BAA is required for your use of the Service and to request one before uploading PHI to the platform. Please contact us at contact@tort.ai to request a BAA.

8. Data Retention and Deletion

• Account and workspace data is retained for as long as your account is active or as needed to provide the Service.
• Uploaded files are retained while your account is active. Deleted files may enter a recovery period, after which they are permanently and irretrievably deleted.
• AI chat history is stored in Tort’s database (not by the AI provider) and retained while your account is active.
• Upon account termination, your data will be retained for a reasonable export period, after which it may be permanently deleted.
• We may retain certain information as required by law or to comply with legal obligations, resolve disputes, and enforce our agreements.
• Tort is not a backup or archival service. You are responsible for maintaining independent copies of your data.

9. Your Rights and Choices

Depending on your location, applicable law (including the California Consumer Privacy Act, as amended by the California Privacy Rights Act, and similar laws in other states) may grant you the following rights regarding your personal information:

• Right to Know / Access. Request information about the categories and specific pieces of personal information we have collected about you.
• Right to Correction. Request correction of inaccurate personal information.
• Right to Deletion. Request deletion of your personal information, subject to legal retention requirements and exceptions.
• Right to Data Portability. Request export of your data in a commonly used format.
• Right to Opt Out. We do not sell or share your personal information for cross-context behavioral advertising. If this changes, we will provide an opt-out mechanism.
• Right to Non-Discrimination. We will not discriminate against you for exercising any of your privacy rights.

To exercise any of these rights, please contact us at contact@tort.ai. We will respond to verifiable requests within forty-five (45) days. We may request additional information to verify your identity before processing your request.

10. SMS Communications

By providing your phone number to Tort (such as through a beta application or account creation), you consent to receive SMS messages from Tort related to the Service, including application updates and service notifications. Message frequency varies. Standard message and data rates may apply.

Reply STOP to opt out of SMS messages at any time. Reply HELP for assistance. We do not sell or share mobile phone numbers or SMS opt-in data with third parties for their own marketing or promotional purposes.

11. Cookies and Tracking

Our platform uses cookies and session tokens to authenticate users, maintain your session, prevent fraud, and ensure platform functionality. You can control cookie settings through your browser, but disabling cookies may affect your ability to use the Service.

12. International Data Transfers

Your information may be transferred to and processed in the United States or other countries where our service providers maintain infrastructure. By using the Service, you consent to the transfer of information to countries outside your country of residence, which may have different data protection laws than your jurisdiction.

13. Children’s Privacy

The Service is designed for use by legal professionals and is not directed at individuals under the age of 18. We do not knowingly collect personal information from children. If you believe we have inadvertently collected such information, please contact us at contact@tort.ai and we will promptly delete it.

14. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated Policy on this page, updating the “Last Updated” date, and, where appropriate, notifying you via email or in-app notification. Your continued use of the Service after such changes constitutes your acceptance of the updated Policy. We encourage you to review this Policy periodically.

15. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy, our data practices, or your privacy rights, please contact us at: contact@tort.ai

By using the Tort Service, you acknowledge that you have read, understood, and agree to the collection, use, and disclosure of your information as described in this Privacy Policy.