Privacy Policy

1. Scope, Who We Are, and Our Role

Handled Legal Technologies, LLC, a Nevada limited liability company doing business as Handled., is referred to throughout this Privacy Policy as "Handled." Handled. is the provider responsible for this Privacy Policy and provides the services described in this document. Questions and legal notices may be sent to [email protected].

Handled. ("we," "us," or "our") provides litigation case-management software and related services. This Privacy Policy explains how we handle information through the Handled. website, accounts, subscriptions, support, and desktop application (collectively, the "Service"). It describes information practices only; it does not expand any software license or other rights under the Terms of Service or EULA. Transaction-specific checkout disclosures control if they conflict with this Policy, and applicable law controls where it cannot be waived.

The Service is designed for professional and business use by litigation attorneys and their authorized assistants or paralegals in the United States. It is not directed to consumers acting in a personal or household capacity.

Our two roles. We handle two kinds of information in two different roles:

As a business/controller, for the limited account, authentication, license, device, billing, and support information we collect to provide the Service to you, we determine the purposes and means of processing and act as a "business" (California) or "controller" (other states).

As a service provider/processor, for the case information you enter, import, synchronize, back up, or export ("case information"), you (or your firm) are the business/controller, and we process that information solely on your behalf and under your instructions. Our processing of personal information within case information is governed by our Data Processing Addendum (the "DPA"), which is incorporated by reference. For most of that case information on Pro, we hold only a protected copy we cannot read (Section 3).

2. Categories of Information We Handle, and Why

We handle the following categories of personal information, the sources they come from, and the purposes for handling them:

• Case information. Matter names and numbers, clients, parties, counsel, courts, judges, dates, deadlines, notes, and next actions, collected from you and your authorized users, used to provide local case management and, on Pro, protected synchronization and collaboration processed on your behalf under the DPA.
• Account and authentication. Email address, account and user identifiers, authentication and session data, account roles, and login or license-revalidation records, collected from you, used to create and secure accounts and authenticate users.
• Profile and launch-list information. Your first name and, if you choose to provide them, your firm name and the states where you are licensed, collected when you create an account; and, if you join our launch list or request a resource from us, your email address and any answers you choose to give, such as the plan you are interested in and the tools you use today. Collected from you and used to set up your account, send the emails described in Section 4, and understand which practices and states our users come from.
• License, device, and collaboration. Plan and license status, device identifiers and names, device public keys, invitation addresses and status, owner and assistant roles, and registered-device records, collected from you and your device, used to validate licenses, enforce plan, seat, and device limits, and manage invitations.
• Agreement records. The version of the EULA you accepted, when you accepted it, and whether you accepted as an account owner or as an invited assistant, used to keep a record of your agreement.
• Recovery, protection, and synchronization. Wrapped key material, public keys, key-version numbers, account and matter identifiers, table and row relationships, timestamps, and deletion and synchronization state, collected from your device, used to operate protection, recovery, and synchronization; we do not receive the recovery phrase or raw account key.
• Billing. Subscription, plan, cancellation, expiration, refund, and billing-state information, collected from you and Lemon Squeezy, used to administer subscriptions, refunds, and billing and to send related notices, such as renewal reminders.
• Support communications. Email address, message, and attachments you send, collected from you, used to respond to support and privacy requests. If you start a support email from inside the application, it is pre-filled with your application version, plan, operating system, distribution channel, and when your license was last checked; you can review or remove that information before sending.
• Website and delivery. Information generated when you visit the site or download the application, including your IP address, which we keep briefly to limit repeated form submissions and protect the site from abuse, collected from you and your browser, used to host and secure the website and deliver the application; if you accept our cookie banner, also used to understand site traffic through Google Analytics (Section 8).
• Email records. The emails we have scheduled or sent to you, their delivery status, and the details they contain, such as your first name, plan, price, and renewal date, used to send account, billing, and launch-list emails and to avoid sending duplicates.

We may collect sensitive information only incidentally, within case information you control; we process it solely on your behalf under the DPA and do not use it to infer characteristics about you.

3. Where Case Information Lives

Free and Solo case information stays in the encrypted local application database on the user's computer. Those plans do not copy case content between users or computers through Handled. Pro also keeps a protected online copy so an account owner and one invited assistant or paralegal can work from authorized computers. Before upload, case content is protected on the device, and we do not hold the key required to read that protected content. We can read and process the operational account, license, device, invitation, key-wrap, and synchronization metadata described in Section 2; that metadata can reveal facts such as which account, device, record, or key version is involved and when an update occurred, though it does not reveal the protected case content itself.

The Service does not independently monitor courts or discover docket information; users supply and verify their own case information.

4. How We Use Information

We use information to: create and authenticate accounts; register devices, validate licenses, and enforce plan, seat, and device limits; provide the local application and, for Pro, store the protected online copy and synchronize authorized updates; administer invitations, subscriptions, plan changes, cancellations, and billing; protect the Service, investigate misuse, prevent fraud, troubleshoot, and maintain security; respond to support and privacy requests; and comply with law and preserve records for billing, tax, security, fraud-prevention, dispute, and legal-compliance purposes.

We do not use case information for advertising, to train machine-learning or artificial-intelligence models, or for unrelated product development. We do not use protected Pro case content for these operational purposes because we cannot read it; storing, transmitting, and synchronizing that protected content is still processing it on your behalf under the DPA.

Emails we send. We send the emails needed to run your account and subscription, such as account confirmation, password reset, welcome and getting-started messages, plan-change, cancellation, refund, and annual-renewal notices, assistant invitations, and security or legal notices. If you join our launch list or request a resource, we also email you about Handled.'s launch and that resource. You can ask us at any time to stop launch-list or other promotional emails by emailing [email protected]; account, billing, security, and legal notices continue while you have an account.

5. How We Share Information; No Sale or Sharing for Advertising

We disclose information only to the service providers and recipients below, each acting under a written contract that limits their use of the information to providing services to us:

• Supabase, authentication and storage of account, profile, launch-list, agreement, email, license, seat, device, invitation, login/revalidation, key-wrap, and protected Pro synchronization records.
• Lemon Squeezy, checkout, subscription administration, and cancellation as merchant of record; sends us billing and license events.
• Resend, sends our account, billing, launch-list, and assistant-invitation emails (processes the recipient address and the content of each email).
• Netlify, builds and hosts the website.
• GitHub, hosts application release files reached through the website's download route.
• Google Analytics (Google LLC), provides website traffic analytics, and only receives information if you accept our cookie banner; declining keeps it from receiving any information (Section 8).
• An invited assistant or paralegal, can receive future authorized access to the Pro account's case information after accepting the invitation and completing device approval; the account owner decides whom to authorize.
• Government authorities, courts, or other parties, only as Section 11 permits or requires.

A current list of our subprocessors is set out in Section 8 of the Data Processing Addendum, incorporated by reference. If you install the Windows application from the Microsoft Store, Microsoft handles that download under its own terms and privacy statement as a company you deal with directly; we do not receive your Microsoft account details. We do not sell your personal information, and we do not share it for cross-context behavioral advertising, as those terms are defined under applicable state privacy law. We have not sold or shared personal information in the preceding 12 months.

6. How Long We Keep Information

We keep each category of information only as long as reasonably necessary for the purpose for which it was collected, subject to the periods below:

• Local application data. Remains on your computer until you delete or overwrite it, or the storage is lost; we do not control or delete local data.
• Protected Pro copy and obsolete access or recovery records. Protected Pro case information and obsolete access or recovery records are automatically deleted within 30 days after leaving Pro. While an account remains on Pro, a matter you delete in the application is marked deleted in the protected online copy, and its protected content stays in that copy so that authorized devices stay consistent and a restored backup can bring it back.
• Account, invitation, device, and access records. Kept while the account is active; deleted within 30 days after account deletion, subject to the limited-retention items below. Account deletion is currently handled by request to [email protected] (Section 7).
• Billing, tax, fraud-prevention, security, dispute, and legal-compliance records. Up to seven years when reasonably needed for those purposes or required by law.
• Support communications. Kept as reasonably needed to address the request and maintain a record, and then deleted within 24 months, unless a longer period is required by law or an open dispute.
• Provider logs and backups. Retained per each provider's standard configuration; copies in provider backups expire through the provider's ordinary backup lifecycle, generally within 30-90 days.
• Launch-list entries. Kept until you ask us to remove them or we no longer need them for our launch communications.
• IP addresses used for abuse protection. Kept for about one day and then routinely cleared.
• User-created files (.lhbackup, CSV export). Controlled by you; remain wherever you save them until you delete them. A .lhbackup file made with application version 0.2.16 or later is encrypted; older .lhbackup files and CSV reports are not. None of these files inherit Pro's online protection.

7. Your Privacy Rights and Choices

Depending on your state of residence and applicable law, you may have the right to: (a) know or access the personal information we hold about you and the categories of sources, purposes, and recipients; (b) obtain a portable copy; (c) correct inaccurate information; (d) delete your information; (e) opt out of any sale or sharing for cross-context behavioral advertising (we do neither); and (f) limit the use of sensitive personal information (we use it only to provide the Service you request). We will not discriminate against you for exercising these rights.

How to submit a request. Email [email protected]. You can also review your account email, plan, and registered devices, and remove devices, on your account page at legalhandled.com. Requests to delete your account are handled by email. Because we operate online and have a direct relationship with you, email is a designated request method. We will verify your identity and authority over the account and will respond within 45 days, extendable once by an additional 45 days where reasonably necessary, with notice to you. You may use an authorized agent, subject to reasonable proof of authorization. If we deny a request, you may appeal by replying to our decision; we will respond to an appeal within the period required by your state's law.

Requests about case information. Where we hold case information as a service provider/processor on your behalf, we will direct a request we receive from an individual whose data appears in that information to you (or your firm) as the controller, and we will assist you in responding, as described in the DPA. Rights do not extend to personal information about another person that we maintain on your behalf.

You can manage information in the application, create a .lhbackup, and, on Solo or Pro, create a CSV report. A CSV report contains only a subset of application information and is not a complete backup. You are responsible for protecting, retaining, and securely deleting files you export.

A Pro account owner can remove the invited assistant or paralegal and registered devices. Removal blocks future authorized online access after the system processes it, but it does not erase case information already stored on the other person's computer or retrieve information that person already viewed, copied, exported, photographed, or otherwise retained. After an assistant is removed, the application is designed to replace the account key and re-protect the online copy when an owner device is next online, which changes the owner's recovery phrase (Section 13). This protects content going forward but cannot reach copies made before the removal.

8. Cookies and Tracking

Our website uses a small number of cookies and browser storage items that are strictly necessary to operate it: sign-in cookies that keep you signed in to your account page (lasting up to 30 days), a short-lived cookie used while you accept an assistant invitation, and browser local storage that remembers your cookie choice. Our pages also load Lemon Squeezy's checkout script so that checkout can open on our site; Lemon Squeezy may set its own cookies under its own privacy policy. If you accept our cookie banner, we also use Google Analytics to understand site traffic, such as which pages are visited and for how long. Google Analytics sets cookies and is the only third-party analytics tool we use; we do not use advertising or cross-site tracking tools of any kind, and Google Analytics is not used for advertising.

You can decline Google Analytics from the cookie banner, which keeps it from loading. To change your choice later, clear this site's local storage in your browser, which brings the cookie banner back; clearing this site's cookies also removes any Google Analytics cookies already set. You can also use Google's Analytics opt-out browser add-on. We do not sell or share personal information for advertising.

9. Where Information Is Processed

We and our service providers, Supabase, Lemon Squeezy, Resend, Netlify, and GitHub, are based in the United States, and our Supabase database is hosted in the United States. If you accept our cookie banner, Google Analytics also processes limited website-traffic information, as described in Section 8; that processing occurs on Google's infrastructure, which may include locations outside the United States. The Service is directed to users in the United States and is not offered to individuals in the European Economic Area, the United Kingdom, or other jurisdictions whose data-transfer laws would apply.

10. Business Use and Age Requirement

The Service is offered only for professional or business use by people who are at least 18 years old and have authority to create or use the relevant account. It is not directed to children, and users should not provide the Service directly to anyone under 18.

11. Legal Requests

We may preserve, use, or disclose information in response to a subpoena, court order, government demand, or other legal process only when legally required. When legally permitted, we will give the affected account owner advance notice so the owner may seek protection or otherwise respond. We may withhold notice where law prohibits it or where a legally permissible emergency, safety, security, or fraud concern makes advance notice inappropriate.

Because we cannot read protected Pro case content, our ability to produce intelligible case content from the protected online copy is limited. We may still be able or required to preserve or disclose readable account, device, license, invitation, key-wrap, synchronization, billing, support, or other operational records.

12. How We Protect Information; Reasonable Security

We implement and maintain reasonable administrative, technical, and physical safeguards appropriate to the nature of the information we handle, designed to protect it from unauthorized access, use, modification, destruction, or disclosure. The desktop application is designed to store its working database in an encrypted local database using a key held through the computer's operating-system credential store. Pro protects case content on the device before uploading it, and we do not hold the key needed to read the protected online copy. Access to online systems requires an authorized account seat and a current Pro license.

These measures reduce risk but cannot guarantee perfect security. Security also depends on users protecting their computers, operating-system accounts, credentials, recovery information, authorized devices, exported files, and access granted to others. No method of storage, transmission, authentication, or encryption eliminates all risk.

13. Recovery Information and Authorized Devices

Pro's account key and human-readable recovery phrase are generated or derived on an authorized computer. Current setup and recovery flows do not send the recovery phrase or raw account key to us. We store device-specific protected key material and related operational records, but we cannot recreate a lost recovery phrase from those records. Keep recovery information somewhere safe and separate from the computer. If an assistant is removed from a Pro account, the account key and recovery phrase change; the owner should use Reveal in the application's settings to record the new phrase, because the earlier phrase will not unlock the re-protected online copy.

A new assistant device submits a public key and displays a fingerprint that an owner device must confirm before it can synchronize; an owner may use the recovery phrase to authorize an additional owner device.

14. Security-Incident Notices

We maintain an incident-response process. If a security incident affects information for which notice is legally required, we will notify affected individuals and any regulators as required by applicable law, without unreasonable delay and within the timeframes the law requires. Where we process personal information on your behalf as a service provider/processor, we will notify you (or your firm) of a relevant incident without undue delay so that you can meet your own notification obligations, as further described in the DPA.

15. Changes to This Policy

We may update this Policy as the Service, information practices, providers, or legal requirements change. The revised Policy will identify its effective date, and we will provide additional notice or obtain consent where legally required. A change to this Policy does not itself expand rights under the Terms of Service or EULA.

16. Contact Us

For privacy questions, correction or deletion requests, or requests concerning a protected online copy, email [email protected]. For accessibility feedback, see our Accessibility Statement.