Privacy policy

The firm is controller of its client and matter data. The LegalTrack operator is processor of that data to run the software, and controller of user-account data (name, email, authentication and LegalTrack subscription billing).

We process account data, subscription payment data, technical logs (IP, date, errors) and the data the firm uploads (clients, cases, documents, deadlines, time entries and log). If you connect Google Calendar, we also process the Google account data described in section 4. We do not sell case data.

To provide the service we rely on these providers, which receive only what their function needs: Contabo (hosting of the server and of the encrypted backups), Paddle (subscription billing; card data is processed by Paddle and never passes through LegalTrack), Mailtrap (transactional email such as invitations, notices and password recovery), Sentry (technical error monitoring) and Google (Google Calendar, only if you connect it, and cloud storage for the backups, which are stored encrypted). If the firm connects its own messaging services (for example SMS or WhatsApp) or artificial intelligence services, the data is sent to those providers under the firm's own account and responsibility. We do not sell personal data or share it for advertising.

LegalTrack offers an optional Google Calendar integration. If you choose to connect it, Google asks you for two permissions: view and edit events on your calendars (calendar.events) and view your Google email address (userinfo.email). We use the first one only to create, update and delete, in your primary calendar, the events LegalTrack generates (deadlines, hearings and appointments) and, if you choose, to invite attendees; we do not read or store the other events on your calendar. We use the second one only to show you which Google account is connected. From Google we receive and store only the access tokens, your Google email address and the identifier of the events we create.

We do not sell, rent or share Google user data with third parties, and we do not transfer or disclose it, except in these cases: (1) the guests you add to an event receive the Google Calendar invitation; (2) the hosting provider that runs our servers under our instructions, where that data and its backups are stored encrypted; (3) when the law requires it, to protect security or to investigate abuse; and (4) with your express consent.

LegalTrack's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We use Google data only to provide the calendar feature described here; we do not use it for advertising or to train artificial intelligence or machine learning models, and no person reads it except with your consent, for security or abuse reasons, or to comply with the law.

How we protect the data: Google access and refresh tokens are stored encrypted in the database (AES-256) and never in plain text; all communication with Google and with LegalTrack is encrypted with TLS (HTTPS); each firm's data is isolated from every other firm's and access is controlled by roles and permissions; backups are encrypted before they leave the server; administrative access to the server requires a cryptographic key (no password) and blocks repeated attempts; and only authorized operator staff can access the infrastructure.

You can disconnect Google Calendar at any time from LegalTrack's Agenda: we revoke the permission with Google and delete your tokens immediately. You can also withdraw access from your Google account (myaccount.google.com/permissions). Events already created stay on your calendar until you delete them. We keep the tokens only while the connection is active and they are deleted when the firm's account is closed. To request deletion of your data, write to the operator's email shown at the bottom of this page.

You may request access, correction, deletion or portability via the operator email. The firm handles its own clients' rights. Data is kept while the account is active plus backup and legal retention windows.

We use strictly necessary cookies and local storage: sign-in session, language and your choice on this notice. We do not use advertising or commercial tracking cookies. Clearing browser cookies may sign you out.