Legal
Privacy policy
Last updated September 6, 2026.
Scope
This policy explains how FirmReply handles personal information for firms using the service and for individuals who submit an intake form. FirmReply is an early-stage product in pilot.
What we collect
Account data (name, email, firm, role), intake submissions your prospective clients provide (name, phone, email, matter type, a short description, and how they heard about you), and missed-call text-back message logs where that feature is switched on.
Why we process it
To provide the service to your firm and to protect the public form against abuse. We do not sell personal information, and intake content is never used to train or prompt any AI model.
Controller and processor
Your firm decides what is collected and how it is used. FirmReply processes that data on your firm's instructions in order to run the service.
Retention
Lead and message records are kept until your firm deletes them or asks us to delete the firm's data. We do not currently offer configurable retention windows; if you need one, tell us.
Security
Data is sent over TLS and stored in a managed PostgreSQL database. Firms are separated by row-level security enforced in the database, so one firm's queries cannot return another firm's rows. Service credentials exist only on the server and are never shipped in the website's code. See the security page for the details and how they were verified.
Third parties
Managed database and application hosting; Twilio, where a firm has switched on missed-call text-back; a transactional email provider for new-lead alerts; and Stripe for subscription billing. We do not use advertising or analytics trackers.
Your rights
If you submitted an intake form and want a copy, a correction or deletion, contact the firm you contacted. We will assist that firm with the request.
Cookies
Strictly necessary cookies for signing in. Nothing else.
Contact
Use the contact page to reach us with any question about this policy.
Questions about this document? Use the contact page.