Privacy Policy

Advocate AI Tech Inc. ("Advocate", "we", "us") provides an AI workspace for trial lawyers. This Policy explains how we handle personal data when you visit theadvocate.ai, use the workspace at attorneys.theadvocate.ai, or otherwise deal with us. Capitalized terms not defined here (including Customer, Authorized Users, Services, Outputs, Subprocessor, Security Incident, and Content Commitments) have the meanings given in our Terms of Service (the "Terms"). The data-processing and security provisions are in section 19 and Schedules A–C of the Terms.

This Policy is a notice of our practices, not a contract. The binding commitments about Customer Content are in the Terms; this Policy summarizes and cites them.

The short version for attorneys

Do you train AI on my case files? No. We do not use Customer Content to train or otherwise improve any AI model, ours or anyone else’s, and we contractually prohibit our Subprocessors from doing so. (Terms, section 4.)

Who at Advocate can see them? Only personnel you specifically authorize to view identified content to resolve an identified support issue or bug, or when the law requires. A general support inquiry or bug report does not authorize viewing. Access is limited, recorded, and ends when the task is complete or authorization is withdrawn. (Terms, section 4.)

Who else processes them? Subprocessors provide cloud hosting and storage, case analysis and document/media processing, Live Hearing transcription, text embeddings, and retrieval storage. We may add or replace them under the Terms. Their identities and processing details are available privately on reasonable request. We provide proactive disclosures, change notices, and opportunities to object where required by applicable law or a binding customer agreement. (Terms, section 19.4 and Schedule B.)

Where are they stored? In the United States, using managed cloud storage and database services. (Terms, Schedule B.)

What if someone subpoenas you for my files? We send the requester to you, tell you before we disclose anything unless the law forbids it, and resist improper demands. We never volunteer Customer Content to law enforcement, prosecutors, or an adverse party. (Terms, section 5.)

Can I delete everything? Yes. Delete a file, a matter, or everything at any time, and we delete it from active systems within 14 days after your request. If you close your account, you first have 30 days to export, subject to the narrow restrictions and any extension in Terms section 11.3, and the 14-day deletion period runs after that window. Backups clear within the further period stated in section 8. We confirm deletion in writing on request. (Terms, sections 11 and 19.6.)

1. Scope and roles

We handle two kinds of data in two different roles.

Account Data and website data: we are the controller

"Account Data" means registration, contact, billing, support, and usage data about Customer and Authorized Users for which Advocate is the controller. We are also the controller of data about visitors to our public website and people who contact us. Sections 2, 3, 5, 6, 9, 10, and 11 describe that data.

Customer Content: we are a service provider or processor

"Customer Content" means all materials that Customer or its Authorized Users submit to, record with, stream through, or import into the Services, in any format (documents, images, video, audio, live audio streams, transcripts, prompts, messages, notes, and metadata such as matter, file, and party names), together with all Derived Content. "Derived Content" means everything the Services generate from Customer Content, including transcripts, summaries, analyses, element and evidence mappings, timelines, entity maps and dossiers, flags, extracted frames and clips, indexes, embeddings, caches, and the portions of prompts and model outputs that contain Customer Content. Video, including body-worn camera footage, is expressly included.

For Customer Content, Advocate is a service provider or processor acting on the Customer’s instructions under the Terms. The attorney or office that holds the account is the controller, or a processor for its own client. This Policy does not give Advocate any rights over Customer Content. Customer Content is typically confidential and often privileged or subject to court orders, and we treat all of it as confidential regardless of its source. Sections 4, 7, and 8 summarize the Terms. If this Policy conflicts with the Terms, the Terms control, subject to Commitment G: where a provision conflicts with the Content Commitments, the provision more protective of Customer Content controls.

If you appear in a customer’s case materials

Customer Content can include information about clients, defendants, victims, witnesses, minors, police officers, experts, judges, court personnel, opposing counsel, and bystanders. The attorney or office handling the matter, not Advocate, decides how those materials are used. Please direct any request to that attorney or office. We do not search Customer Content to locate individuals, and we will not confirm or deny whether any customer holds material about you. If your request names an attorney or office, we will pass it along if that attorney or office is a customer, without telling you whether it is.

2. Information we collect as controller

• Account and profile. Name, email address, phone number, organization, role or title, and account settings. Sign-in is provided by a dedicated authentication provider, which handles log-in credentials and login events for us. If an organization administrator invites you to its account, the administrator gives us your email address and may also give us your name. If a colleague refers you, the colleague gives us your email address only (see "Referral invitations" below).
• Communications and support. What you send us by web form, email, phone, or in-product support, including feedback and any testimonial you agree to give. Demo bookings go through a demo-booking provider, which collects your name, email address, and scheduling details. Do not send case materials by email or attach them to feedback; use in-product support access instead. If you nevertheless do, we treat the material as Customer Content under the Content Commitments, view it only with your specific authorization under the Content Commitments, use it only for that authorized support request, and delete it from the support channel when the request is closed where the tool allows.
• Prospective users. Business contact details of legal professionals (name, firm or office, email address, phone number) from public professional sources such as bar directories and firm websites, used only to tell them about the Services. We do not add information from public sources to the profiles of existing account holders.
• Billing. We collect a billing contact and payment details at checkout through a payment processor. The payment processor holds full payment card data; Advocate does not store it.
• Referral invitations. If you use the referral program, you give us a colleague’s email address (up to five colleagues). We use it only to send the invitation and at most one reminder, each identifying you as the referrer, and for nothing else unless the colleague signs up. The referral program section of the Terms describes storage credits.
• Optional calendar connection. If you connect a supported calendar, the connection is read-only. We use the calendar connection only to show your calendar and schedule events for you within the workspace. Advocate personnel do not review your calendar data. The connection itself (provider, calendar account, and authorization) is Account Data. Imported event details can name clients and matters, so they fall within the definition of Customer Content and are handled under the Content Commitments.
• Device, log, and usage data. IP address, device and browser type, operating system, language, timestamps, login events, feature-usage events, and performance and error data. Usage data means events and metrics that contain no Customer Content (for example feature-usage counts, latency, and error rates). Matter, file, and party names are Customer Content, not usage data.
• Cookies. See section 5.

3. How we use Account Data

• To provide and secure the Services: create and administer accounts, authenticate users, apply organization permissions, prevent fraud and abuse, and troubleshoot.
• To provide support and respond to requests.
• For product analytics and improvement, using usage data only, never Customer Content.
• To send service messages (security alerts, notices of changes, account messages) and product-update emails.
• For marketing, on an opt-out basis. You can unsubscribe from any marketing email using the link in it; service messages continue. We also sponsor emails sent by bar associations. The association sends those to its own list, and we do not receive the list. We publish attorney testimonials only with consent, which can be withdrawn for future uses.
• For legal compliance, and to establish or defend legal claims.

Advocate does not use Account Data or Customer Content to train AI models. We do not make decisions about account holders based solely on automated processing that produces legal or similarly significant effects.

4. AI processing of Customer Content

What the AI features do

Customers upload case records: discovery, police reports, body-worn camera and other video, audio, transcripts, filings, exhibits, and medical and psychiatric records. At the Customer’s direction, AI models analyze those records and produce case summaries; charges broken into elements quoted from model jury instructions; evidence that supports or undermines each element, with citations to the record; available defenses; timelines and current posture; a map of the people and entities in the record, with per-person dossiers exportable to PDF; and video analysis (key moments, transcripts, and multi-camera sync).

Outputs about people in the record are generated only from that Customer’s own materials, for that Customer’s use. Advocate makes no decisions about those individuals, does not build profiles of them for itself, and does not combine one customer’s materials with another’s. Outputs are analysis for attorneys, who review them and make every professional decision. Outputs can be wrong; the AI Outputs section of the Terms explains their limits.

Customer Content may include information about minors and sensitive information such as health records and criminal history. The Customer is responsible for its authority to submit these materials. Section 19.7 of the Terms states our positions on HIPAA, 42 C.F.R. Part 2, state-protected records, and criminal justice information.

The Content Commitments in plain language

The Content Commitments are in section 4 of the Terms, which controls. In summary:

• No training. We never use your case files, or anything derived from them, to train or improve any AI model, and our Subprocessors may not either.
• No other use. We use them only to run the Services for you, follow your instructions, provide support you specifically authorize under the Content Commitments, and meet the legal duties stated in the Terms. No advertising, no sale.
• No mixing. Each customer’s content is kept separate. Your content never shapes another customer’s results, even if we serve the other side.
• No browsing by staff. Our personnel do not look at your content on their own initiative. They may view identified content only with your specific authorization to resolve an identified support issue or bug, or when the law requires. A general inquiry or bug report does not authorize viewing. Access is limited to what is necessary, recorded, and ends when the task is complete or authorization is withdrawn.
• Processing by product and no training. Generative AI inference uses enterprise models through a managed cloud AI platform under enterprise terms. Those terms prohibit the cloud AI provider from using Customer Content to train or fine-tune AI or machine-learning models without our prior permission or instruction. We do not and will not give that permission or instruction. Live Hearing transcription uses a real-time speech-to-text service; search and retrieval use text-embedding and database services. The Content Commitments apply to all Customer Content across these services, including documents, images, video, audio, Live Hearing audio, prompts, Outputs, and Derived Content. Schedule B of the Terms describes processing by product and service function.
• No backsliding. A later change never reduces these commitments for content you already submitted unless you expressly agree, and the more protective provision always wins.

Live Hearing

Live Hearing listens to live hearing or deposition audio through the user’s device, transcribes it in real time with generic speaker labels, and flags testimony that appears to contradict the case record. Audio is captured only when the user starts a session, and capture stops when the user ends it. The audio may include the voices of judges, witnesses, opposing counsel, court personnel, and others nearby.

Audio is processed only to produce the transcript. We will not retain Live Hearing audio after the session, including in logs or caches. Speaker labels are generic (for example "Speaker 1"). Diarization may use temporary voice characteristics to tell speakers apart within a session; we must configure the feature to discard them when the session ends and not retain them or use them to identify anyone. Advocate creates no voiceprints or face templates to identify individuals. If biometric identifiers were ever introduced, we would first give notice and obtain any consent required by law.

Live Hearing audio, transcripts, and flags are Customer Content under every Content Commitment. In Live Hearing, Advocate acts solely as the Customer’s tool and service provider, processes the audio only to deliver transcripts and flags to that Customer, and has no right to use the audio or transcript for any purpose of its own. The Customer is responsible for determining whether it may use the feature in a proceeding and for obtaining any required permission or consent (Terms, section 6).

5. Analytics, cookies, and advertising

The workspace (attorneys.theadvocate.ai)

The workspace uses the cookies needed to sign you in and keep your session secure. Product analytics record which pages and features are used. They are not used to capture the contents of case materials, and there is no session recording of case screens.

The public marketing website (theadvocate.ai)

With your consent through the cookie control, the marketing website uses tag-management and analytics tools for site measurement, advertising tools for advertising measurement and remarketing, and tools that record how visitors interact with marketing pages. A demo-booking service is embedded for scheduling. These tools never receive Customer Content.

These providers may use cookie identifiers and browsing activity for advertising across sites. California law may treat that as "sharing" identifiers for cross-context behavioral advertising. You can decline or withdraw consent at any time in the cookie control, and we treat a Global Privacy Control signal as an opt-out. We do not sell personal information.

Do Not Track

We do not respond to browser Do Not Track signals because no common standard for them exists. We honor Global Privacy Control as described above.

6. How we disclose Account Data

• Service providers that process Account Data for us under contract: hosting, authentication, product analytics (as described in section 5), email delivery, demo booking, and payment processing. Providers that process Customer Content are Subprocessors. Schedule B of the Terms describes their functions; section 19.4 covers private provider information on reasonable request and disclosures and notices required by applicable law or a binding customer agreement.
• Organization administrators. If you use an organization’s account, its administrator controls membership and permissions and may see account and usage information for the organization’s workspace.
• Advertising providers on the marketing website, only with your consent, as described in section 5.
• Professional advisers (lawyers, auditors, insurers) under duties of confidentiality, and where needed to establish or defend legal claims or to address fraud or a security threat against the Services. Account Data only.
• Corporate transactions. Account Data may pass to a successor in a merger, acquisition, financing, or sale of the business, subject to this Policy. Customer Content is different. It is held for the Customer, it is not an Advocate asset available for sale, and it is never disclosed in due diligence. In any merger, acquisition, financing, bankruptcy, or wind-down, it may pass only to a successor that assumes the Terms, including the Content Commitments, after the advance notice and exit right in the assignment clause of the Terms. If Advocate ceases to offer the Services, it will give at least 60 days’ notice where practicable, keep export available during that period, and then delete Customer Content.
• Legal process. We disclose Account Data in response to a legal demand only when served with valid and binding legal process, and then only the minimum required. Because Account Data can show that a lawyer or office uses the Services, we tell the affected account holder first where the law allows.
• With your consent or at your direction.

For demands seeking Customer Content, the stricter procedure in section 5 of the Terms applies: valid and binding legal process only; a search warrant or court order for contents, where the law lets us insist; the requester redirected to the Customer first; notice to the Customer before any disclosure unless legally prohibited, with a challenge to the nondisclosure order where there are reasonable grounds and notice when the prohibition ends; and the minimum disclosure required. Preservation requests get the same treatment: we preserve and do not disclose. We never voluntarily disclose Customer Content to law enforcement, prosecutors, or any adverse party.

Required reporting can arise without a demand. Where 18 U.S.C. section 2258A applies, actual knowledge of facts or circumstances indicating an apparent offense covered by that statute triggers reporting to NCMEC’s CyberTipline as soon as reasonably possible and applicable preservation duties. Covered offenses include specified child sexual abuse material offenses, sex trafficking involving a minor, and enticement of a minor. We disclose only what the law requires. We do not proactively monitor Customer Content to detect these offenses, and personnel viewing remains subject to the Content Commitments. Lawful case evidence is not prohibited merely because it concerns child abuse or exploitation. Terms section 8.3 states the upload restrictions and reporting rule.

7. Security

The Services run on managed cloud infrastructure in the United States. We do not operate our own data centers. Advocate does not currently hold a SOC 2, ISO 27001, or similar certification or audit report.

The security measures we commit to for Customer Content are set out in Schedule C of the Terms, and we will not materially reduce them. At a high level they cover encryption in transit and at rest, access controls, logical isolation by customer organization, and logging of access. This section summarizes Schedule C and does not add to or replace it. No system is perfectly secure.

Security Incidents affecting Customer Content. We notify the affected Customer without undue delay and in any event within 72 hours after we become aware of a Security Incident, at its designated security contact or, if none, its account administrator. We do not hold the first notice until an investigation is complete; details about the incident, the content affected, likely consequences, and mitigation follow in phases, and we reasonably assist with remediation and required notifications. Section 5.4 of the Terms states the full procedure.

Incidents affecting Account Data. We notify affected individuals and regulators as the law requires, including California Civil Code section 1798.82.

8. Retention

We may keep specific Account Data longer where the law requires it or a legal hold applies.

Customer Content. We keep Customer Content while the account is open, until the Customer deletes it. After termination or account closure for any reason, the Customer may export its lawful Customer Content for 30 days. Export also remains available during suspension. Terms section 11.3 limits restrictions to legal requirements or specific security risks and pauses the export period for affected lawful content when no lawful, secure means of export is available. We delete Customer Content from active systems within 14 days after the export window ends, or after the Customer’s earlier deletion request, and from backups within 30 days after that. Deletion includes Derived Content and copies held by Subprocessors. We confirm deletion in writing on request. Restoring a backup does not revive deleted content. Customer Content is deleted, not anonymized and kept. Sections 11 and 19.6 of the Terms govern. Retention of Live Hearing audio is described in section 4.

9. Your rights and choices

These rights concern personal data we hold as controller. For Customer Content, see "If you appear in a customer’s case materials" in section 1.

You may ask us to give you access to your personal data, correct it, delete it, or provide it in a portable format. You may object to a use of it, including marketing, and withdraw any consent you have given (for example for marketing-website cookies or a testimonial). We will not retaliate or discriminate against you for exercising a right.

How to exercise them. Email info@theadvocate.ai with the subject line "Privacy Request". We verify identity before acting, usually by confirming control of the account email address. An authorized agent may act for you with your signed permission, and we may confirm the request with you directly. We respond within 45 days and may extend once by 45 days where the law permits, with notice to you. If we decline all or part of a request, we explain why. You may appeal by replying to the decision. You may also lodge a complaint with a data protection regulator, such as the data protection authority in your country or the California Privacy Protection Agency.

10. California notice

Advocate provides these rights and disclosures to California residents whether or not it currently meets the applicability thresholds of the California Consumer Privacy Act.

In the last 12 months we collected, as controller:

We use account log-in credentials only to authenticate you and secure the Services, not to infer characteristics about you.

• Sources: you; your organization’s administrator or a colleague who invites or refers you; your devices; our demo-booking provider when you book a demo; and, if we collect prospective users’ contact details as described in section 2, the public professional sources described there.
• Purposes: those in section 3.
• Recipients: the service providers and contractors in section 6 and, for marketing-website cookie data collected with consent, the advertising providers in section 5.
• Retention: section 8.
• Sale: none. We do not sell personal information.
• Sharing: only the consented marketing-website advertising cookies described in section 5 (identifiers and internet activity). Opt out through the cookie control or a Global Privacy Control signal.
• Minors: we have no actual knowledge that we sell or share the personal information of consumers under 16.

Customer Content is not listed above because Advocate handles it only as a service provider for its customers.

Shine the Light. We do not disclose personal information to third parties for their own direct marketing purposes within the meaning of California Civil Code section 1798.83.

11. Users outside the United States

The Services are operated from and hosted in the United States and are intended for legal professionals in the United States. If you access them from elsewhere, your Account Data is processed in the United States.

Where the GDPR or UK GDPR applies to Account Data, we rely on performance of our contract with you, our legitimate interests in operating, securing, improving, and marketing the Services, compliance with legal obligations, and consent. Consent applies to marketing-website cookies and testimonials, and you may withdraw it at any time.

A Customer that needs to transfer personal data subject to the GDPR, UK GDPR, or Swiss law to Advocate may request the EU Standard Contractual Clauses and the UK Addendum under section 19.8 of the Terms, to be signed before that transfer. They are not in place by default, and we do not claim to rely on any transfer mechanism today.

12. Minors

The Services are for legal professionals and the personnel they supervise. Account holders must be at least 18 and able to enter into the Terms. Minors may not create accounts or use the Services directly.

This restriction on accounts does not limit lawfully submitted Customer Content that depicts or identifies minors, including children under 13. We process that content on the Customer’s instructions under the Terms, subject to applicable law and the Content Commitments. We do not delete lawful case evidence merely because it includes a minor.

If we learn that a minor has created an account or given us personal information directly, outside a customer’s case materials, we will close the account and delete that information, subject to legal preservation requirements. We handle concerns that relate to Customer Content as described in section 1.

13. Third-party links and integrations

Our website and workspace may link to sites we do not operate. If you connect a supported calendar, or book a demo through a demo-booking provider, that provider also handles your data under its own terms and privacy policy. This Policy does not cover third parties’ own practices.

14. Changes to this Policy

We will give notice by email and in the workspace at least 30 days before a material change to this Policy takes effect. The "Last updated" date shows the current version.

Changes are not retroactive as to Customer Content. No change to this Policy reduces the Content Commitments for Customer Content submitted before the change unless the Customer expressly agrees. If a change would materially expand how we use Account Data we already hold, we will ask for your consent where the law requires it.

15. Contact

Advocate AI Tech Inc.