Privacy Policy
This policy explains how TeamLaw ("we", "us"), operated by Column Seven (8 The Green, Ste B, Dover DE 19901, USA), collects and processes personal data on teamlaw.ai, the TeamLaw application at launch.teamlaw.ai, and co-branded domains in the Agentix product family (including teamoffice.ai and baseagentix.com).
Contact: privacy@teamlaw.ai
1. Two roles we play
- As a data controller — for data about our own customers ("Customers"): accounts, billing, support, and service communications.
- As a data processor — for the content Customers bring into the workspace ("Workspace Content"): case files, documents, drafts, evidence, voice captures, conversation history, and any personal data contained in them. The Customer (typically a law firm or legal professional) is the controller of Workspace Content; we process it only to provide the service, under our Data Processing Agreement.
2. Data we collect
Customers (we are the controller)
- Account data: name, email address, authentication credentials (or OAuth identity), and workspace settings.
- Billing data: subscription tier, credit balance, and payment records. Card details are collected and stored by Stripe — we never see full card numbers.
- Support communications and service emails.
Workspace Content (we are the processor)
- Case files, documents, drafts, memos, deliberations, and evidence uploaded or created in the app.
- Conversation history with AI agents.
- Voice captures and their transcripts.
- Collaboration data: names and email addresses of invited collaborators.
- Connected-app data accessed through integrations the Customer authorises (see Section 7).
Website visitors
- Server logs: IP address, user agent, requested URL — retained briefly by our hosting infrastructure for security and reliability.
- Optional advertising measurement: if you opt in, OpenAI's advertising pixel measures ad attribution and completed registrations on TeamLaw's public marketing and successful email-verification pages. It does not run inside the private workroom.
- When you submit a request form on teamlaw.ai, your contact details and message are sent to our server and delivered through our email provider so the relevant TeamLaw team can respond. Do not include confidential documents, identity documents or API keys.
3. Cookies and local storage
We use essential cookies to operate the service and optional advertising cookies only after you choose Accept. Choosing Accept minimal keeps optional advertising cookies off and does not affect access to TeamLaw. The cookie and browser-storage inventory includes:
| Name | Type | Set by | Purpose | Duration |
|---|---|---|---|---|
GAESA | Cookie | Hosting infrastructure (Google Cloud) | Load balancing. Strictly necessary. | 30 days |
| Session cookie | Cookie | TeamLaw app | Keeping you signed in. Strictly necessary. | Session (rolling) |
baseagentix_english | Cookie | TeamLaw app | Remembering your English dialect preference (en-US/en-GB). Shared across Agentix family domains so your preference follows you. Functional. | 1 year |
__stripe_mid, __stripe_sid | Cookies | Stripe (billing pages only) | Fraud prevention and payment security. Strictly necessary for payment processing. | 1 year / 30 min |
teamlaw_measurement_consent | Cookie | TeamLaw | Remembers your measurement choice across teamlaw.ai and its subdomains. Preference only; contains no account details or ad identifier. | 180 days from your choice |
__oppref | Cookie | OpenAI Measurement Pixel, after opt-in | Stores the ad-click attribution identifier supplied in a landing-page URL. | 30 days after capture; capturing a non-empty identifier again resets this period |
__obref | Cookie | OpenAI Measurement Pixel, after opt-in | Stores a randomly generated browser reference for advertising measurement. | 365 days from creation; reading it does not extend expiry |
| UI preferences | localStorage | TeamLaw app | Theme, sidebar layout, accessibility settings, disclaimer acknowledgments. Never sent to our servers for tracking. | Until cleared |
Optional OpenAI advertising measurement
The OpenAI Measurement Pixel is off by default. We do not load its SDK or send measurement events until you opt in. The cookie notice offers Accept minimal for essential cookies only and Accept to also allow optional advertising cookies. You can reopen Settings on these public pages to change your choice. Withdrawing consent stops future measurement and removes accessible OpenAI measurement cookies; it does not undo events already sent.
When enabled, the pixel sends event information, the page origin, ad-attribution identifiers and browser references to OpenAI for advertising measurement. Where automatic advanced matching is enabled, the pixel can detect supported customer details on the page, normalize them and hash them in your browser before including the hashes with conversion events. Raw customer details are not sent through that matching feature. Hashes and browser identifiers can still be personal data. We do not manually pass account identifiers or Workspace Content to the pixel.
A completed-registration event is sent only on the successful email-verification screen when measurement is allowed. We remove verification-link query and fragment data before loading the pixel there. If you have not chosen yet, the event may be sent if you opt in while that success screen is still open. A declined event is discarded, not replayed on a later visit. The private login and workroom do not load this pixel.
Cookie durations are separate from OpenAI's attribution windows and conversion-data retention. Your browser may shorten them or block cookies. For more information, see OpenAI's privacy policy and its Measurement Pixel documentation.
4. How we use data and legal bases (GDPR)
| Purpose | Data | Legal basis |
|---|---|---|
| Providing the TeamLaw service | Account data, Workspace Content | Contract (Art. 6(1)(b)); Workspace Content processed on the Customer's behalf under our DPA |
| Billing and subscription management | Billing data | Contract (Art. 6(1)(b)) |
| Security, abuse prevention, reliability | Server logs | Legitimate interests (Art. 6(1)(f)) |
| Service announcements to Customers | Account data | Contract / legitimate interests |
| Optional advertising measurement | Conversion events, ad-attribution and browser identifiers; browser-hashed customer details where automatic matching is enabled | Consent (Art. 6(1)(a)); you can withdraw via Settings |
| Legal compliance | Any of the above | Legal obligation (Art. 6(1)(c)) |
We do not sell personal data or use Workspace Content for advertising or to train our own AI models. With your opt-in, we use the limited website advertising-measurement data described above to measure our ads. This does not control third-party providers you select using your own API keys.
5. AI processing — where your content travels
An OpenRouter API key is required for AI features. The prompts, documents, and context needed to fulfil your request are sent to the selected provider. You may also connect optional API keys for other supported providers, such as OpenAI or Anthropic.
- Required OpenRouter key: requests are routed through OpenRouter and, depending on the model selected, may also be processed by the model provider. Their terms and data-handling policies apply. Your key is stored encrypted and used only to route your requests.
- Optional provider keys: requests routed with another provider's key are governed by that provider's own terms and policies.
- Provider policies: each provider sets its own rules for data collection, retention, and model training. These practices are controlled by the provider and are outside our service agreement. Review the relevant policies before sending confidential or client information.
Voice captures are transcribed by a third-party transcription provider (details to be confirmed and updated here). Audio and transcripts are stored as Workspace Content.
6. Payments
Payments are processed by Stripe, Inc. Stripe collects your card details directly; we receive only a payment reference, status, and the billing details needed for invoicing. Stripe acts as an independent controller for fraud prevention and payment processing — see Stripe's privacy policy.
7. Connected apps (integrations)
You may connect third-party apps (via Composio) to let your agents act on your behalf. When you authorise a connection, OAuth tokens are stored securely and data from that app is accessed only as needed to perform the actions you request. Disconnecting an integration revokes our access; you can also revoke from the third-party app directly.
8. Sub-processors and service providers
| Provider | Purpose | Location / safeguards |
|---|---|---|
| Replit / Google Cloud | Application hosting, server logs | US; DPA and SCCs |
| PostgreSQL (Replit managed) | Database | US; DPA |
| Stripe | Payment processing | US; independent controller, SCCs |
| Composio | Third-party app integration layer | US; DPA |
| OpenRouter and partner LLM providers | AI processing for platform-operated services, where applicable | See applicable provider terms |
| Transactional email provider | Transactional email | To be confirmed |
Fonts are self-hosted. No font requests are made to Google or any other third party.
9. Retention
- Account data: while the account is active; deleted within 30 days of account deletion.
- Workspace Content: under the Customer's control — you can export or delete at any time; deleted within 30 days of account deletion.
- Billing records: retained as required by tax and accounting law.
- Server logs: up to 30 days. Backups purge on a rolling 30-day cycle.
10. Your rights
EU/UK residents: access, rectification, erasure, restriction, objection, portability, and complaint to a supervisory authority. Contact privacy@teamlaw.ai. For personal data inside Workspace Content, we may redirect your request to the responsible Customer (the controller), and we will assist them in fulfilling it.
11. International transfers
Where data is transferred outside the EU/UK, we rely on Standard Contractual Clauses (Module 2) with the sub-processors listed above. A UK Addendum is incorporated for UK customers.
12. Security
TLS in transit; encryption at rest; encrypted storage of API keys and OAuth tokens; per-workspace access isolation; hashed credentials; access controls and least-privilege administration. Details in our DPA's security annex.
13. Children
TeamLaw is a professional tool intended for adults. We do not knowingly collect data from anyone under 16.
14. Changes
Updates are posted here with a revised effective date. Material changes are announced to Customers by email and require re-acceptance in the app before continuing to use the service.