Privacy Policy

Effective date: September 26, 2026

This Privacy Policy describes how ExpertCaseTools ("ExpertCaseTools," "we," "us," or "our") collects, uses, discloses, and protects information in connection with the ExpertCaseTools web application and related services (the "Service"). It should be read together with our Terms of Service. Capitalized terms not defined here have the meanings given in the Terms of Service.

1. Scope and our role

The Service is a business-to-business product sold to expert-witness, consulting, and professional practices (each a "Customer") and used by the Customer's authorized staff ("Users"). We handle two different kinds of information, and our role differs for each:

  • Customer Data -- the case, client, contact, billing, time-entry, invoice, task, document, email, and calendar content that Customers and Users enter into, upload to, or connect to the Service. We process Customer Data on behalf of and at the direction of the Customer, as a "service provider" / "processor." The Customer decides what Customer Data to submit and is responsible for having all rights, consents, and legal bases needed to do so. Individuals whose information appears in Customer Data (for example, a Customer's own clients, opposing parties, or persons named in case records) should direct privacy requests to the relevant Customer; we will assist the Customer as required by law.
  • Account and Usage Data -- information about Users and Customer administrators that we need to provide, secure, and support the Service (for example, login and profile details and technical logs). We determine how this information is used, as described below.

This Policy does not apply to third-party websites or services linked from or connected to the Service, which are governed by their own privacy policies.

2. Information we collect

2.1 Information you provide.

  • Account and profile information: name, professional credentials, email address, username, phone number, time zone, organization name and address, logo, and password (stored only as a salted cryptographic hash).
  • Multi-factor authentication: if enabled, a TOTP secret and recovery codes.
  • Customer Data: as described in Section 1, which may include information about third parties and may include sensitive information such as medical, health, criminal-justice, or financial records contained in case files.
  • Communications: information you send us when you request support or otherwise contact us.

2.2 Information from connected services (only if a User chooses to connect them).

  • Email mailbox (IMAP): the mail server address, username, and password (stored encrypted), and the headers and contents of messages the Service retrieves in order to identify tasks, deadlines, and matters. By default the Service does not retain message bodies after processing; retention of message bodies occurs only if the Customer's administrator enables it (and, where permitted, the individual User opts in).
  • Google Calendar: an OAuth access token and refresh token (stored encrypted), the list of your calendars (so you can choose where events go), and the calendar events the Service itself created for your tasks. See Section 5.
  • AI provider credentials: API keys or server addresses for an AI/large-language-model provider that a Customer or User configures (stored encrypted).

2.3 Information collected automatically.

  • Log and device data: IP address, browser type, operating system, pages and features used, timestamps, and error diagnostics, recorded by our servers when you use the Service.
  • Invoice delivery data: when a Customer emails an invoice through the Service, we record when the invoice was sent and when it was first viewed by the recipient, so the Customer can see delivery status.
  • Cookies and browser storage: see Section 9.

3. How we use information

We use information only for the following business purposes:

  • to provide, operate, and maintain the Service, including the features a Customer or User turns on (case and billing management, invoicing, conflict checks, PDF tools, task extraction, calendar sync, reporting, data import and export);
  • to authenticate Users, enforce access controls, and secure the Service, including detecting, preventing, and investigating fraud, abuse, and security incidents;
  • to provide customer support and troubleshoot problems, at the Customer's or User's request;
  • to send service-related communications (for example, invitations, password resets, security notices, and changes to our terms);
  • to maintain and improve the reliability and performance of the Service using aggregated or de-identified technical data;
  • to comply with law, legal process, and our legal obligations, and to establish, exercise, or defend legal claims; and
  • as otherwise directed or authorized by the Customer.

We do not sell personal information, "share" it for cross-context behavioral advertising, use Customer Data for advertising or marketing, or use Customer Data to train generalized artificial-intelligence or machine-learning models.

4. Artificial-intelligence features

Certain optional features send portions of Customer Data to an AI/large-language-model provider to generate a result:

  • Email task extraction sends the content of retrieved emails (including, where relevant, earlier messages quoted in the same thread) to the AI provider configured by the User or, if none, by the Customer. It never uses a provider configured by us.
  • AI-assisted data import and the AI Report Builder may send column headings, sample rows, report requests, or database schema descriptions to an AI provider configured by the Customer or, where the Customer has not configured one, to the AI provider we configure for the platform.

A Customer-configured provider may be a third-party service or a server the Customer operates itself; its handling of data is governed by the Customer's own agreement with that provider. Where we configure the provider, we select providers that contractually agree not to use submitted data to train their models. AI output can be inaccurate or incomplete and must be reviewed by a qualified person before it is relied on -- see the Terms of Service.

5. Google user data

If you connect Google Calendar, the Service requests the following Google OAuth scopes: calendar.events (to create, update, and read the events it creates for your tasks), calendar.calendarlist.readonly (to list your calendars so you can choose a destination), and calendar (used solely to create one dedicated calendar for your tasks when you first connect).

  • Use. Google user data is used only to provide and improve user-facing calendar-sync features that are visible and prominent in the Service's interface: pushing your tasks' due dates and appointment times to your calendar, and, if you turn on two-way sync, detecting changes you make to those same events so you can confirm them on the task.
  • Limited reach. The Service only reads or writes events it created for your own tasks. It does not read, modify, or delete any other event on your calendars.
  • Limited Use. ExpertCaseTools's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
  • No transfer, no ads, no model training. We do not transfer Google user data to third parties except as necessary to provide or improve the calendar-sync feature, to comply with applicable law, or as part of a merger, acquisition, or sale of assets with notice to you. We do not use or transfer Google user data for serving advertisements, including retargeting, personalized, or interest-based advertising; we do not sell it; we do not use it to determine creditworthiness or for lending purposes; and we do not use it to develop, improve, or train generalized AI or machine-learning models. Google user data is never sent to an AI provider.
  • No human access. No person reads Google user data unless we have your affirmative agreement for specific messages or events, it is necessary for security purposes (such as investigating abuse), it is required to comply with applicable law, or the data is aggregated and anonymized for internal operations.
  • Revocation and deletion. You may disconnect Google Calendar at any time from your integration settings, which revokes our access token and deletes it from our systems; you may also revoke access at myaccount.google.com/permissions. Events already placed on your own calendar remain there unless you delete them (events on the dedicated calendar created by the Service are removed when that calendar is deleted on disconnect, where Google permits).

6. How we disclose information

We disclose information only as follows:

  • Within the Customer's organization, according to the roles and permissions the Customer's administrators configure.
  • Service providers (subprocessors) that host, secure, transmit, or support the Service -- for example, infrastructure and hosting providers, email-delivery providers, and AI providers described in Section 4 -- under written obligations to use the information only to provide services to us and to protect it. A current list is available on request.
  • Connected services the Customer or User chooses to connect (such as an email server, Google, or a Customer-configured AI provider), at the User's direction.
  • Recipients chosen by the Customer, such as the Customer's own clients who receive invoices sent through the Service.
  • Legal and safety: when we believe in good faith that disclosure is required by law, subpoena, court order, or other legal process; to protect the rights, property, or safety of ExpertCaseTools, our Customers, or others; or to investigate and prevent fraud, security incidents, or violations of our Terms. Where legally permitted, we will notify the affected Customer of a legal demand for its Customer Data and give it an opportunity to seek a protective order.
  • Business transfers: in connection with a merger, acquisition, financing, reorganization, or sale of all or part of our business, subject to this Policy's protections.

7. Support access to accounts

Authorized ExpertCaseTools personnel may access a Customer's account, including by temporarily signing in as a User, solely to provide support the Customer or User has requested, to investigate or resolve a technical or security issue, or to comply with law. Such access is limited to personnel with a need to know, is restricted to platform administrators, and is subject to confidentiality obligations.

8. Health information and other sensitive data

Customers may upload records that contain protected health information ("PHI") or other sensitive information, such as medical records produced in litigation. Unless we have signed a separate written Business Associate Agreement with a Customer, ExpertCaseTools does not act as a "business associate" under the Health Insurance Portability and Accountability Act ("HIPAA"), and the Customer is solely responsible for determining whether its submission of such records is lawful and consistent with any authorization, protective order, confidentiality agreement, or professional obligation that applies to them. We nonetheless protect all Customer Data, including sensitive data, using the safeguards described in Section 11, and we use it only to provide the Service.

9. Cookies and browser storage

The Service uses only cookies and browser storage that are strictly necessary for it to function:

  • Session and security cookies that keep you signed in and protect against cross-site request forgery;
  • Browser storage (such as local storage and IndexedDB) used to remember interface preferences and, in the PDF editor, to keep a temporary local copy of the document you're working on so unsaved work can be recovered after a browser crash. This copy stays in your browser and is cleared when you close the document.

We do not use advertising cookies, third-party analytics, or cross-site tracking technologies. Because we do not track Users across third-party websites, we do not respond differently to "Do Not Track" signals; we treat Global Privacy Control signals as a request to opt out of sale/sharing, which we do not do in any event.

10. Data retention and deletion

  • Customer Data is retained for as long as the Customer's account is active, or as the Customer directs through the Service's own deletion features. When a Customer closes its account, its Customer Data is permanently deleted 30 days after closure (the delay allows a mistaken closure to be reversed), or sooner if an administrator confirms an immediate purge. Customers may export their data before closure.
  • Email content retrieved for task extraction is not retained after processing unless message-body storage is enabled, in which case it is retained with the resulting task.
  • Connected-service credentials and tokens are deleted when the User disconnects the service or the account is closed.
  • Residual copies may persist in encrypted backups for a limited period until they are overwritten in the ordinary course, during which they remain protected and are not used for any other purpose.
  • We may retain limited information longer where required by law, to resolve disputes, to enforce our agreements, or for legitimate security purposes.

11. Security

We maintain administrative, technical, and physical safeguards designed to protect information against unauthorized access, loss, misuse, or alteration, including: encryption in transit (TLS); encryption at rest of stored credentials, passwords for connected mailboxes, OAuth tokens, and API keys; salted password hashing; optional multi-factor authentication; login rate limiting; logical separation of each Customer's data with role-based access controls; and restriction of administrative access to authorized personnel. No method of transmission or storage is completely secure, and we cannot guarantee absolute security. Users are responsible for safeguarding their credentials and for enabling multi-factor authentication.

Security incidents. If we become aware of a breach of security leading to unauthorized access to or disclosure of Customer Data, we will notify the affected Customer without undue delay and provide information reasonably available to us to help the Customer meet any notification obligations it may have, and we will notify individuals and regulators where the law requires us to do so directly.

12. Your California privacy rights

If you are a California resident, the California Consumer Privacy Act, as amended by the California Privacy Rights Act ("CCPA"), gives you the following rights regarding personal information for which we act as a business (Account and Usage Data), subject to certain exceptions:

  • the right to know the categories and specific pieces of personal information we have collected, the sources, the business purposes, and the categories of recipients;
  • the right to delete personal information;
  • the right to correct inaccurate personal information;
  • the right to opt out of the sale or sharing of personal information (we do not sell or share it);
  • the right to limit the use of sensitive personal information (we use it only for purposes permitted without that right, such as providing the Service and ensuring security); and
  • the right not to receive discriminatory treatment for exercising these rights.

Notice at collection. In the preceding 12 months we have collected the following categories of personal information: identifiers (name, email, phone, username, IP address); professional or employment-related information; internet or other electronic network activity (log data); account log-in credentials (sensitive personal information); and, within Customer Data, any category the Customer chooses to submit, which may include medical, financial, or other sensitive information. Sources, purposes, recipients, and retention periods are described in Sections 2, 3, 6, and 10. We have not sold or shared personal information, and we have no actual knowledge of selling or sharing the personal information of consumers under 16.

Exercising your rights. Submit a request to [email protected]. We will verify your request by matching information you provide against information we hold, and you may use an authorized agent with written, signed permission. For Customer Data, we will refer your request to the relevant Customer, for whom we act as a service provider. California residents may also request information about disclosures for direct-marketing purposes under Civil Code section 1798.83; we make no such disclosures.

13. Other U.S. state privacy laws

Residents of other states with comprehensive privacy laws may have similar rights to access, correct, delete, and obtain a copy of their personal information, and to opt out of targeted advertising, sale, and certain profiling (none of which we engage in). To exercise these rights, contact us as described below. If we deny your request, you may appeal by replying to our decision; if we deny your appeal, you may contact your state attorney general.

14. Location of processing

The Service is offered to Customers in the United States and is operated from, and stores data in, the United States. It is not directed to individuals in the European Economic Area, the United Kingdom, or Switzerland.

15. Children

The Service is intended for business use by adults and is not directed to children under 18. We do not knowingly collect personal information from children as Users. Customer Data may incidentally concern minors (for example, in case records); such data is processed solely on the Customer's behalf.

16. Changes to this Policy

We may update this Policy from time to time. If we make material changes, we will notify Customer administrators by email or through the Service before the change takes effect, and we will update the effective date above. We will not materially expand our use of previously collected Customer Data or Google user data without providing notice and, where required by law or by Google's policies, obtaining consent.

17. Contact us

ExpertCaseTools
Email: [email protected]