Privacy Policy

Compass AI, Inc.("we," "us," or "our") operates MyEvidencePackage. This Privacy Policy explains what information we collect, how we use it, who we share it with, and your rights regarding your data and your clients' data.

If you are an attorney using our Service:much of the data you process through MyEvidencePackage is your clients' data, which you control as the data controller. We act as a data processor on your behalf. Your professional obligations regarding confidentiality and privilege apply independently of this policy.

Account and firm information

When you create an account, we collect your name, email address, firm name, and billing details. We collect your firm's logo and brand color if you provide them.

Case and client submission data

Through your firm's client portal, we collect the evidence your clients submit: written descriptions, photographs, documents, videos, contact details (name, phone, email), and attestation records. This data is associated with your firm's cases.

Usage and technical data

We collect standard server logs including IP addresses, browser type, pages visited, timestamps, and error reports. This data is used to operate, secure, and improve the Service. We do not use cross-site tracking or third-party advertising cookies.

• To provide the Service: storing files, generating AI-assisted reports, serving signed download URLs, and maintaining your firm's portal.
• Billing and account management: processing payments, communicating plan changes, and sending receipts via Stripe.
• Security and fraud prevention: detecting unauthorized access, enforcing one-firm-per-domain policies, and maintaining audit logs.
• Service communications: transactional emails (magic links, trial reminders). We do not send unsolicited marketing emails without consent.
• Service improvement: aggregated, de-identified analytics about feature usage. We do not use client submission content to train AI models.

To generate evidence reports, we transmit submission content (descriptions, file metadata, and exhibit images) to Anthropic, PBC for AI analysis. Anthropic processes this data under a data processing agreement and does not use API inputs to train its models.

The following third-party subprocessors handle your data:

• Supabase (Supabase Inc.) — database, authentication, and file storage. Data stored in the United States.
• Anthropic (Anthropic, PBC) — AI report generation. Submissions processed but not retained for training.
• Stripe (Stripe, Inc.) — payment processing. We do not store payment card numbers.
• Vercel (Vercel Inc.) — application hosting and edge infrastructure. United States.

We do not sell your data or your clients' data to any third party.

Evidence submissions collected through your firm's portal may be subject to attorney-client privilege and work product protection. We maintain technical and organizational controls designed to protect this data, including:

• Encryption in transit (TLS) and at rest (AES-256);
• Row-level security ensuring each firm can only access its own data;
• Private storage buckets with time-limited signed URLs for file access;
• Audit logging of every data access event.

You remain responsible for asserting and maintaining privilege. We will cooperate with lawful legal process but will notify you of requests affecting your client data to the extent permitted by law.

We retain account data for as long as your account is active. Case data, submissions, exhibits, and reports are retained for the duration of your subscription and for 90 days following account termination, after which they are permanently deleted.

Audit logs are retained for 2 years. Billing records are retained as required by applicable tax and financial regulations.

You may request deletion of your firm's data at any time by contacting privacy@myevidencepackage.com. Client portal submissions cannot be selectively deleted while the associated case is active.

We implement industry-standard security measures including encryption at rest and in transit, row-level database access controls, secrets management via environment variables, and audit logging. We conduct periodic security reviews.

No system is perfectly secure. In the event of a data breach affecting your firm's data, we will notify you without undue delay as required by applicable law.

Depending on your jurisdiction, you may have the following rights regarding your personal data:

• Access: request a copy of personal data we hold about you;
• Correction: update inaccurate personal information through account settings or by contacting us;
• Deletion: request deletion of your account and associated data, subject to legal retention requirements;
• Portability: request an export of your case data in a structured format;
• Objection / restriction: object to certain processing activities.

To exercise any of these rights, contact privacy@myevidencepackage.com. We will respond within 30 days. For rights requests related to client submission data, you (as the attorney and data controller) are responsible for managing client requests.

California residents have the right to know what personal information we collect, the right to delete personal information, and the right to opt out of the "sale" of personal information. We do not sell personal information. To exercise your rights, contact privacy@myevidencepackage.com.

If you are located in the European Economic Area, United Kingdom, or Switzerland, we process your personal data under the following legal bases: (a) performance of our contract with you; (b) our legitimate interests in operating and securing the Service; and (c) your consent where required. Data is transferred to the United States under Standard Contractual Clauses where required.

You may lodge a complaint with your local supervisory authority if you believe we have processed your data unlawfully.

We use strictly necessary cookies to maintain your authenticated session. We do not use advertising cookies, cross-site tracking pixels, or analytics cookies that identify individual users. Client portal sessions are stateless and do not set persistent cookies.

The Service is not directed to individuals under 18. We do not knowingly collect personal information from minors. If you believe we have inadvertently collected such information, contact us at privacy@myevidencepackage.com and we will delete it promptly.

We may update this Privacy Policy from time to time. We will notify you of material changes by email or in-app notice at least 14 days before the changes take effect. Your continued use of the Service after the effective date constitutes acceptance of the updated policy.

For privacy-related questions or requests, contact our privacy team at privacy@myevidencepackage.com.

Compass AI, Inc.
Attn: Privacy
privacy@myevidencepackage.com