Privacy Policy

Account Information: When you create an account, we collect your full legal name, email address, phone number, and role (Client or Professional User). Professional Users also provide their firm name, bar association number (if applicable), and business address.

Intake Information: Clients who complete the intake wizard provide detailed personal, financial, and family information across 13 sections including personal details, marriage details, information about children, income and employment, real property, financial assets, debts and liabilities, business interests, insurance, monthly expenses, spousal support details, domestic issues, and personal goals and priorities. This information is highly sensitive and is treated with the highest level of protection.

Case Documents and Evidence: Users upload documents to the Platform including financial statements, tax returns, bank statements, legal documents, court filings, correspondence, photographs, and other evidence relevant to their divorce proceedings.

Communications: Messages exchanged between Clients and Professional Users through the Platform's secure messaging system.

Billing Information: Professional Users and Firms provide payment information including credit card details, billing address, and tax identification numbers. Payment processing is handled by Stripe, Inc. and we do not store complete credit card numbers on our servers.

With your explicit consent, we import information from third-party services to support your case:

Calendar Data: When you connect your Google Calendar, Apple Calendar, or Outlook Calendar, we import calendar events including event titles, dates, times, locations, descriptions, and attendee information for the date range you specify. We access your calendar in read-only mode and cannot modify, create, or delete your calendar events.

Email Data: When you connect your Gmail or Outlook account, we import emails relevant to your divorce case. We use smart filters based on the contacts and keywords you provide during setup to identify relevant messages. We import email metadata (sender, recipient, date, subject), email body content, and attachments. We access your email in read-only mode and cannot send, modify, or delete your emails.

Text Message Data: When you upload text message exports from our extraction tool, WhatsApp, or other sources, we import message content, timestamps, sender and recipient information, and any included attachments.

Usage Data: We collect information about how you interact with the Platform including pages visited, features used, time spent on pages, clicks, and navigation paths.

Device and Technical Data: We collect your IP address, browser type and version, operating system, device type, screen resolution, and language preferences.

Cookies and Similar Technologies: We use essential cookies for authentication and session management, functional cookies to remember your preferences, and analytics cookies to understand Platform usage. We do not use advertising or tracking cookies. See Section 12 for more details.

Log Data: Our servers automatically record information including access times, API requests, error logs, and performance metrics. These logs are used for security monitoring, debugging, and performance optimization.

Our AI Services generate additional information based on your Case Data and Connected Data:

• •Sentiment Analysis: Emotional tone classification (positive, negative, neutral, aggressive, conciliatory) applied to imported communications.
• •Topic Detection: Automatic identification of discussion topics in communications (children, finances, property, scheduling, legal matters).
• •Pattern Recognition: Detection of communication patterns, frequency changes, behavioral anomalies, and timeline correlations across data sources.
• •Insights and Reports: AI-generated summaries, case strength assessments, credibility scores, contradiction reports, and strategic recommendations.
• •Document Drafts: AI-generated draft documents, affidavit sections, and evidence summaries created at the request of a Professional User.

All AI-generated information is clearly marked as such and requires human review before being used in any legal proceeding.

• •Creating and managing your account
• •Processing and organizing case information through the intake wizard
• •Storing, encrypting, and managing documents and evidence
• •Facilitating secure communication between Clients and Professional Users
• •Processing data connections (calendar, email, text messages) to build your evidence profile
• •Running AI analysis on your case data to generate insights, detect patterns, and support case preparation
• •Generating documents, summaries, and reports at your request
• •Processing payments and managing subscriptions for Professional Users and Firms

• •Analyzing aggregate, de-identified usage patterns to improve Platform features
• •Testing new features and functionality
• •Monitoring Platform performance, reliability, and security
• •Training and improving our AI models using de-identified, aggregated data only (never individual case data — see Section 5.3)

• •Detecting and preventing unauthorized access, fraud, and security threats
• •Maintaining comprehensive audit logs as required by applicable regulations
• •Complying with legal obligations, court orders, and regulatory requirements
• •Enforcing our Terms of Service

• •Sending transactional notifications (task reminders, deadline alerts, document updates, message notifications)
• •Responding to your support requests and inquiries
• •Sending service announcements and security notices
• •With your consent, sending product updates and educational content

All data is encrypted in transit using TLS 1.3. All data is encrypted at rest using AES-256-GCM encryption. Each case uses its own unique encryption keys. Encryption keys are managed through HashiCorp Vault with automated key rotation.

Each law firm's data is isolated in separate containerized environments. There is zero cross-tenant data access by design. Per-tenant encryption keys ensure that even in the event of a system-level breach, data from one firm cannot be used to access data from another.

Your individual case data is never used to train our AI models. AI processing occurs within your isolated tenant environment. AI-generated content is logged in full (prompts and responses) for auditability and transparency. All AI outputs are clearly labeled and require human review before use in legal proceedings. We may use aggregate, de-identified, and anonymized usage patterns to improve our AI capabilities. Such data cannot be re-identified to any individual, case, or firm.

Role-based access controls ensure that only authorized individuals can access case data. Professional Users can only access cases they are assigned to. Clients can only access their own case. Firm administrators can manage their firm's users and settings but cannot override case-level access controls without being assigned to the case. All access is logged in immutable audit trails.

Our infrastructure is hosted on enterprise-grade cloud providers with SOC 2 Type II and ISO 27001 certifications. We conduct regular penetration testing and vulnerability assessments. We maintain an incident response plan and will notify affected users within 72 hours of discovering a confirmed data breach. We pursue our own SOC 2 Type II and ISO 27001 certifications and will update this policy when they are obtained.

Between Clients and Professional Users: The core function of the Platform is to facilitate collaboration between Clients and their lawyers. Case Data, Connected Data, and AI-generated insights are shared between the Client and their assigned Professional User(s) as part of normal Platform operation. Clients are informed of this sharing during onboarding and can control certain sharing preferences.

Invitation-based sharing: When a Client invites a lawyer (or vice versa), the invited party gains access to the shared case upon acceptance.

We share information with third-party service providers who assist us in operating the Platform, solely for the purpose of providing our Services:

• •Stripe, Inc. — Payment processing. Stripe receives billing information necessary to process transactions.
• •Cloud Infrastructure Provider(s) — Data hosting and storage under strict data processing agreements.
• •WorkOS — Authentication and identity management under their data processing agreement.
• •AI Model Provider(s) — AI processing under enterprise agreements that prohibit using your data for model training.

All service providers are bound by contractual obligations to protect your information and to use it only for the purposes we specify.

We may disclose your information if required to do so by law or in response to valid legal process, including court orders, subpoenas, or government requests. We will notify you of such requests unless prohibited by law or court order. We will challenge overly broad or unjustified requests where possible.

In the event of a merger, acquisition, or sale of all or substantially all of our assets, your information may be transferred to the acquiring entity. We will provide notice and, where required, obtain consent before your information is transferred and becomes subject to a different privacy policy.

• ✕We never sell your personal information to third parties.
• ✕We never share your case data with advertisers or marketing companies.
• ✕We never use your individual case data to train AI models.
• ✕We never share data between firms or between unrelated cases.
• ✕We never provide access to your data to other DivorceParty users who are not assigned to your case.

We retain your personal information and Case Data for as long as your account is active and the associated case is open.

When a case is closed, we retain the Case Data for a minimum period determined by the applicable jurisdiction's legal record-keeping requirements, generally not less than 7 years from the date of case closure, unless you request earlier deletion and no legal hold applies.

Clients and Firms may opt into our post-divorce data retention service to maintain access to case data after closure. This is a paid add-on service and is entirely optional.

You may request deletion of your account and associated data at any time (see Section 9). Upon receiving a verified deletion request, we will delete your personal information within 30 days, except where retention is required by law, necessary to complete an ongoing transaction, or subject to a legal hold.

Audit logs are retained for a minimum of 7 years from the date of creation for compliance purposes. Audit logs may contain references to your actions on the Platform but do not contain the substantive content of your case data.

Encrypted backups are maintained for disaster recovery purposes and are purged on a rolling 90-day cycle. Deleted data is removed from backups within 90 days of the deletion request.

Depending on your location, you may have additional rights under applicable privacy legislation. We endeavor to respect the privacy rights of all users regardless of jurisdiction.

To exercise any of your privacy rights, you may:

• •Use the Privacy Dashboard within the Platform (Settings → Privacy & Data)
• •Email our Privacy Officer at privacy@divorceparty.com
• •Write to us at: DivorceParty Privacy Officer, [Mailing Address]

We will verify your identity before processing any request. We will respond to verified requests within 30 days (or sooner if required by applicable law). If we need additional time, we will notify you of the reason and expected timeline.

You may export a complete copy of your data at any time through the Platform's data export feature (Settings → Privacy & Data → Export My Data). The export includes your account information, case data, documents, messages, imported data, and AI-generated insights in machine-readable formats (JSON, CSV, and original file formats for documents).

You may request deletion of your data through the Platform or by contacting our Privacy Officer. The deletion process is as follows:

1. You submit a deletion request through the Platform or via email.
2. We confirm receipt and verify your identity.
3. If you are a Client with an active case managed by a Professional User, we notify the Professional User of the pending deletion and allow a 14-day window for them to export any data they are legally required or entitled to retain.
4. After the 14-day window (or immediately if there is no active Professional User), we delete your personal information and Case Data from our active systems within 30 days.
5. Backup copies are purged within 90 days.
6. Audit log entries referencing your actions are retained for the mandatory 7-year period but are anonymized so they can no longer be linked to your identity.

We may retain certain information after a deletion request where required by applicable law or regulation, necessary to complete an ongoing legal proceeding, subject to a litigation hold, part of our audit logs (anonymized), or necessary to enforce our Terms of Service or protect against fraud.

These cookies are necessary for the Platform to function and cannot be disabled. They include session authentication tokens, security tokens (CSRF protection), and user preference cookies (language, theme).

These cookies enhance your experience by remembering your preferences such as form auto-save state, dashboard layout preferences, and notification preferences.

We use privacy-respecting analytics (Vercel Analytics or equivalent) to understand how the Platform is used in aggregate. These analytics do not track individual users across websites, do not use fingerprinting, and do not share data with advertising networks.

We do not use advertising cookies, social media tracking pixels, or third-party tracking cookies of any kind. We do not participate in cross-site tracking. We do not sell cookie data or allow third parties to place cookies on our Platform for advertising purposes.

You can control cookies through your browser settings. Note that disabling essential cookies may prevent you from using the Platform.