Privacy Policy

1.Information we collect

• Attorney account information: name, email, firm name, bar number and licensure details, firm size, branding assets you upload, and subscription records.
• Client and matter information: what attorneys and their invited clients enter into questionnaires, documents, records, and portals, which may include family, financial, health-related, and other sensitive details necessary for estate planning.
• Signing records: for electronically signed documents we record the signature, timestamp, IP address, and device information needed for a valid audit trail.
• Usage and technical data: log data, authentication cookies, and email delivery and open events for messages we send.

2.Special categories of information

Section 1 refers to health related and other sensitive details. We want to be specific about that, because some of what an estate plan requires is what data protection law calls special category information: health data, and information revealing religious belief. We collect it because the documents cannot be drafted without it.

• Whether a named child has special needs, and whether they receive SSI or Medicaid.
• A substance use indicator, with free text describing any limitations.
• Authority for a physician certified psychiatric or substance admission.
• Life sustaining treatment preferences.
• Organ donation preferences, including which organs.
• Religious considerations, which we invite by name in a free text field.

Two things follow that are worth saying plainly. Much of this describes people who are not our users and will never read this policy: named children, healthcare agents, executors and other fiduciaries. We hold that information because an attorney’s client provided it in order to have documents drafted, and the attorney remains its controller. And because several of these fields are free text, we cannot promise a bounded list of what they contain.

No product surface exposes questionnaire responses to Midly Labs personnel. The platform administration area is restricted to an allowlist, and every function behind it concerns bar verification rather than client data. We put it that way on purpose rather than saying we cannot access it: the data is stored without field level encryption, so the honest statement is about what the product exposes, not about what is technically impossible.

The information is still processed even where it is never viewed. It is stored, it is included in the prompt that generates a draft, and it is summarized in plain language by the summary feature. Each of those is processing, so we treat this category as sensitive throughout.

Legacy Doc HQ is not a HIPAA covered entity, and neither is the attorney’s firm in this capacity. Healthcare directives contain health information, but drafting them is legal work rather than the provision of healthcare, so HIPAA does not attach to it. Readers often assume the opposite, which is why we say so here.

3.How we use information

• To operate the Platform: generating documents, producing plain-language summaries, sending questionnaires and notifications, running client portals, and processing electronic signatures.
• To verify attorney bar standing against the State Bar of Georgia member directory.
• To bill subscriptions and process marketplace payments.
• To secure the service, prevent abuse, and comply with law.

We do not sell personal information, and we do not use client information to train artificial intelligence models. AI-assisted drafting processes the information you submit solely to produce work product for the responsible attorney.

4.Service providers

We use a small set of processors to run the Platform, each bound to use data only to provide their service to us:

Vercel

Application hosting, and private file storage for uploads and generated documents.

Neon

The database. Questionnaire answers, documents, portal messages and account records all live here.

Clerk

Authentication. Email, name, session tokens and any Google sign in tokens.

Stripe

Subscription payments and marketplace payouts. Card details are tokenized and we never see the number.

Resend

Email delivery. This carries account mail and the questionnaire notifications we send to the attorney, which summarize the client’s submission.

Anthropic

AI drafting assistance. Document and questionnaire content is sent to the Claude API to produce drafts and summaries. Under our agreement Anthropic deletes inputs and outputs within 30 days and does not use them to train its models, with longer retention only in documented exceptions such as usage policy enforcement and compliance with law.

Google Analytics 4

Page view measurement on our public marketing pages, loaded through Google Tag Manager. It does not run inside the attorney or client portals.

Google Fonts

Typefaces on our public pages, which means Google receives the request your browser makes for them.

Cloudflare

DNS for the legacydochq.com domain. The domain is not proxied, so Cloudflare does not see the content of requests to the Platform.

5.Sharing

Information is shared only: within the workspace that owns it (an attorney’s team, and the clients and family members that attorney or client authorizes); with the service providers above; when required by law or legal process; or in a corporate transaction, in which case this policy continues to apply to previously collected data. Client portal access is controlled by allowlists we enforce on every read.

An attorney may add their own scheduling link, such as Calendly or Acuity, to be sent to prospects. That is the attorney’s vendor rather than ours. We collect nothing through it, and that provider’s privacy notice governs whatever happens after the click.

6.Retention

• Active account data is retained while the account is active.
• Workspaces of lapsed free trials are retained for at least 30 days after the trial ends, then may be permanently deleted.
• After a subscription ends, the workspace and its client data are retained for at least 30 days, during which the attorney may resubscribe or request an export, then may be permanently deleted.
• On cancellation, attorneys may request an export of their client records and submissions.
• Signing audit records are retained as long as the executed document’s validity may depend on them.

7.Security

Data is encrypted in transit, stored with access controls, and client files are held in private storage accessible only through authenticated, authorized requests. No system is perfectly secure; we notify affected users of any breach as required by law.

8.Your choices and rights

Attorneys can review and update account information in Settings. Clients should direct requests about their information to their attorney, whose practice owns the client relationship; we support attorneys in fulfilling those requests. Where applicable law grants you rights to access, correct, or delete personal information, contact us at feedback@legacydochq.com and we will respond as the law requires.

9.Email tracking

Emails we send may include a delivery and open beacon so attorneys can tell whether time-sensitive messages reached their clients. We do not track link clicks in email.

10.Children

The Platform is not directed to children and we do not knowingly collect information from anyone under 18, except as attorneys record information about minor children (for example, guardianship nominations) in the course of representing their clients.

11.Changes and contact

We may update this policy; material changes will be announced on the Platform or by email. Adding a service provider runs on a separate and longer clock, because it changes who handles your data rather than what this page says about it: we will give attorneys at least 30 days’ notice before a new service provider begins processing personal data in a way that materially affects that processing. This matches the commitment we make on midly.ai. Questions: feedback@legacydochq.com, or Midly Labs Inc., attention Privacy.