Law Spark Inc. as the developers of InFiler ("we," "us," or "our") is committed to protecting the privacy of our users. This Privacy Policy describes our practices for collecting, using, maintaining, protecting, and disclosing that information. Throughout this Privacy Policy, we refer to any person accessing or using our Website or the InFiler Add-In as "you" or the "User."

This Privacy Policy applies to information we may collect:

• On or through our InFiler website and any of its subdomains, referred to in this policy as the Website.
• Via the InFiler Add-In: The InFiler Microsoft Outlook add-in, referred to in this policy as the InFiler Add-In, is a Microsoft Outlook application that allows professionals to file emails and attachments directly into the systems they already use in their practice.

This Privacy Policy does not apply to:

• Information collected by third-party integration services you connect to when using the InFiler Add-In. Please be aware that we have no control over the content and policies of those third-parties, and cannot accept responsibility or liability for their respective privacy practices. Please review those services' privacy policies separately.

By accessing the Website or using the InFiler Add-In, you agree to the collection and use of information in accordance with this Policy. If you do not agree with our practices, please do not access our Website or use the InFiler Add-In.

This Privacy Policy may change from time to time. Continued access and use of the Website or the InFiler Add-In after changes are posted constitutes acceptance of those changes.

We may collect a variety of personal information about you or your devices from various sources, as described below.

A. Information You Provide Directly

• Contact Information. Basic contact information, such as name, email, username, and phone number, when you sign up for an account to use the InFiler Add-In, or when you contact us directly via email. We may also store the contents of any message or attachments that you send to us that relate to your communications.
• Surveys. Information you provide when you choose to participate in surveys, polls, contests, or promotions.
• Payment Processing Information. Information to process your payment, such as payment card number, expiration date, and billing information when you sign up for a paid subscription through the Website, or otherwise initiate a purchase transaction with us. Payment card data is collected and processed by Stripe, a third-party payment processor, and is never stored on our servers.

B. Information We Collect Automatically

• Technical, Device, and Connection Information. When you visit and interact with our Website, certain information is automatically collected on our behalf by our website hosting provider and through Google Analytics 4. This information may include your Internet protocol address, user settings, cookie identifiers, details about your browser, operating system or device, inferred general location based on your IP address, Internet service provider, and pages that you visit before, during, and after using the Website.
• Cookies and Similar Technology. Our website hosting provider and Google Analytics 4 may use cookies, pixel tags, local storage, and other technologies to automatically collect information through the Website. Cookies are small data files placed on your device that allow us to record certain information whenever you visit or interact with the Website. You can disable cookies through your browser settings, though doing so may affect the functionality of the Website.

C. Information Collected When You Use the InFiler Add-In

• Email metadata, including subject line, sender name and email address, recipient information, and date and time sent
• Email body content, accessed only when you explicitly perform an action such as filing an email to a matter or generating a PDF
• Account connection information, including third-party service credentials you provide when you choose to connect external accounts to the InFiler Add-In, via OAuth or by providing an API key. These credentials are stored locally on your device and are used solely to perform actions you explicitly initiate. They are transmitted only to the specific service they are intended for.
• Email attachments, accessed only when you explicitly select them for upload to a connected service

D. Information We Do Not Collect

• We do not store your email content or attachments on our servers beyond the time required to complete the action you requested
• We do not read, scan, or process your emails outside of actions you explicitly initiate
• We do not use tracking technologies such as cookies, web beacons, or pixel tags in the InFiler Add-In
• We do not collect precise location data, biometric identifiers, or government-issued identification numbers

We may use the information we collect for the following purposes:

• To provide the InFiler Add-In's core features, including filing emails to matters, creating tasks, logging time, adding expenses, and saving attachments to connected accounts
• To generate your email as a PDF upon your explicit request
• To authenticate with and communicate on your behalf with connected third-party accounts, such as Airtable, Monday.com, Harvest, and Dropbox
• To manage your account and provide customer support
• To process billing and subscription transactions
• To send administrative or account-related communications, such as updates or billing notifications
• To improve InFiler's core features, reliability, and performance, using aggregated and anonymized data only
• To detect, investigate, and prevent fraudulent transactions and other illegal activities
• To comply with our legal obligations and resolve any disputes

The InFiler Add-In lets you connect to the following third-party accounts, only when you explicitly configure and use those connections:

• Airtable: You may connect to your Airtable account via OAuth. We send email metadata, task details, time entries, and expense records to your selected Airtable base. We also read field and table schema settings to enable field mapping in the InFiler Add-In. Airtable's privacy policy is available at airtable.com/privacy.
• Monday.com: You may connect to your Monday.com account using your API token. We send task title, due date, priority, assignee, notes, and file attachments to your Monday.com board. Monday.com's privacy policy is available at monday.com/trustcenter/privacy.
• Harvest: You may connect to your Harvest account using your API token. We send time entries and expense records, including receipt files where applicable, to your Harvest account. Harvest's privacy policy is available at getharvest.com/privacy-policy.
• Dropbox: You may connect to your Dropbox account via OAuth. We upload selected email attachments and email PDF exports directly to your Dropbox account. Dropbox's privacy policy is available at dropbox.com/privacy.

We do not share your information with these third parties for any purpose other than performing the actions you explicitly request through the InFiler Add-In. We are not responsible for the data practices of these third-party accounts.

We may need to share your personal data with the parties set out below for the purposes described in this Policy:

• Our service providers acting as processors, who may be based in the United States or elsewhere, and who provide us with account management, IT support, IT backup, data storage, email management, system administration, and related services. This includes our website hosting provider and Google Analytics 4 for analytics purposes.
• Payment processing providers, specifically Stripe, which collects and processes billing information on our behalf in a PCI-DSS compliant manner.
• Analytics providers, including Google Analytics 4, which may have servers based in the United States, for the purpose of analyzing visitor behavior on the Website.
• Third parties to whom we may choose to sell, transfer, or merge parts of our business or our assets. Alternatively, we may seek to acquire other businesses or merge with them. If a change happens to our business, the new owners may use your personal data in the same way as set out in this Privacy Policy.

We require all third parties to respect the security of your personal data and to treat it in accordance with the law. We do not allow our third-party service providers to use your personal data for their own purposes and only permit them to process your personal data for specified purposes and in accordance with our instructions.

A. How We Store Your Information

Your connection settings, field mappings, and integration credentials are stored locally on your device. We use secure server-side infrastructure to process certain requests on your behalf, such as generating PDFs and facilitating file transfers to connected accounts. Data processed in this way is not retained after the operation is complete.

B. Retention

We retain personal information and account data for as long as your account is active or as needed to provide you with access to the Website or InFiler Add-In. Upon account termination, we will delete your data within 30 days, except where a longer retention period is required by law or necessary for legitimate business purposes such as billing records, fraud prevention, or compliance with audit requirements.

We maintain appropriate organizational and technical measures designed to protect your information against unauthorized or unlawful access, accidental loss, or destruction, including:

• Employing physical access controls, encryption, Internet firewalls, intrusion detection, and network monitoring depending on the nature of the information and the scope of processing
• OAuth 2.0 for selected third-party accounts. We never store your passwords
• Authentication of all server-side API requests using a secret key
• HTTPS encryption for all data in transit between the InFiler Add-In, our API, and connected third-party accounts
• Access to user data restricted to the minimum necessary for operation
• Payment transactions encrypted via SSL and processed by a PCI-DSS compliant payment processor. We never store payment card numbers

The transmission of information via the Internet is not completely secure. Although we do our best to protect your personal information, we cannot guarantee the security of information transmitted to or from us. Any transmission is at your own risk.

A. Accessing and Updating Your Information

You may access or update your personal information at any time by contacting us at support@lawspark.co.

B. Deleting Your Information

You may request deletion of your personal information by contacting us at support@lawspark.co. We will delete your data within 30 days of your verified request, subject to any legal retention requirements.

C. Opting Out of Marketing Communications

You may opt out of receiving marketing communications from us by clicking "unsubscribe" in any marketing email or by contacting us at support@lawspark.co. This does not apply to transactional communications related to your account or subscription.

D. Data Portability

Upon request, we will provide you with a copy of your personal data in a structured, commonly used, and machine-readable format. To make this request, contact support@lawspark.co.

E. California Privacy Rights

California Civil Code section 1798.83 requires us to disclose to our California customers, upon request, the identity of any third parties to whom we have disclosed Personal Information within the previous calendar year, along with the type of Personal Information disclosed, for the third parties' direct marketing purposes. Please note that under California law, we are only required to respond to a customer request once during any calendar year. If you are a California resident and would like to make such a request, please contact us at support@lawspark.co.

If you are located in the European Economic Area, the United Kingdom, or Switzerland, the following additional information applies.

A. Legal Bases for Processing

We process your personal information on the following legal bases:

• Contractual necessity: To perform our contractual obligations to you when providing access to the Website and InFiler Add-In
• Legitimate interests: To improve InFiler's core features, prevent fraud, and ensure security
• Legal obligations: To comply with applicable laws and regulations
• Consent: Where required by law, such as for optional communications

B. Your Rights Under GDPR

You have the right to access, rectify, erase, restrict, or object to the processing of your personal data, as well as the right to data portability. To exercise these rights, contact support@lawspark.co. We will respond within 30 days.

C. International Data Transfers

Your personal information may be transferred to and processed in countries outside the European Economic Area, including Canada and the United States, where our servers and service providers are located. When transferring data from the European Economic Area, we rely on appropriate safeguards including Standard Contractual Clauses where applicable.

D. Complaints

If you believe we have not addressed your privacy concerns adequately, you have the right to lodge a complaint with your local data protection authority.

The Website and InFiler Add-In are not directed at children and are not intended for use by individuals under the age of 18. We do not knowingly collect information from individuals under the age of 18. If you are under the age of 18, you may not use the Website or InFiler Add-In. If you believe a minor has provided us with personal information, please contact us at support@lawspark.co and we will take steps to delete such information promptly.

We will review and update this Privacy Policy periodically in response to changing legal, technical, and business developments. When we update this policy, we will revise the "Last updated" date at the top of this page. If we make material changes, we will notify you by email or by posting a prominent notice in the InFiler Add-In before the changes take effect. Your continued access and use of the Website or InFiler Add-In after changes are posted constitutes your acceptance of those changes. We encourage you to review this Privacy Policy periodically.

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

We will respond to all privacy-related inquiries within 30 days.