1. Who controls the information
Case Razor LLC provides CaseRazor to law firms. The subscribing firm controls most information about its clients, staff, and legal matters. Case Razor LLC handles that information on the firm's instructions to provide the service. Case Razor LLC separately controls account, security, support, and billing records. It also controls records needed for its own legal duties.
CaseRazor is designed for professional legal work. A firm should place information in the service only when it has authority to do so.
2. Information we handle
Depending on the features a firm enables, CaseRazor may handle:
The data depends on the tools the firm uses. Some tools use less.
- Accounts and firms. This includes names, work contact details, roles, sign-in records, security settings, and support requests.
- Clients and matters. This includes contact details, family details, immigration history, legal notes, tasks, deadlines, case plans, and facts about witnesses or other people.
- Sensitive details. This may include identity papers, government numbers, finances, health, disability, criminal history, race, ethnicity, nationality, religion, sexual orientation, family ties, or genetic ties.
- Government cases. This includes USCIS receipt numbers, A-Numbers, online account numbers, agency case numbers, official notices, and case status.
- Documents and forms. This includes uploaded proof, signatures, form answers, created files, and review history.
- Messages and schedules. This may include email, chat, calendar, task, text, file, and appointment data from services the firm connects.
- Billing. This includes invoices, time, expenses, payment status, trust records, and payment-provider references. CaseRazor does not intend to store full card numbers.
- Technical data. This includes IP address, browser and device data, access time, audit events, connection status, provider IDs, and limited error logs.
CaseRazor does not request or collect precise browser or device location, such as GPS coordinates. We may infer an approximate region from an IP address only for security, fraud prevention, and hosting diagnostics. Apart from that region, the only location information in CaseRazor is an address that a user types into a contact, matter, form, or document.
3. How we use information
We use information to provide, secure, maintain, and support CaseRazor. We use it to sign in users and enforce firm and matter access. We also use it to organize legal work, connect services selected by the firm, retrieve USCIS status information, and prepare requested forms or drafts. Other uses include sending service notices, preventing abuse and data loss, fixing reliability problems, and meeting legal, accounting, security, and contract duties.
When an authorized user chooses an AI-assisted feature, CaseRazor may send the information selected for that feature to Google Gemini. The interface marks assisted work. A professional must review it. AI output may be incomplete or wrong and is not legal advice.
We may use combined or de-identified information to operate and improve the service. We do not use product data for third-party advertising. We will not make a new use or disclosure of personal, de-identified, anonymized, or pseudonymized product information without active consent from an authorized firm representative.
4. When information is shared
We disclose information only to provide a selected feature, follow a firm's instructions, protect the service, complete a business deal, or comply with law. The providers and recipients may include:
- Supabase: authentication, database, file storage, and server functions.
- Vercel: hosting and delivery of the CaseRazor web application, and limited request diagnostics. A private Vercel worker also processes a selected PDF and its form values when a user asks CaseRazor to fill or convert a form.
- Google Cloud: protected background processing, scheduling, logging, and secret storage.
- Malware scanning: when a firm uses the CaseRazor client portal to receive an uploaded file, we scan the file's content with an antivirus service we operate on Google Cloud before the file enters storage. The scanner checks only whether the file is safe. It does not use the file's content for another purpose.
- USCIS Torch API: receipt numbers and credentials needed to return authorized case-status information.
- Google Workspace: Gmail, Drive, Calendar, Tasks, and Chat information when a firm connects those services. CaseRazor's use and transfer to any other app of Google API data adheres to the Google API Services User Data Policy, including Limited Use.
- Google Gemini: selected information for an AI-assisted feature that an authorized user invokes.
- Resend: transactional email delivery selected by the firm or recipient.
- Matterline and Twilio: optional text-message delivery. CaseRazor sends an approved message request to Matterline, which manages carrier delivery through Twilio.
- Acuity Scheduling and Docketwise: optional appointment or migration information when the firm enables those connections.
- Stripe or PayPal: payment processing and reconciliation when a firm enables a supported payment service.
Before we send product data to a listed provider, we require written terms that limit it to the stated purpose. A provider may not use personal, de-identified, anonymous, or coded product data for its own unrelated purpose. It may not start a new use or disclosure until an authorized firm representative has actively consented. If we cannot verify the terms, we stop sending data until we can. We will give notice before a provider change that would materially change how data is used.
A legal matter can include facts about relatives, household members, witnesses, employers, or other people. Sharing family history, health details, or genetic ties can affect those people and the client. Firms must weigh those effects. They must get any needed permission before sharing the data through a connected service.
5. No sale of personal information
Case Razor LLC does not sell personal information for money. We also do not share CaseRazor product data for cross-context behavioral advertising. If a future practice is treated as a sale or sharing under applicable law, we will provide the required notice and opt-out before it begins.
6. Choices and connected services
Authorized users choose whether to connect optional services. They can disconnect them in product settings. A firm controls its users, permissions, communications, exports, and many retention choices. Disconnecting a provider stops new exchanges. It does not automatically delete information already stored under the firm's file-retention duties.
Connected services can reduce duplicate entry, keep staff aware of deadlines, and place related work in one matter. They also create limits and risks: information leaves CaseRazor for the selected provider, the provider may be unavailable, and its own security and retention rules apply. CaseRazor limits each connection to the selected purpose and the access granted by the firm.
CaseRazor will ask an authorized firm representative to accept a new purpose, a new disclosure, or a material change to this notice or to the terms before that change applies to the firm. Declining an optional use will not block unrelated core features.
7. Retention and dormant accounts
- Active account and matter information is retained while the firm subscribes and as required by the firm's file-retention instructions.
- If a subscription ends but the firm does not close the account, we may keep the dormant account for up to 12 months to permit reactivation or export. We will provide notice before scheduled closure when we have a working contact address.
- After a verified closure or deletion request, we disable ordinary access promptly and delete covered information from primary systems within 45 days. Encrypted backup copies expire within 90 days.
- Terminal USCIS polling jobs and provider-attempt records are kept for 90 days, then reduced to privacy-minimized daily metrics. Completed worker telemetry is kept for 30 days. Case-status transitions remain with the matter until the matter is deleted or a retention duty applies.
- Support records may be kept for 24 months after the request closes. Security and audit records may be kept for up to 24 months.
- Billing, tax, signed agreement, trust-accounting, fraud-prevention, dispute, and legal-hold records may be kept for up to seven years or longer when law requires it.
A legal hold, professional duty, accounting rule, security need, or active dispute may delay deletion. We will explain any exception in our response. Data set for deletion is removed from ordinary use while backup copies age out.
8. Access, correction, export, deletion, and account closure
A client or other person should first contact the law firm that controls the matter. A firm administrator may email cole@caserazor.com. A person asking about information controlled by Case Razor LLC may use the same address. Use the subject “CaseRazor privacy request.” State whether the request is for access, correction, export, deletion, or account closure.
We acknowledge verified privacy requests within 10 business days. We complete them within 45 calendar days when reasonably possible. If the law allows more time, we will explain why and give a new date. We verify identity and authority based on the sensitivity of the information.
Before account closure, a firm may request an available export. Closure disables user access and begins the deletion schedule above. Disabling one user does not delete records the firm must retain.
Authorized firms may use available access controls and export tools to securely review, transmit, download, or request disposal of health information and other sensitive information. Any transfer remains subject to the firm's instructions, user permissions, professional duties, and the safeguards of the selected recipient or connected service.
California and Oregon residents may have rights to know, access, correct, delete, or receive certain information and to opt out of covered sales or sharing. We do not discriminate against a person for exercising a privacy right.
9. Security and breach notices
We use safeguards designed for legal-practice information. These include encrypted connections, protected receipt numbers, role-based access, tenant isolation, secret managers, audit records, and bounded background workers. No system can guarantee absolute security.
If we confirm a breach that affects a firm's information or a CaseRazor user account, we will notify the affected firm and any directly affected user without unreasonable delay. We will do this whether or not a separate law or contract requires notice. The notice will describe what happened, the types of information involved, the known effects, the steps we took, and actions the recipient can take. We will also meet any stricter timing or content rule imposed by law or contract. Report a concern to cole@caserazor.com.
10. Business transfer or service closure
We will notify affected firms before a transfer of ownership or control changes who handles product information, unless law bars notice. A successor must provide protections consistent with this notice. If not, the firm will have a meaningful chance to export or securely delete its information before a materially different use begins.
If Case Razor LLC ends CaseRazor, we will give reasonable notice. Firms will have a chance to export or securely delete product information, subject to lawful retention duties.
11. Changes to this notice
Before a material change takes effect, we will publish a plain-language summary of what is changing. Every material change requires an authorized firm representative to actively accept the new version before it applies to that firm. Continued use alone is never sufficient acceptance of a material change. USCIS rules, applicable law, or our agreement may impose additional or stricter acceptance requirements, and we will also meet those. Every prior version remains available at its own permanent address, listed in the version history on the current policy page.
12. Contact
Privacy and security questions, verified requests, and account-closure requests may be sent to cole@caserazor.com. Mail may be addressed to Case Razor LLC, Portland, Oregon, United States.