firstcase Privacy Policy

1. Introduction

firstcase is an AI-powered voice receptionist and legal intake platform built for law firms ("Platform"). The Platform is operated by LexTone Communications LLC, a New Mexico limited liability company doing business as firstcase ("we," "us," or "our"). This Privacy Policy explains how we handle information when law firms ("Clients") and their callers use the Platform.

Law firms operate in a uniquely sensitive environment. Calls handled by the Platform may involve people seeking legal help and sharing personal and potentially privileged information. We treat that responsibility seriously.

By using the Platform you agree to this Privacy Policy. If you do not agree, do not use the Platform.

2. Our Role: Processor for the Client

For caller information, the Client (the law firm) is the controller and decides why and how the information is processed. firstcase acts as a processor (service provider), handling caller information only on the Client's instructions and only to provide the Platform. Callers who want to exercise rights over their information should contact the law firm they called. Our handling of caller information is also governed by our Data Processing Addendum.

3. Information We Collect

3.1 Caller Information (collected for Clients)

When the Platform handles a call for a Client, we collect: caller name and callback number; the nature and area of the legal matter; urgency and tone indicators assessed by the AI; call transcripts and recordings; date, time, and duration; scheduling information; and AI-generated summaries and intake assessments. This information is collected on behalf of the Client and is subject to the Client's own confidentiality and privilege obligations.

3.2 Client Account Information

When a firm subscribes, we collect: firm name, address, phone, and website; attorney names, direct lines, and routing preferences; practice-area and intake configuration; calendar and CRM connection credentials (handled by our integration providers and stored in encrypted form); billing information processed by our billing provider (we do not store full payment card numbers); and administrative account credentials managed by our authentication provider.

3.3 Automatically Collected Information

We collect IP address and device information for security, usage and feature analytics, and error and performance logs.

3.4 Website and Cookies

Our website uses cookies and similar technologies that are strictly necessary for the site to function, and may use privacy-respecting analytics to understand site usage. We do not use third-party advertising or cross-site tracking cookies. You can manage non-essential cookies through the cookie preferences control on our site and through your browser settings.

We also count visits to www.firstcase.ai with our own cookieless analytics: the page visited, the referring website, which buttons were clicked, and approximate country and device type. We do not set cookies or store IP addresses for this; visitors are counted with a one-way code that changes every day. We honor Do Not Track, Global Privacy Control, and the "Do not sell or share" choice on this site.

4. How We Use Information

4.1 Caller Information

We use caller information only to: provide call answering and intake for the Client; generate transcripts, recordings, and AI summaries for the Client; deliver SMS and email notifications to the Client's designated recipients; and let the Client review, search, and export its call logs. We do not use caller information for any purpose beyond delivering the Platform to the Client that received the call.

4.2 SMS and Email Notifications

We send notifications by SMS and email to recipients the Client designates. These may include caller name and contact information, the nature and urgency of the matter, AI-generated summaries, and secure links to transcripts and recordings stored in the Platform. SMS and email are inherently less secure than the encrypted dashboard. Clients are responsible for designating appropriate recipients, for those recipients' authority to receive the information, and for compliance with applicable consent and messaging laws. Clients can configure notification content and preferences in the dashboard. Standard message and data rates may apply.

4.3 Client Account Information

We use Client account information to provide, secure, support, and bill for the Platform, and to communicate with the Client about the service.

4.4 Aggregated and De-Identified Data

We may create and use aggregated and de-identified data (for example, average call duration and feature adoption) to operate, secure, analyze, and improve the Platform. This data does not identify any caller, Client, or call and is not used to re-identify anyone.

5. No Sale of Data; No Advertising Use

We do not sell or rent caller information or Client information, and we do not share it with advertising networks, data brokers, or marketing companies. We do not use your information for targeted advertising.

6. AI Training

We do not use identifiable caller information, call transcripts, or call recordings to train, fine-tune, or develop foundation or general-purpose AI models, whether our own or a third party's. We may use aggregated and de-identified data to operate and improve the Platform as described in Section 4.4. We will not use your identifiable caller information for any other purpose without your separate written consent.

7. Privilege and Confidentiality

We recognize that pre-representation communications may be protected by attorney-client privilege depending on jurisdiction and circumstances. The Platform is designed to act as an agent of the law firm, and information collected on a firm's behalf is treated as confidential. We do not share caller information across Clients, and we do not access individual transcripts or recordings except for authorized technical support with the Client's consent or as required by law. Clients remain responsible for their own privilege determinations and should consult their state bar rules on AI-assisted intake.

8. Data Isolation and Security

We use technical and organizational measures designed to protect information, including:

• Encryption in transit using TLS 1.2 or higher
• Encryption at rest provided by our infrastructure providers (AES-256)
• Logical separation of each Client's data environment, with row-level security and role-based access controls
• Storage of calendar and CRM connection credentials in encrypted form by our integration providers, not held by us in plaintext
• Access logging and restriction of staff access to authorized technical support
• Hosting on established cloud providers and periodic review of our security practices

No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

9. No Protected Health Information

The Platform is not designed or intended to receive or store Protected Health Information ("PHI") as defined under HIPAA, and firstcase is not a HIPAA Business Associate absent a separately signed Business Associate Agreement. Clients must not configure the Platform to collect PHI. See the Terms of Service for details.

10. Data Retention

Unless a Client requests earlier deletion, we retain call logs and metadata, call transcripts, AI summaries, and call recordings for the duration of the Client's subscription plus 90 days. Call recordings are available in the Client's dashboard for 6 months on the Essential plan and 2 years on the Growth plan. We retain configuration and account data for the duration of the subscription plus 90 days, and billing records for 7 years as required by law. Clients may request deletion as described in Section 12.

11. Service Providers (Subprocessors)

We use the following service providers, each governed by a data processing agreement. The current list is also maintained in our Data Processing Addendum.

We do not share caller or Client information with any third party for marketing or advertising, or for any purpose unrelated to providing the Platform.

12. Your Rights and Controls

12.1 Clients

Clients may access tenant data through the dashboard, export call logs, transcripts, and configurations, request deletion of tenant data on cancellation, request correction of account information, and restrict processing of certain categories.

12.2 Callers

Callers may have rights under applicable privacy laws, including the GDPR, the CCPA as amended by the CPRA, and other U.S. state privacy laws, such as the right to know what information was collected, to request deletion, and to opt out of certain processing. Because the law firm is the controller, callers should direct requests to the firm that received their call. Clients may forward caller deletion requests to legal@firstcase.ai, and we will act on them within 30 days.

12.3 Deletion on Cancellation

On cancellation, we retain data for 90 days to allow export, after which caller information, transcripts, recordings, and configurations are permanently deleted, except billing records retained as required by law.

13. International Transfers

Our subprocessors are located in the United States. Where information about EU or UK individuals is transferred, we rely on Standard Contractual Clauses and other lawful transfer mechanisms as described in our Data Processing Addendum.

14. Breach Notification

If a security incident affects Client or caller information, we will notify affected Clients without undue delay and in any event within 72 hours of becoming aware of it, provide a written incident report within 14 days, and cooperate with the Client's own notification obligations. Details are in our Data Processing Addendum.

15. Children's Privacy

The Platform is not directed to individuals under 18, and we do not knowingly collect their information. If a caller under 18 contacts a firm through the Platform, the Client is responsible for handling that information under applicable law.

16. Changes to This Policy

We may update this Privacy Policy. We will notify Clients of material changes by email or in-product at least 30 days before they take effect. Continued use after the effective date constitutes acceptance.

17. Contact