Privacy Policy | OkLegal

OkLegal, Inc., a New Jersey corporation (“OkLegal,” “we,” “us,” or “our”), respects your privacy and is committed to protecting the personal information you share with us. This Privacy Policy describes the types of personal information we collect, how we use and protect that information, with whom we share it, and the choices available to you regarding your information. This Privacy Policy applies to our websites at oklegal.ai and market.oklegal.dev, any associated mobile applications, email and SMS communications, and all related services, features, and functionality (collectively, the “Platform”). By using the Platform, you consent to the practices described in this Privacy Policy.

1. Information We Collect

The types of personal information we collect depend on how you interact with the Platform and the role in which you use it:

a. Client Information

Full name, phone number, and email address
Accident and injury details, including date of accident, injury type, procedure type, and treatment information
Insurance information and policy details
Liability information and venue (county/state)
Estimated damages range
Case documents and supporting files you upload
Communications with Attorneys or Funders through the Platform

b. Attorney Information

Full name and firm name
Bar number(s) and jurisdiction(s) of licensure
Contact information (phone, email, office address)
Practice areas and experience
Subscription tier and billing information
Bid history and case engagement records

c. Funder Information

Company name and business registration details
Contact information (name, phone, email, business address)
Licensing and registration details, where applicable
Subscription and billing information
Funding offer history and transaction records

d. Automatically Collected Information

IP address and approximate geolocation
Device type, operating system, and browser type and version
Pages visited, time spent on pages, and navigation paths
Referring URL and exit pages
Usage analytics, click patterns, and interaction data
Cookies and similar tracking technologies (see Section 6 below)

2. De-Identification During the Bidding Process

During the competitive bidding phase, case information shared with Attorneys and Funders is de-identified to protect Client privacy. Only the following categories of information are shared during bidding:

Injury type and procedure type
Liability profile
Venue (county and state)
Estimated damages range

No personally identifiable information is shared during the bidding phase. This includes, but is not limited to: names, dates of birth, phone numbers, email addresses, physical addresses, Social Security numbers, insurance policy numbers, and any other information that could be used to directly identify the Client. Full case details, including Client PII, are disclosed only to the Attorney selected by the Client after a bid has been accepted and the engagement has been formalized. Funder access to Client PII is similarly restricted and provided only upon the Client’s express consent in connection with a funding arrangement.

3. How We Use Your Information

We use the information we collect for the following purposes:

Case Matching: To facilitate case submissions, competitive bidding, attorney matching, and litigation funding connections.
Account Management: To create, maintain, and administer your account, including subscription management and billing.
Communications: To communicate with you about your case, account, bids, and our services via SMS, email, phone, or in-platform notifications.
Transaction Processing: To process subscriptions, subscription fees, closing fees, and other Platform-related transactions.
Analytics and Improvement: To analyze usage patterns, improve Platform functionality, develop new features, and conduct research.
Fraud Prevention: To detect, investigate, and prevent fraudulent, unauthorized, or illegal activity on the Platform.
Legal Compliance: To comply with applicable laws, regulations, legal processes, and governmental requests, and to enforce our Terms of Service.

4. How We Share Your Information

We share your information only in the following circumstances:

Attorneys and Funders (de-identified): During the bidding phase, only de-identified case data (as described in Section 2) is shared with Attorneys and Funders. No PII is disclosed during bidding.
Selected Attorney: Full case details and Client PII are shared with the Attorney selected by the Client after bid acceptance.
Payment Processing (Stripe): We use Stripe, Inc. to process all payments, subscriptions, and financial transactions. Stripe receives the payment and billing information necessary to process your transactions. OkLegal does not store credit card numbers or bank account details on its servers. Stripe’s use of your information is governed by the Stripe Privacy Policy.
SMS Communications (Twilio): We use Twilio, Inc. to send SMS notifications and communications. Twilio receives phone numbers and message content necessary to deliver messages. Twilio’s use of your information is governed by the Twilio Privacy Policy.
Email Communications (Resend): We use Resend to deliver transactional emails, including account notifications, bid updates, and other service communications. Resend receives email addresses and message content necessary to deliver emails.
Legal Compliance: We may disclose your information to comply with applicable laws, regulations, legal processes, subpoenas, court orders, or governmental requests, or to protect the rights, safety, or property of OkLegal, our Users, or the public.
Business Transactions: Your information may be disclosed or transferred in connection with a merger, acquisition, reorganization, sale of assets, or bankruptcy proceeding involving OkLegal.

We do not sell your personal information to third parties for marketing or advertising purposes. No aggregate bid data, pricing trends, or cross-firm comparisons are surfaced or shared. All bid data is siloed per-bid, per-case.

5. Data Security

We implement commercially reasonable administrative, technical, and physical security measures to protect your personal information. These measures include:

Encryption at rest: All stored data is encrypted using AES-256 encryption.
Encryption in transit: All data transmitted between your device and the Platform is encrypted using TLS 1.3.
Payment security: All payment data is processed by Stripe and is never stored on OkLegal servers. Stripe is PCI DSS Level 1 compliant.
Access controls: Database access is restricted to authorized personnel and is audited regularly.

Despite these measures, no method of electronic transmission or storage is 100% secure. We cannot guarantee the absolute security of your information. You are responsible for maintaining the confidentiality of your account credentials and for all activities that occur under your account.

6. Cookies and Tracking Technologies

We use cookies and similar tracking technologies to collect usage data and improve the Platform. The types of cookies we use include:

Essential/Session Cookies: Required for the Platform to function properly, including authentication, session management, and security. These cookies cannot be disabled.
Analytics Cookies: We use Google Analytics to understand how visitors interact with the Platform. Google Analytics collects information such as pages visited, time on site, and navigation patterns. You may opt out of Google Analytics by installing the Google Analytics Opt-out Browser Add-on.

You may manage or disable cookies through your browser settings. Please note that disabling certain cookies may affect the functionality of the Platform. We do not respond to Do Not Track signals at this time.

7. Data Retention

We retain your information in accordance with the following policies:

Case Data: Case submissions, bid records, and related case information are retained for a minimum of seven (7) years from the date of case closure or last activity, consistent with applicable legal and regulatory requirements.
User Profiles: Attorney and Funder profiles, including account information and engagement history, are retained for the duration the account remains active and for a reasonable period thereafter for legal and business purposes.
Client Profiles: Client information is retained while the case is active and for seven (7) years following case resolution or closure.
Deletion Requests: You may request deletion of your personal information at any time by contacting us at privacy@oklegal.ai. We will process deletion requests in accordance with applicable law, subject to any legal obligations that require us to retain certain information.

8. State Privacy Rights

Depending on your state of residence, you may have certain rights under applicable privacy laws, including the California Consumer Privacy Act (“CCPA”), the California Privacy Rights Act (“CPRA”), and similar laws enacted in other states. These rights may include:

Right to Know / Access: You have the right to request information about the categories and specific pieces of personal information we have collected about you, the sources of that information, the purposes for collecting it, and the categories of third parties with whom we have shared it.
Right to Correct: You have the right to request correction of inaccurate personal information we maintain about you.
Right to Delete: You have the right to request deletion of your personal information, subject to certain exceptions permitted by law.
Right to Opt Out: You have the right to opt out of the sale or sharing of your personal information. As stated in Section 4, we do not sell your personal information.
Right to Non-Discrimination: We will not discriminate against you for exercising your privacy rights.

To exercise any of these rights, please contact us at privacy@oklegal.ai. We will respond to all verifiable requests within forty-five (45) days of receipt. If we require additional time (up to an additional 45 days), we will notify you in writing. You may designate an authorized agent to submit requests on your behalf, subject to identity verification.

9. Children’s Privacy

The Platform is not intended for use by individuals under the age of eighteen (18). We do not knowingly collect, use, or disclose personal information from children under 18. If you are a parent or guardian and believe that your child has provided personal information through the Platform, please contact us immediately at privacy@oklegal.ai. If we become aware that we have collected personal information from a child under 18, we will take steps to promptly delete such information.

10. International Users

The Platform is operated from and intended for use in the United States of America. If you access the Platform from outside the United States, please be aware that your information may be transferred to, stored, and processed in the United States, where data protection laws may differ from those of your jurisdiction. By using the Platform, you consent to the transfer and processing of your information in the United States. We do not represent or warrant that the Platform is appropriate or available for use in any particular jurisdiction outside the United States.

11. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or the Platform. When we make material changes, we will update the “Effective” date at the top of this Privacy Policy and may provide additional notice through the Platform, by email, or by other means. Your continued use of the Platform after the effective date of any changes constitutes your acceptance of the revised Privacy Policy. We encourage you to review this Privacy Policy periodically for any updates.

12. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, or if you wish to exercise your privacy rights, please contact us at:

OkLegal, Inc.
Email: privacy@oklegal.ai