Privacy Policy

1. Introduction

We are committed to protecting your privacy and handling personal information in a lawful, fair, and transparent manner. This policy explains what data we collect, why we collect it, how we use it, and your rights regarding that data.

By using the Services, you acknowledge that you have read and understood this Privacy Policy. If you do not agree with the practices described here, please do not use the Services.

Important: This Privacy Policy does not override or diminish any attorney–client privilege, work-product protections, confidentiality obligations, or professional responsibility rules that apply to our legal representation. Where this policy and professional duties conflict, professional duties govern.

2. Scope and application

This policy applies to personal information processed through:

• Washington Law Firm Client Portal mobile applications (iOS and Android)
• Washington Law Firm Client Portal web application
• Any website, service, or feature that links to this policy
• Communications and data exchanged through the Services in connection with legal matters and client services

This policy does not apply to information collected offline, through other Washington Law Firm channels not linked to this policy, or on third-party websites or services that may link to or be accessible from the Services.

3. Who we are

The data controller for personal information processed through the Services is Washington Law Firm, a law firm operating the Client Portal for its clients, authorized users, and prospective clients.

For privacy-specific inquiries and requests, contact:

4. Information we collect

We collect information directly from you, automatically when you use the Services, and in some cases from third parties. The categories and specific data points are detailed below.

4.1 Account and identity information

When you create an account or update your profile, we collect:

• Email address (required for account creation and authentication)
• Password (hashed and stored securely; we never store passwords in plain text)
• Full name
• Phone number (optional; used for contact and account profile)
• User role (client, attorney, or administrator)
• Account timestamps (account creation date, last login, last activity)

4.2 Legal matter and case content

The Services enable you to manage legal matters. We collect and store:

• Case information: case title, case number, case description, case status, participant identifiers (client ID, attorney ID)
• Progress reports: event titles, written notes, report dates, and timestamps for updates on case developments
• Voice recordings: optional audio files you attach to progress reports, including file names, file sizes, and audio content
• Document uploads: any files you upload to a case (including PDFs, images, spreadsheets, Word documents, and other file types), along with file names, file sizes, upload timestamps, and file metadata
• Folder and organization metadata: how you organize documents and cases within the portal

4.3 Messages and communications

Our secure messaging feature collects:

• Message content: the text of messages you send and receive through the case-based chat feature
• Sender and receiver identifiers: user IDs for participants in the conversation
• Message timestamps: date and time each message was sent
• Read receipts: whether a message has been read by the recipient
• Presence data: online/offline status and last-seen timestamps for chat participants, used to show availability

4.4 Appointments and scheduling

When you book or manage appointments, we collect:

• Appointment type: whether the meeting is a video consultation or in-person/court appearance
• Date and time: selected appointment date and time slot
• Appointment status: pending, confirmed, rescheduled, or cancelled
• Associated case: case ID if the appointment is linked to a specific legal matter
• Client identifier: your user ID for appointment records

4.5 User preferences and settings

We store your preferences, including:

• Notification settings: whether you have enabled or disabled push notifications for case updates, messages, appointments, and billing notices
• Appearance preferences: optional display settings such as light or dark mode, stored on your device and/or account profile where available

4.6 Device and push notification data

When you use our mobile applications, we may collect:

• Device type and model: information about your device (e.g., iPhone 14, Samsung Galaxy S23) to ensure compatibility and optimize the user experience
• Operating system and version: iOS or Android version to support platform-specific features
• Push notification token: an Expo push token generated for your device, stored in your user profile, used to deliver push notifications about case updates, new messages, appointment reminders, and new invoices
• Notification permissions: whether you have granted the app permission to send notifications
• Device checks: confirmation that you are using a physical device (not a simulator) for push notification registration

4.7 Technical and usage data

We automatically collect technical information when you use the Services:

• IP address: your internet protocol address, which may reveal approximate geographic location
• App version: the version of the mobile or web application you are using
• Session data: login timestamps, session duration, and session identifiers
• Navigation and feature usage: pages or screens visited, features accessed, buttons clicked, and time spent in different sections of the app (collected to improve the user experience and identify technical issues)
• Error and crash logs: diagnostic information when the app encounters errors or crashes, including stack traces and device state
• Performance metrics: app load times, response times, and other performance indicators

Some of this data is collected automatically by Google Firebase (our cloud infrastructure provider) when you authenticate, access Firestore database, or use Firebase Storage. See Section 8 for details about Firebase data processing.

4.8 Support and communications with us

If you contact our support team or communicate with us through other channels, we collect:

• Inquiry content: the text of your messages, questions, feedback, or support requests
• Response records: our replies and the resolution of your inquiry
• Support metadata: timestamps, ticket IDs, and status of support requests

4.9 Payment and billing information

The Client Portal includes invoice billing so staff can bill clients and clients can pay outstanding legal fees online. In connection with billing, we process:

• Invoice records: invoice title/description, amount, currency, due date, status (for example pending, paid, or overdue), creation and payment timestamps, and the client account the invoice is assigned to
• Payment status metadata: checkout session identifiers, payment intent identifiers, and payment status values returned by our payment processor after you start or complete checkout
• Purchase / billing history: a record of invoices issued to your account and whether they have been paid, used to show outstanding balances and payment history in the portal

Online invoice payments are processed by Stripe (Stripe, Inc. and its affiliates). When you tap Pay invoice, you are redirected to Stripe Checkout (typically in your device browser). We do not collect or store full payment card numbers, CVV codes, or bank account numbers. Card and bank details are entered on Stripe's pages and handled by Stripe under its own terms and privacy policy. We receive confirmation of payment success or failure and limited transaction metadata needed to mark the invoice paid and keep billing records accurate.

Stripe's processing of payment data is described in the Stripe Privacy Policy.

4.10 Sensitive personal data

We do not require you to submit sensitive categories of personal data (such as racial or ethnic origin, religious or philosophical beliefs, health data, genetic data, or biometric data) through the Services unless it is necessary for your legal matter and you voluntarily choose to provide it. If you do submit sensitive data, we will process it only as permitted by law and as required for the provision of legal services.

5. How we use your information

We use personal information to:

• Provide and operate the Services: enable account creation, authentication, case management, document storage, messaging, appointment scheduling, and other portal features
• Facilitate legal representation: support attorney-client communication, document exchange, case tracking, and collaboration on legal matters
• Send service communications: notify you about account activity, case updates, new messages, appointment reminders, new invoices, and system maintenance
• Process billing and payments: create and display invoices, start Stripe Checkout for unpaid balances, verify payment confirmation, and maintain billing history for clients and firm staff
• Improve and optimize the Services: analyze usage patterns, identify bugs and errors, test new features, and enhance user experience
• Secure the Services: authenticate users, prevent fraud, detect and respond to security incidents, unauthorized access, and abuse
• Comply with legal obligations: satisfy legal, regulatory, and professional responsibility requirements, including record retention, conflict checks, and ethical rules
• Exercise or defend legal claims: where permitted by law, use information to establish, exercise, or defend legal claims or rights
• De-identified analytics: analyze aggregated or de-identified data (data that cannot reasonably identify you) to understand service usage trends and improve functionality

We do not sell your personal information to third parties for monetary consideration. We do not use your personal information for cross-context behavioral advertising as defined under applicable U.S. state privacy laws, except where you have provided separate, explicit consent and such consent is required by law.

6. Legal bases for processing (EEA, UK, Switzerland)

If you are located in the European Economic Area (EEA), the United Kingdom (UK), or Switzerland, data protection law requires us to have a legal basis for processing your personal information. We rely on one or more of the following, as appropriate:

• Performance of a contract: processing is necessary to provide the Services under our agreement with you (e.g., account creation, case management, messaging)
• Legitimate interests: processing is necessary for our legitimate interests or those of a third party, provided your rights and freedoms do not override those interests (e.g., securing the Services, improving functionality, detecting fraud, analyzing usage)
• Legal obligations: processing is necessary to comply with legal requirements, regulatory mandates, or professional conduct rules
• Consent: where required, we rely on your explicit consent (for example, for certain marketing communications, if ever offered, or optional features). You may withdraw consent at any time without affecting the lawfulness of processing before withdrawal.

7. Data sharing and disclosure

We do not sell or rent your personal information. We may share or disclose information in the following circumstances:

7.1 Within the firm

Personal information may be shared with authorized attorneys, paralegals, and administrative personnel at Washington Law Firm who need access to perform their duties in connection with your legal matter or the operation of the Services.

7.2 Service providers and processors

We engage third-party service providers who process personal information on our behalf to support the Services. These providers are contractually obligated to use information only as instructed, to implement appropriate security measures, and to comply with applicable data protection laws. Categories of processors include:

• Cloud infrastructure and hosting providers: Google Firebase (see Section 8 for details)
• Push notification services: Expo push notification delivery
• Authentication and security services: identity verification and fraud prevention tools
• Analytics and performance monitoring: tools that help us understand usage and diagnose technical issues
• Customer support platforms: tools for managing support inquiries and communications
• Email delivery services: for sending transactional emails (e.g., password resets, account notifications)
• Payment processors: Stripe processes online invoice payments. Card and sensitive payment details are handled by Stripe; we receive payment confirmation and limited transaction metadata
• Application programming and API services: backend services used to create Stripe Checkout sessions, verify payments, and serve app configuration such as optional store update prompts

7.3 Professional advisers

We may share information with professional advisers (such as accountants, auditors, insurers, or consultants) where necessary for the delivery of legal services, firm operations, or professional compliance.

7.4 Legal obligations and protection

We may disclose information when required or permitted by law, including to:

• Comply with legal process (e.g., subpoenas, court orders, warrants)
• Respond to lawful requests from government authorities, regulatory agencies, or law enforcement
• Enforce our Terms of Service, investigate potential violations, or protect the security and integrity of the Services
• Protect the rights, property, safety, or security of Washington Law Firm, our clients, users, or the public
• Comply with professional responsibility rules and ethical obligations governing legal practice

7.5 Business transfers

In the event of a merger, acquisition, reorganization, bankruptcy, or sale of substantially all our assets, personal information may be transferred to a successor entity. We will provide notice as required by applicable law, and any successor will be required to honor the commitments in this policy or provide you with notice of changes.

7.6 With your consent

We may share information with third parties when you explicitly consent or direct us to do so.

8. Data storage and infrastructure

The Services rely on cloud infrastructure to store and process your data. This section details our primary infrastructure provider and what data they handle.

8.1 Google Firebase and Google Cloud Platform

We use Google Firebase (a service of Google LLC) to provide core functionality, including:

• Firebase Authentication: user account creation, login, password management, and session management
• Cloud Firestore: a NoSQL database that stores user profiles, case data, messages, appointments, invoices, progress reports, and other structured information
• Firebase Cloud Storage: file storage for uploaded documents, audio recordings, and other media associated with legal matters

Personal information and legal matter content you submit through the Services are stored and processed on Google's infrastructure subject to our configuration, security rules, and data processing agreements. Google processes this data as our processor and in accordance with:

• Firebase Privacy and Security Information
• Google Privacy Policy
• Google Cloud Data Processing Terms

8.2 Google Analytics for Firebase (if enabled)

Our Firebase project configuration includes a measurementId, which indicates that Google Analytics for Firebase may be enabled for certain builds of the Services. If active, Google Analytics for Firebase automatically collects:

• App instance identifiers: unique identifiers assigned to each installation of the app
• Device and OS information: device model, OS version, screen size, language, and region
• Usage events: app opens, screen views, feature usage, and other in-app actions (aggregated for analytics)
• Performance data: app stability, crash reports, and performance metrics

Google Analytics for Firebase is used to provide aggregated analytics, identify bugs, and improve app stability. Data collected by Google Analytics is subject to Google Analytics Terms of Service and the Google Privacy Policy.

Important for app store compliance: The data types and purposes described in this section must align with what you declare in the Data safety section of Google Play Console and the App Privacy section of App Store Connect. If you disable Google Analytics in your Firebase project or exclude the Analytics SDK from your builds, update your app store declarations accordingly.

8.3 Stripe payment processing

Online invoice payments are processed by Stripe. When you pay an invoice in the mobile app, Checkout is opened with Stripe. Stripe collects payment credentials on its systems. We store invoice and payment-status records in Firestore and may use our application backend to create Checkout sessions and confirm that a payment completed. Stripe's handling of payment data is governed by the Stripe Privacy Policy.

8.4 Data residency

Google Firebase and Cloud Storage data is hosted on Google Cloud Platform infrastructure. Data location depends on the Firebase project region configured during setup. Firestore and Storage data are stored in the selected multi-region or regional location (e.g., us-central, europe-west). Payment data processed by Stripe is stored according to Stripe's infrastructure and policies. For details on where your data is stored, contact privacy@washingtonandwells.com.

9. Data retention

We retain personal information for as long as necessary to fulfill the purposes described in this policy, unless a longer retention period is required or permitted by law. Retention periods depend on the nature of the data, the purpose for which it was collected, and applicable legal, regulatory, or professional obligations.

9.1 Account and profile data

Account information (email, name, phone, preferences) is retained for the duration of your account and for a reasonable period after account closure to satisfy legal, accounting, and professional responsibility requirements.

9.2 Legal matter data

Case files, messages, documents, progress reports, invoices, and other matter-related content are retained in accordance with legal and ethical rules governing attorney file retention. This may include:

• State bar rules requiring retention of client files for a minimum period
• Statutes of limitations applicable to potential claims or malpractice actions
• Regulatory requirements for record-keeping in specific practice areas
• Contractual obligations under engagement agreements

Typically, we retain matter data for at least 7 years after the conclusion of representation, or longer if required by law or if the matter remains open.

9.3 Communications and support records

Support inquiries and other communications with us are retained for a reasonable period to provide assistance, improve services, and satisfy record-keeping requirements.

9.4 Technical and usage data

Log files, error reports, and technical data are typically retained for 90 days to 2 years, depending on the type of data and our operational needs.

9.5 Deletion and anonymization

When retention periods expire and no legal or professional obligation requires further retention, we delete or anonymize personal information. Anonymization renders data non-identifiable and no longer subject to this Privacy Policy.

10. Security measures

We implement administrative, technical, and physical safeguards designed to protect personal information against unauthorized access, alteration, disclosure, or destruction. These measures include:

10.1 Encryption

• In transit: All data transmitted between your device and our servers is encrypted using HTTPS/TLS (Transport Layer Security)
• At rest: Firestore databases and Cloud Storage are encrypted at rest by default using Google-managed encryption keys
• Passwords: User passwords are hashed using industry-standard algorithms (bcrypt or similar) and never stored in plain text

10.2 Access controls

• Access to personal information is restricted to authorized personnel who need it to perform their duties
• Firebase Security Rules limit database and storage access based on user authentication and role
• Multi-factor authentication is available and encouraged for user accounts, and required for administrative access to backend systems

10.3 Monitoring and logging

• We log authentication events, database access, and file operations to detect and respond to suspicious activity
• Automated monitoring alerts us to potential security incidents, unauthorized access attempts, and system anomalies

10.4 Vendor security

• We require service providers to implement appropriate technical and organizational measures and to comply with data protection obligations
• Google Firebase and Google Cloud Platform maintain certifications including ISO 27001, SOC 2/SOC 3, and comply with industry security standards

10.5 Incident response

We have procedures in place to respond to data security incidents. In the event of a breach affecting your personal information, we will notify you and relevant authorities as required by applicable law.

10.6 User responsibilities

No method of transmission or storage is completely secure. You can help protect your information by:

• Using a strong, unique password for your account
• Not sharing your account credentials with others
• Logging out of shared or public devices
• Keeping your devices and software up to date with security patches
• Promptly notifying us at support@washingtonandwells.com if you suspect unauthorized access

11. Your privacy rights

Depending on your location and applicable law, you may have certain rights regarding your personal information. This section describes those rights and how to exercise them.

11.1 General rights (where applicable)

• Access: Request a copy of the personal information we hold about you
• Correction: Request correction of inaccurate or incomplete personal information
• Deletion: Request deletion of your personal information, subject to legal and professional retention requirements
• Restriction: Request restriction of processing in certain circumstances (e.g., if you contest accuracy)
• Data portability: Receive your personal information in a structured, commonly used, machine-readable format, and request that we transmit it to another controller (where technically feasible)
• Object: Object to certain processing (e.g., processing based on legitimate interests or for direct marketing)
• Withdraw consent: Where processing is based on consent, withdraw that consent at any time (without affecting the lawfulness of processing before withdrawal)
• Complain to a supervisory authority: Lodge a complaint with a data protection authority in your jurisdiction if you believe we have violated your privacy rights

11.2 How to exercise your rights

To exercise any of these rights, contact us at:

We will verify your request as permitted by law and respond within the timeframe required by applicable law (typically 30-45 days, depending on jurisdiction).

11.3 Limitations

Your rights are subject to certain limitations and exceptions. We may deny requests that:

• Are manifestly unfounded or excessive
• Would adversely affect the rights and freedoms of others (including attorney-client privilege)
• Conflict with legal or professional obligations (e.g., record retention requirements for legal files)
• Are not required by applicable law

If we deny a request, we will explain the reason for the denial as required by law.

12. U.S. state privacy rights (California, Virginia, Colorado, Connecticut, Utah, and others)

Residents of certain U.S. states have additional privacy rights under state laws, including the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA), the Virginia Consumer Data Protection Act (VCDPA), the Colorado Privacy Act (CPA), the Connecticut Data Privacy Act (CTDPA), the Utah Consumer Privacy Act (UCPA), and similar laws.

12.1 Categories of personal information we collect

For California residents, the categories of personal information we collect are described in Section 4 and generally include:

• Identifiers (name, email, phone, user ID, device/push token identifiers)
• Personal information under Cal. Civ. Code § 1798.80(e) (name, contact info, and billing-related account records; we do not store full payment card numbers)
• Commercial information (case details, service usage, invoice and purchase history)
• Internet or network activity (IP address, device info, usage data, log files)
• Audio, electronic, visual, or similar information (uploaded documents, voice recordings)
• Professional or employment-related information (where provided in connection with legal matters)
• Inferences (preferences, characteristics, behaviors derived from usage)

12.2 Your rights under state privacy laws

Subject to certain limitations, you may have the right to:

• Know: Request information about the categories and specific pieces of personal information we have collected, the sources, the purposes, and the categories of third parties with whom we share it
• Delete: Request deletion of your personal information, subject to exceptions
• Correct: Request correction of inaccurate personal information
• Opt out of sales or sharing: We do not "sell" personal information for monetary consideration and do not "share" it for cross-context behavioral advertising as those terms are defined under applicable state laws. If our practices change, we will provide a clear opt-out mechanism.
• Limit use of sensitive personal information: If we use sensitive personal information for purposes beyond those permitted without consent under applicable law, you may have a right to limit such use. We process sensitive data only as necessary for legal services and as you voluntarily provide it.
• Non-discrimination: We will not discriminate against you for exercising your privacy rights.

12.3 How to exercise your state privacy rights

To submit a request under applicable state privacy laws, email:

You may designate an authorized agent to make a request on your behalf. The agent must provide proof of authorization, and we may require you to verify your identity directly with us.

12.4 Appeals

If we deny your request in whole or in part, you may appeal our decision by replying to the decision email or by emailing privacy@washingtonandwells.com with "Appeal" in the subject line. We will respond to your appeal within the timeframe required by applicable state law.

13. International data transfers

If you access the Services from outside the United States, your information may be transferred to, stored in, and processed in the United States or other countries where our service providers operate. These countries may have data protection laws that differ from those in your country of residence.

Where required by applicable law (e.g., transfers from the EEA, UK, or Switzerland to countries without an adequacy decision), we use appropriate safeguards such as:

• Standard Contractual Clauses (SCCs): contractual terms approved by the European Commission or other relevant authorities
• Processor agreements: data processing terms with service providers that include transfer safeguards
• Certification mechanisms: reliance on certifications such as Google Cloud's ISO 27001 and SOC 2

To request information about the safeguards we use for international transfers, contact privacy@washingtonandwells.com.

14. Children's privacy

The Services are not directed to children under 13 years of age (or the minimum age in your jurisdiction where higher), and we do not knowingly collect personal information from children. If you are a parent or guardian and believe we have collected information from a child without appropriate consent, contact us at privacy@washingtonandwells.com. We will take steps to delete such information promptly.

15. Do Not Track signals

Some browsers support "Do Not Track" (DNT) signals. There is currently no industry standard for how to respond to DNT signals. The Services do not respond to DNT signals or similar mechanisms. If a standard is adopted in the future, we will update this policy accordingly.

16. Changes to this policy

We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or for other operational reasons. When we make material changes, we will:

• Post the updated policy with a revised "Effective date" at the top
• Provide notice through the Services (e.g., an in-app banner or notification) or by email if required by law
• Where required, obtain your consent before applying material changes to data previously collected

Your continued use of the Services after the effective date of an updated policy constitutes acceptance of the updated terms, to the extent permitted by applicable law. We encourage you to review this policy periodically.

17. Contact us

If you have questions, concerns, or requests regarding this Privacy Policy or our privacy practices, please contact:

This policy was last updated on April 26, 2026. Prior versions are available upon request.