Attorney Match Privacy Policy
Effective date: 2026-06-02
Last updated: 2026-06-02
1. Introduction & Scope
This Privacy Policy explains how Martello Systems LLC ("Martello Systems," "we," "us," or "our") collects, uses, shares, and protects personal information when you use Attorney Match at attorneymatch.app and related applications and services (the "Service"). It applies to information we process about visitors and users who submit a case through the Service.
By using the Service, you agree to the practices described in this Policy. This Policy is incorporated into and subject to our Terms of Service. If you do not agree with this Policy, please do not use the Service.
2. Information We Collect
- Contact information. When you submit a case, we collect the email address you provide so we can deliver your private results link and service notices.
- Case data you submit. We collect the case description and any documents you upload (such as PDFs, text, or images). This is the most sensitive data we handle. It is encrypted at rest using AES-256-GCM and is used solely to run your matching pipeline and to display your results to you through your private, token-gated access link.
- Payment metadata (via Stripe). Payments are processed by Stripe, Inc. We do not collect or store your full payment card numbers. We retain limited information such as Stripe payment/session identifiers and amounts for accounting.
- Usage and analytics data. We use PostHog to record high-level product events (such as page views, intake submitted, and payment succeeded). These analytics events do not include your case description, uploaded files, or attorney contact details.
- Technical and log data. We automatically collect standard server logs, such as IP address and request metadata, used for security and operating the Service.
- Communications. If you contact us (for example, at support@attorneymatch.app), we collect the content of your messages and our correspondence.
We do not intentionally collect sensitive categories of personal information beyond what you choose to include in your case description, and we ask that you include only what is necessary to describe your matter.
3. How We Use Information
We use personal information to: provide, operate, and maintain the Service; run the matching pipeline and generate your shortlist and draft outreach letters; deliver your private results link and service communications by email; process payments through Stripe; monitor, secure, debug, and improve the Service; detect and prevent fraud, abuse, and security issues; and comply with legal obligations and enforce our agreements. We do not sell your personal information. We do not share your case description with attorneys — outreach letters are drafted for you to send, not sent by us. The Service uses automated processing to generate matches and drafts, but these outputs are informational suggestions and do not produce legal effects on their own; you decide what to do with them.
4. Legal Bases for Processing (EEA/UK)
Where the GDPR or UK GDPR applies, we process personal information on the bases of: performance of a contract (to provide the Service and process your payment); legitimate interests (to secure, improve, and analyze the Service and prevent fraud, balanced against your rights); consent (for certain optional cookies, which you may withdraw at any time); and legal obligation (to comply with applicable laws, including tax and recordkeeping requirements).
5. How We Share Information
We share personal information only as described below. We do not sell your personal information, and we do not share it for cross-context behavioral advertising.
- Service providers (processors). Stripe, Inc. (payment processing); Resend (transactional email delivery — your access link and service notices); PostHog (privacy-conscious product analytics); automated-processing providers used to classify, match, and draft results; and hosting and infrastructure providers (including our database provider) that operate and store the Service's data.
- Public data sources. We build the attorney directory from public and third-party data sources, such as public state-bar records and the Free Law Project / CourtListener. We send these sources queries to compile listings; we do not send them your personal case data.
- Legal and safety. We may disclose information if required by law or legal process, or to protect the rights, property, or safety of Martello Systems, our users, or others, or to enforce our Terms.
- Business transfers. If we are involved in a merger, acquisition, financing, or sale of assets, your information may be transferred as part of that transaction, subject to this Policy.
- With your direction. We share information when you ask us to or otherwise consent.
6. Cookies & Analytics
We use a limited set of cookies and similar technologies. Essential cookies always operate — for example, a cookie to hold the high-entropy results-access token (stored as an httpOnly cookie, so the token does not appear in browser history or referrer headers) — because the Service cannot function without them. Analytics are consent-gated. We use Google Analytics 4 (GA4) to understand how the site is used, and its scripts and cookies are not loaded until you click "Accept" on our cookie banner. If you decline, or until you make a choice, no GA4 analytics cookies are set and no analytics data is collected through GA4. We do not use advertising or cross-site retargeting cookies. You can also control cookies through your browser settings; disabling essential cookies may affect functionality. You may change your analytics choice at any time by clearing the site's stored consent in your browser.
7. Data Retention
- Case descriptions and uploaded documents: retained for 90 days after results are delivered, then deleted (you may request earlier deletion — see Section 9).
- Generated outreach letters: retained for 90 days, then deleted.
- Payment records (Stripe identifiers and amounts): retained as required for accounting and tax purposes, up to seven (7) years.
- Technical logs: retained for a limited period for security and operations.
When information is no longer needed, we delete or anonymize it. Certain records may be retained longer where required by law.
8. Security
Your case description and uploaded documents are encrypted at rest with AES-256-GCM, and the encryption key is held separately from the data. We also use encrypted transport (TLS), access controls on sensitive endpoints, reputable infrastructure and payment providers, and a high-entropy access token delivered only to the email associated with your case. However, no method of transmission or storage is completely secure, and we cannot guarantee absolute security. Anyone with your results link can view your results, so keep it confidential. If we become aware of a breach affecting your personal information, we will notify you and authorities as required by law.
9. Your Privacy Rights
Depending on where you live, you may have rights to: access a copy of the personal information we hold; correct inaccurate information; delete your personal information (including early deletion of your case data); port/export your data; object to or restrict certain processing; withdraw consent where processing is based on consent; and non-discrimination for exercising your rights.
California residents (CCPA/CPRA). You have rights to know, access, correct, and delete personal information, and to opt out of any "sale" or "sharing" — note that we do not sell or share personal information as those terms are defined.
EEA/UK residents (GDPR/UK GDPR). You have the rights listed above and the right to lodge a complaint with your local data protection authority.
To exercise any right, email support@attorneymatch.app from the email address associated with your case. We will verify your request and respond within the timeframes required by applicable law.
10. Children's Privacy
The Service is intended for users who are at least 18 years old and is not directed to children. We do not knowingly collect personal information from anyone under 18. If we learn that we have collected such information, we will delete it. If you believe a minor has provided us information, contact support@attorneymatch.app.
11. International Users
We operate in the United States, and the Service is intended primarily for U.S.-based users. If you access the Service from outside the United States, you understand that your information will be processed in the United States, where data-protection laws may differ from those in your country. By using the Service, you consent to this transfer and processing, subject to this Policy and applicable law.
12. Changes to This Policy
We may update this Privacy Policy from time to time. When we make material changes, we will update the "Last updated" date and may provide additional notice. Your continued use of the Service after the changes take effect constitutes acceptance of the updated Policy.
13. Contact
If you have questions or requests regarding this Privacy Policy or your personal information, contact Martello Systems LLC — Attorney Match, at support@attorneymatch.app (attorneymatch.app).