Legal
Privacy policy
What Corro collects, why, who processes it on our behalf, and how long we keep it.
Items in [square brackets] are for counsel to complete.
Who we are
[Corro legal entity and address.] For a firm's case data, the firm decides what is brought into Corro and why; we process it on the firm's behalf to run the service.
What we collect
From people who use the app
- Account details: name, email address, password (stored only as a hash), firm and role.
- Sign-in records: sessions, and the IP addresses used for rate-limiting sign-in, sign-up and password reset.
- Billing details through Stripe: the billing contact and payment status. Card numbers are entered on Stripe's page and never reach our servers.
Case data your firm brings in
- What Clio holds for the matters you connect, read-only: contacts, custom fields, notes, logged communications, tasks, calendar entries, expenses, bills and documents.
- Files you upload, and what Corro derives from them: page images, extracted facts with their quotes and sources, review decisions, provider-share settings and messages, and Cory's answers and drafts.
- Case files can contain health information about your clients. The firm decides whether to bring them in.
From providers who open a shared link
- That the link was opened and when, and any message the provider sends to the firm. A provider's message is checked against the file, which sends it to our AI provider.
On this website
- This website sets no cookies and runs no analytics or trackers. Our host keeps ordinary request logs.
How we use it
- To run the service for your firm: read the case, show it to your team, share what you choose with providers, and answer your questions about it.
- To keep accounts secure and to bill your firm.
- To send account emails (verification, password reset, receipts).
We do not sell personal information, and we do not use your firm's case data to train AI models.
Who at Corro can see it
Our policy: Corro staff do not open your case files unless you ask us to, for support. If you ask us for help with a specific problem, we look only with your written permission and only at what the problem needs. A small team operates the servers that store your data; that access is used only to run and protect the service.
Who processes it for us
| Service | Purpose |
|---|---|
| Our hosting provider (named on the security page before launch) | Hosting the app and its storage |
| OpenAI | Reading the file, and answering Cory, the checker and provider-share checks (your question or draft and the parts of the file it needs). Sent with response storage off; OpenAI states API data is not used for training unless the customer opts in (we have not), and may keep abuse-monitoring logs for up to 30 days. |
| Stripe | Payments |
| Resend | Account email |
| Vercel | Hosting this website |
| Clio | Your firm's own source of matters, read with your firm's authorisation |
How long we keep it
Your firm's data is yours. An owner can delete the firm and everything in it at any time from Settings; it is removed within 24 hours. If you cancel or take the refund, your cases stay readable, read-only, for 30 days in case you come back; after that they are permanently deleted. The sample case stays available. Deletion removes data from the live system; backup copies held by our hosting provider, encrypted at rest, can outlast it, and the security page will state for how long once the launch host is chosen.
[Retention of billing records and logs, for counsel; backup retention once set.]
Security
See the security page for how data is separated between firms, how sign-in works, and what we do not claim.
Your choices and rights
- Users can update their account details in the app. Owners can delete the firm.
- For a request about case data, contact the firm that holds the case; we will help the firm answer it.
- [Rights under applicable law, including California, and how to exercise them.]
Changes
We will post changes here and tell account owners by email before material changes take effect.
Contact
Write to contact@corro.live.