Privacy Policy

We collect information to provide, improve, and secure our Service. The information we collect falls into three categories:

Personal Information: When you create an account, we collect your name, email address, phone number, bar license number, firm name, firm address, and billing information. If you are part of an organization, your organization's administrator may also provide additional details about your role and permissions. We collect information you provide when filling out intake forms, engagement letters, and other documents within the platform. When you invite clients or colleagues to the platform, we collect the contact information you provide for those individuals.

Usage Information: We automatically collect information about how you use the Service, including the features you access, the frequency and duration of your sessions, the matters and documents you create or modify, the searches you perform (including conflict checks), and the communications you send or receive through the platform. This information helps us understand usage patterns, improve our features, and detect unauthorized activity. We also collect information about your interactions with our customer support team, including the content of support requests and our responses.

Device and Technical Information: When you access the Service, we automatically collect certain technical information from your device, including your IP address, browser type and version, operating system, device identifiers, screen resolution, and the pages you visited before and after accessing the Service. We collect this information using cookies, web beacons, and similar technologies described in Section 8 below. We also collect information about the network you use to access the Service, including your approximate geographic location based on your IP address.

We use the information we collect for the following purposes:

Service Delivery: To provide, maintain, and improve the Service, including processing your transactions, sending notifications about matters and deadlines, generating conflict check reports, and facilitating secure communications between you and your clients. We use your bar license information to verify your identity and eligibility for certain features designed specifically for licensed attorneys.

Communication: To send you technical notices, updates, security alerts, and administrative messages. To respond to your comments, questions, and support requests. To send you marketing communications about features, products, and services we believe may interest you, where you have consented to receive such communications. You may opt out of marketing communications at any time.

Security and Fraud Prevention: To detect, prevent, and address technical issues, security threats, and fraudulent or illegal activities. We monitor for suspicious login attempts, unauthorized access, and unusual usage patterns that may indicate a security breach. We use device and location information to detect impossible travel and credential stuffing attacks.

Analytics and Improvement: To analyze usage trends, measure the effectiveness of our features, and understand how users interact with the Service. We use this information to improve the Service's functionality, user interface, and performance. All analytics are performed on aggregated, de-identified data whenever possible.

Compliance: To comply with applicable laws, regulations, legal processes, or enforceable governmental requests. To enforce our agreements with users, including these Terms of Service. To protect the rights, property, or safety of Bexvon, our users, or the public. We may disclose information as we believe necessary to comply with a court order, subpoena, or other legal obligation, provided that we will make reasonable efforts to notify you unless we are legally prohibited from doing so.

We do not sell, rent, or trade your personal information to third parties. We share your information only in the following limited circumstances:

Service Providers: We share information with trusted third-party service providers who assist us in operating the Service, including cloud hosting providers, payment processors, email delivery services, and customer support platforms. These service providers are contractually obligated to use your information only as necessary to provide their services to us and must maintain the confidentiality and security of your data. These include our cloud hosting and object storage providers, our transactional email providers, and our payment processors. We will name the current providers on request.

Organization Members: If you are part of a law firm or organization using the Service, certain information you input may be visible to other members of your organization based on the access permissions configured by your administrator. This may include matter details, documents, communications, and billing information. Your organization's administrator controls these permissions, and you should direct questions about internal data access to your administrator.

Client Portal: When you invite clients to the client portal, they will have access to specific documents, messages, and information that you designate for sharing. You control what information is shared with each client through the platform's permission settings.

Legal Requirements: We may disclose your information if we believe in good faith that disclosure is necessary to comply with applicable law, regulation, legal process, or enforceable governmental request. Before disclosing any information pursuant to legal process, we will make reasonable efforts to notify you, unless we are legally prohibited from doing so or the request involves an emergency involving danger of death or serious physical injury.

Business Transfers: In connection with any merger, acquisition, reorganization, or sale of all or a portion of our assets, your information may be transferred as part of that transaction. We will notify you via email and/or a prominent notice on our Service of any change in ownership or uses of your personal information.

We implement comprehensive security measures to protect your information from unauthorized access, alteration, disclosure, or destruction. Our security program includes the following controls:

Encryption: All data is encrypted in transit using TLS 1.3 with strong cipher suites. Data at rest is encrypted using AES-256-GCM authenticated encryption, which protects both the confidentiality and the integrity of stored content. Client communications and documents are encrypted at rest under keys controlled by Bexvon. This is not end-to-end encryption: because the Service must process your content to provide features such as search, conflict checking, deadline calculation, and document assembly, our systems decrypt that content in the course of operating the platform. Access to the production systems that hold encryption keys is restricted, logged, and monitored under the access controls described below. Encryption keys are held as environment secrets, kept separate from our token-signing secrets, and can be rotated through a versioned rotation procedure that re-encrypts stored data under the new key.

Access Controls: We enforce role-based access controls (RBAC) and the principle of least privilege across all systems. Our employees and contractors have access to your data only on a need-to-know basis and only as necessary to perform their job functions. All access to production systems is logged, monitored, and subject to regular review. Multi-factor authentication is required for all internal access to systems containing user data.

Infrastructure Security: Bexvon runs on managed cloud infrastructure, and document storage is provided by a third-party object storage service. Where our infrastructure providers hold certifications such as SOC 2 or ISO 27001, those certifications belong to those providers and describe their operations, not ours. Bexvon has not completed a SOC 2 or ISO 27001 audit of its own. We use network segmentation and firewalls.

Audit Trail: Actions performed within the Service are recorded in a hash-chained audit log, in which each entry incorporates the hash of the entry preceding it. This log records who accessed what data, when, and from where. The chain is tamper-evident rather than tamper-proof: altering or removing an entry breaks the chain and is reported as a verification failure when the chain is checked. It is not physically immutable, and we do not claim that Bexvon personnel with production database access are technically incapable of altering it — what the design provides is detection, not prevention. Used together with the access controls above, this gives evidence of record integrity for regulatory and legal purposes.

Incident Response: We maintain a comprehensive incident response plan and conduct regular tabletop exercises. In the event of a data breach, we will notify affected users within seventy-two (72) hours of discovery, in compliance with applicable data breach notification laws. We will provide details about the nature of the breach, the data affected, and the steps we are taking to remediate the situation.

We understand the critical importance of attorney-client privilege to the legal profession. Our Service is specifically designed with the following privilege-preserving features:

Ethical Walls: The platform supports configurable ethical walls that restrict access to matter information based on conflict check results. When a conflict is identified, the system automatically enforces access restrictions, preventing attorneys and staff from viewing or accessing information related to conflicted matters. These walls are enforced at the application and database level.

Privilege Warnings: Our communication tools include built-in privilege warnings that remind users of the confidential nature of their communications and the importance of preserving attorney-client privilege. These warnings are displayed before sending messages, sharing documents, and inviting new participants to conversations.

Confidentiality Designations: Users can designate communications, documents, and other content as privileged or confidential within the platform. These designations are preserved in metadata and are respected by the platform's search, export, and sharing features. Privileged content is subject to additional access restrictions and audit logging.

Legal Hold Support: The platform supports legal hold functionality that preserves relevant documents and communications in their original state when litigation is anticipated or pending. Legal holds prevent the routine deletion or modification of covered data and provide a defensible chain of custody.

While we implement these protections, you are ultimately responsible for ensuring that your use of the Service complies with the attorney-client privilege requirements in your jurisdiction. We recommend consulting with a qualified ethics attorney regarding your specific privilege obligations and best practices for preserving privilege when using technology platforms.

We retain your personal information and User Data for as long as your account is active or as needed to provide the Service. After account termination, we retain your data for sixty (60) days to allow you to export your information, after which it is permanently deleted from our production systems, subject to the following exceptions:

Legal Retention: We may retain certain data for longer periods as required by law, regulation, or legal process. This includes data subject to litigation holds, regulatory investigations, or other legal proceedings. We will inform you of any extended retention periods that apply to your data where practicable.

Backup Retention: Deleted data may persist in encrypted backup systems for up to ninety (90) days following deletion from production systems. Backup data is not accessible through the Service and is subject to the same security controls as production data.

Anonymized Data: We may retain anonymized, aggregated data derived from your use of the Service indefinitely for analytical, research, and service improvement purposes. This data cannot be used to identify you or any individual user and is not subject to deletion requests.

Audit Logs: Hash-chained audit logs are retained for a minimum of seven (7) years to comply with legal and regulatory requirements applicable to legal practice management. These logs contain metadata about actions performed within the Service but do not contain the content of privileged communications or documents.

You may request earlier deletion of your data by contacting us at the contact form at bexvon.com/contact, subject to our legal retention obligations. We will process such requests within thirty (30) days and confirm completion via email.

We use cookies and similar tracking technologies to collect information about your browsing activities and to distinguish you from other users of our Service. We use the following types of cookies:

Essential Cookies: These cookies are strictly necessary for the operation of the Service. They enable core functionality such as authentication, security, session management, and load balancing. You cannot opt out of essential cookies as the Service will not function properly without them. Essential cookies include session tokens, CSRF protection tokens, and authentication state indicators.

Functional Cookies: These cookies enable the Service to remember choices you make (such as your preferred jurisdiction, dashboard layout, or notification preferences) and provide enhanced, personalized features. Functional cookies do not track your browsing activity across other websites. You may opt out of functional cookies, but some features of the Service may be affected.

Analytics Cookies: We use analytics cookies to understand how users interact with the Service, including the pages visited most frequently, the features used most often, and any errors encountered. We use this information to improve the Service's performance and user experience. Analytics cookies collect information in an aggregated, anonymized format. We use industry-standard analytics tools that comply with applicable privacy regulations.

We do not use advertising cookies or participate in cross-site tracking for advertising purposes. We do not share cookie data with advertising networks or data brokers. You can manage your cookie preferences through your browser settings. Most browsers allow you to refuse cookies, delete existing cookies, or alert you when a cookie is being set. Please note that disabling certain cookies may affect the functionality of the Service. For more information about how we use cookies, please contact us at the contact form at bexvon.com/contact.

Depending on your jurisdiction, you may have certain rights regarding your personal information. We are committed to facilitating these rights regardless of where you are located:

Right of Access: You have the right to request a copy of the personal information we hold about you. You can access much of this information directly through your account settings. For additional information, you may submit a data access request to the contact form at bexvon.com/contact, and we will respond within thirty (30) days.

Right to Correction: You have the right to request that we correct any inaccurate or incomplete personal information. You can update most of your personal information directly through your account settings. For information that cannot be self-updated, contact us and we will process your request promptly.

Right to Deletion: You have the right to request that we delete your personal information, subject to certain exceptions (such as legal retention requirements, ongoing legal proceedings, or legitimate business interests). Upon receiving a verified deletion request, we will delete your personal information from our production systems within thirty (30) days and from backup systems within ninety (90) days, unless a legal exception applies.

Right to Data Portability: You have the right to request a copy of your personal information in a structured, commonly used, machine-readable format. You may also request that we transmit this data directly to another service provider where technically feasible. We support data exports in standard formats including CSV, JSON, and PDF.

Right to Restrict Processing: You have the right to request that we restrict the processing of your personal information in certain circumstances, such as when you contest the accuracy of the data, when processing is unlawful but you prefer restriction over deletion, or when we no longer need the data but you require it for legal claims.

Right to Object: You have the right to object to the processing of your personal information for direct marketing purposes or for purposes based on our legitimate interests. Upon receiving your objection, we will cease processing your data for those purposes unless we have compelling legitimate grounds that override your interests.

To exercise any of these rights, please contact us at the contact form at bexvon.com/contact. We may request verification of your identity before processing your request. We will not discriminate against you for exercising your rights under this policy.

If you are a California resident, the California Consumer Privacy Act (CCPA) grants you additional rights:

Right to Know: You have the right to request that we disclose what personal information we collect, use, and disclose about you (a "Right to Know" request). We are required to provide this information for the 12-month period preceding your request. Our response will include the categories of personal information collected, the categories of sources from which the information was collected, the business or commercial purposes for collecting or selling the information, and the categories of third parties with whom we share the information.

Right to Delete: You have the right to request that we delete any personal information about you that we have collected from you, subject to certain exceptions outlined in the CCPA. We will honor your deletion request within forty-five (45) days of receipt, with a possible forty-five (45) day extension for complex requests, and we will notify you of the extension within the initial forty-five (45) day period.

Right to Opt Out of Sale: We do not sell personal information as the term "sale" is defined under the CCPA. Because we do not sell personal information, there is no need to provide an opt-out mechanism for such sales. We also do not sell personal information of minors under 16 years of age.

Right to Non-Discrimination: We will not discriminate against you for exercising any of your CCPA rights. This means we will not deny you goods or services, charge you different prices, provide you a different level of quality of goods or services, or suggest that we will do any of these things if you exercise your CCPA rights.

Shine the Light: California Civil Code Section 1798.83 permits California residents to request certain information about our disclosure of personal information to third parties for their direct marketing purposes. To make such a request, please contact us at the contact form at bexvon.com/contact.

Bexvon is headquartered in the United States, and your information may be transferred to and processed in the United States or other countries where our service providers operate. These countries may have data protection laws that differ from the laws of your country of residence. By using the Service, you consent to the transfer of your information to these countries.

We take appropriate safeguards to ensure that international transfers of your data comply with applicable data protection laws. For transfers from the European Economic Area (EEA), the United Kingdom, and Switzerland, we rely on Standard Contractual Clauses (SCCs) approved by the European Commission, which provide appropriate safeguards for the transfer of personal data to countries that have not been deemed to provide an adequate level of data protection.

We have implemented additional measures to supplement the protections provided by SCCs, including encryption of data in transit and at rest, strict access controls, and contractual obligations for our service providers. We regularly assess the legal framework in destination countries to ensure that your data remains protected to a standard consistent with the laws of your jurisdiction.

If you have questions about our international data transfer practices or would like a copy of our Standard Contractual Clauses, please contact us at the contact form at bexvon.com/contact. We will provide the requested information within thirty (30) days of receiving your request.

The Service is not directed to individuals under the age of eighteen (18), and we do not knowingly collect personal information from children. If you are a parent or guardian and become aware that your child has provided us with personal information, please contact us at the contact form at bexvon.com/contact, and we will take steps to delete such information from our systems promptly.

Because the Service is designed for legal professionals and law firms, the collection of data from children is neither intended nor anticipated. Our registration process requires users to confirm that they are at least eighteen (18) years of age and to provide professional credentials that are inconsistent with minors' use of the platform.

In the unlikely event that we discover that we have collected personal information from a child under the age of thirteen (13) without verified parental consent, we will take immediate steps to delete that information from our servers and notify the parent or guardian in writing. If we discover that a child between the ages of thirteen (13) and eighteen (18) has provided personal information, we will delete that information upon the request of the child's parent or guardian.

Our commitment to children's privacy extends to any data we may inadvertently collect through the client portal feature. Law firms using the platform to communicate with clients should ensure that they do not include personal information of minors in their communications without appropriate consent from a parent or guardian.

We may update this Privacy Policy from time to time to reflect changes in our practices, technologies, legal requirements, or other factors. When we make material changes to this Privacy Policy, we will notify you by: (a) posting the updated Privacy Policy on our website with a revised "Last Updated" date; (b) sending an email notification to the address associated with your account; and (c) displaying a prominent notice within the Service upon your next login.

We encourage you to review this Privacy Policy periodically to stay informed about how we collect, use, and protect your information. Your continued use of the Service after any changes to this Privacy Policy constitutes your acceptance of the updated policy. If you do not agree with the changes, you must discontinue use of the Service and request deletion of your account and data.

For changes that materially reduce your rights or increase our data collection or sharing practices, we will provide at least thirty (30) days' advance notice before the changes take effect, giving you an opportunity to review the changes and exercise your rights, including the right to object or to delete your account. We maintain a history of prior versions of this Privacy Policy, and you may request a copy of any prior version by contacting us at the contact form at bexvon.com/contact.

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, use the contact form at bexvon.com/contact. We do not currently publish a postal address, a Data Protection Officer, departmental inboxes, or an EU representative; those will be listed here when they exist.

If you are not satisfied with our response to a privacy concern, you have the right to lodge a complaint with a data protection authority in your jurisdiction. In the European Union, you may contact your local supervisory authority. In California, you may contact the California Attorney General's office.