Plain-language summary. We collect what is needed to run your firm's workspace and keep it secure. Your firm's content, including client information, belongs to your firm and is treated as confidential. We do not sell or share personal information for advertising, we do not track you across other apps or websites, and we do not use your firm's content to train AI. Text recognition, Word previews and PDF conversion happen on your phone. You can delete your account at any time. This summary is for convenience only; the full policy below controls.
- Who we are
- Scope and roles
- Information we collect
- Processing on your device
- How we use information
- Client information and confidentiality
- Artificial intelligence
- How we share information
- Legal requests
- Security
- Security incidents and breach notification
- How long we keep information
- Deleting your account
- Your privacy rights
- State-specific disclosures
- Visitors outside the United States
- Cookies and similar technologies
- App permissions
- Children
- Changes to this policy
- Contact us
1. Who we are
VANTAGE is a practice operations platform for law firms, provided by a sole proprietorship based in the State of Louisiana (“VANTAGE,” “we,” “us” or “our”). We serve law firms throughout the United States. VANTAGE is not a law firm and does not provide legal advice. Questions about this policy go to privacy@vantage.associates.
2. Scope and roles
This policy covers personal information handled through the VANTAGE mobile app, our websites at vantage.associates and app.vantage.associates, and related services (the “Services”). It should be read with our Terms of service.
VANTAGE accounts are created by law firms (each a “Firm”) for their lawyers and staff (“Users”). We play two roles:
- For Firm Content, meaning the matters, tasks, messages, documents, scans, photos, templates and other material a Firm stores in VANTAGE, including information about the Firm's clients and opposing parties, the Firm is in control. The Firm decides what to store and why, and we process it only on the Firm's behalf and instructions, as its service provider (or “processor”). Individuals whose information appears in Firm Content, such as a Firm's clients, should direct privacy requests to that Firm. We will help the Firm respond.
- For account, security, billing and website information, we decide how it is used, as described in this policy.
3. Information we collect
| Category | Examples | Source |
|---|---|---|
| Identifiers and account details | Name, work email address, Firm, role (coordinator or member), account ID | Your Firm, when it sets you up; you |
| Sign-in and security data | Password (stored only as a salted one-way hash by our authentication provider), two-step verification enrolment, session and refresh tokens, sign-in times, failed sign-in and account-deletion attempts | You; generated as you use the Services |
| Firm Content | Matters, tasks, comments, messages, uploaded Word, Excel and PDF files, scanned pages and photos, recognised text from scans, PDF copies, templates, and anything in them, which may include client information and sensitive information about individuals | You and other Users at your Firm |
| AI usage records | Who used which AI feature, when, with which model, whether it succeeded, and the size of each request (not its text); stored message and document translations | Generated when an AI feature is used |
| Safety-check data | Web addresses found in messages, and uploaded files while they are scanned for malware | Generated when you send a link or upload a file |
| Enquiries | Name, Firm, email, optional phone number, package of interest, topic, message, and a salted one-way hash of your network address used to prevent abuse | You, through our contact form |
| Commercial information | Package, number of users, invoices and payment status for the Firm | Your Firm |
| Technical and log data | Request times, error codes, device type and operating-system version, app version, IP address as recorded by our hosting providers | Your device and browser; our providers |
We do not collect your precise location, contacts, call logs, photos you do not choose, advertising identifiers, or browsing history from other sites. We never receive fingerprint or face data (see section 18).
4. Processing on your device
Several features run entirely on your phone, so the information involved does not reach us until you choose to upload the result:
- Scanning and photo import. Pages you scan, or JPG photos you choose to upload, are processed on your phone to recognise text (OCR) and read VANTAGE cover-sheet barcodes. Pages are kept in the app's private cache only until you upload or discard them, and are then deleted from the phone.
- Word previews. Word documents are opened and displayed inside the app on your phone.
- PDF conversion. When you choose “Save as PDF,” the PDF is created on your phone and then uploaded as a new document, which is virus-checked like any upload.
- Biometric sign-in. Fingerprint or face recognition is performed by your phone's operating system.
5. How we use information
| Purpose | Information used | Legal basis (where required, e.g. for EEA/UK visitors) |
|---|---|---|
| Provide the Services: sign-in, show the Firm's workspace, deliver messages and documents to the right people | Account, security, Firm Content | Performance of our contract with the Firm; our and the Firm's legitimate interests |
| Protect the Services and Users: two-step verification, lockout, malware scanning, link checks, fraud and abuse prevention | Security, safety-check, technical data | Legitimate interests in security; legal obligations |
| Run AI features the Firm has switched on, and show the Firm its AI usage and limits | Relevant Firm Content, AI usage records | Performance of contract (on the Firm's instruction) |
| Respond to enquiries and arrange demonstrations | Enquiry data | Legitimate interests; steps before entering a contract |
| Billing and account administration | Commercial information, account details | Performance of contract; legal obligations (tax, accounting) |
| Maintain, troubleshoot and improve the Services, using aggregated or de-identified data where possible | Technical data, aggregated usage | Legitimate interests |
| Comply with law, enforce our terms, and establish or defend legal claims | Any relevant information | Legal obligations; legitimate interests |
We do not sell personal information, “share” it for cross-context behavioural advertising, use it for targeted advertising, or use it to make decisions with legal or similarly significant effects based solely on automated processing.
6. Client information and confidentiality
We understand that Firm Content often contains information protected by the attorney–client privilege, the work-product doctrine and lawyers' duties of confidentiality. We therefore:
- treat all Firm Content as the Firm's confidential information;
- do not view Firm Content except as needed to provide or secure the Services, to respond to a support request the Firm makes, or where the law requires;
- never sell Firm Content, use it for advertising, or use it to train AI models; and
- restrict access within each Firm according to the roles, document privacy settings and sharing choices the Firm and its Users make, enforced in our database itself.
Firms remain responsible for their own professional obligations, including deciding whether client consent is needed before using cloud or AI services.
7. Artificial intelligence
AI features are optional and are switched on or off by each Firm's coordinators. When a User makes an AI request (for example, planning a task, suggesting assignments, translating a message or a document, or asking a question about a matter), only the text needed for that request is sent to the AI provider the Firm has chosen: Anthropic (Claude) or OpenAI (ChatGPT). To translate a scanned or Word document, its recognized text is sent; the page images are not. We use their business programming interfaces, under terms that do not allow them to train their models on that data. The providers may keep request data for a limited period to detect abuse, as their business terms describe. Message translations are stored with the message so colleagues can read them, and are deleted with it. Translations of filed documents are stored with the document, so the same document is not sent again, and are deleted with it; a translation is saved as a separate document only if a User chooses to save it. Machine translations are not certified translations. Other AI output is stored in VANTAGE only if a User saves it, for example as a task or template. For each request we also record who made it, the feature, the model, whether it succeeded and its size, but not its text. AI output can be wrong and must be checked by a qualified person.
8. How we share information
We share personal information only as follows:
Within your Firm
Other Users at your Firm see your name and role and the content you share with them, according to your Firm's settings and your sharing choices. Coordinators can see the Firm's AI usage records.
Service providers (sub-processors)
We use these providers to run VANTAGE. Each may use the information only to provide its service to us, under written terms that require confidentiality and security.
| Provider | Purpose | Information involved |
|---|---|---|
| Supabase, Inc. | Database, file storage, authentication, server functions | All categories stored in the Services |
| Anthropic, PBC and OpenAI, L.L.C. | AI features, if the Firm enables them | Text of individual AI requests |
| Google LLC (Web Risk) | Checking web addresses against lists of known dangerous sites | Web addresses in messages |
| Our malware-scanning service, hosted on Fly.io, Inc. | Scanning every uploaded file before it can be opened | Uploaded files, transiently |
| Cloudflare, Inc. | Hosting and protecting our websites; routing our email | Website traffic and technical data; email |
| Resend, Inc. | Delivering contact-form enquiries to our inbox | Enquiry data |
| Google Fonts and Unsplash | Typefaces and photographs on our website, loaded by your browser | Your IP address and browser details, as your browser requests the files |
| Apple and Google app stores | App distribution and updates | Information you give the app store, under its own privacy policy |
We will update this list before adding a provider that processes Firm Content, and Firms may ask to be notified of changes.
Other disclosures
- Legal requirements. When required by law or valid legal process, as described in section 9.
- Protection. When reasonably necessary to protect the security of the Services, prevent fraud or abuse, or protect the safety of any person.
- Business transfers. To a successor if VANTAGE is organised as a company, merged, acquired or sold, provided the successor is bound by this policy's commitments for information collected under it. We will notify Firms in advance.
- With consent. Otherwise only with the Firm's or your permission.
9. Legal requests
If a government agency, court or private litigant asks us for Firm Content, we will direct them to the Firm where possible. Unless legally prohibited, we will promptly notify the Firm so it can object or seek a protective order, and we will disclose only what we are legally required to disclose.
10. Security
We use administrative, technical and physical safeguards appropriate to the sensitivity of legal information, including:
- encryption in transit (TLS) and at rest;
- database-level access controls that separate each Firm's data and enforce roles and document privacy;
- quarantine and malware scanning of every upload before it can be opened, and safety checks of links before they open;
- two-step verification and biometric sign-in, a temporary lockout after repeated failed sign-in attempts, and re-entry of your password to delete your account;
- short-lived download links, and website sessions kept only in memory; and
- least-privilege access to production systems, using provider security features and audit logs.
No system is completely secure. You can help by using a strong, unique password, turning on two-step verification, and keeping your device locked and up to date.
11. Security incidents and breach notification
If we learn of a breach of security that compromises personal information or Firm Content we hold, we will:
- notify each affected Firm without undue delay, and in any event within 72 hours after confirming the breach, with the information reasonably available, so the Firm can meet its own professional and client obligations;
- notify affected individuals, and regulators where required, under the data-breach notification law of the state where each affected individual lives. For Louisiana residents this means notice in the most expedient time possible and no later than 60 days after discovery, together with notice to the Louisiana Attorney General where the law requires it; and
- take reasonable steps to contain the breach, investigate it and prevent it from happening again.
Where the affected information is Firm Content for which the Firm is in control, we will coordinate with the Firm on any notices to its clients or others.
12. How long we keep information
| Information | Kept for |
|---|---|
| Your login (email, password hash, two-step settings, sessions) | Until your account is deleted, then erased immediately (section 13) |
| Firm Content | As long as the Firm keeps it. After the Firm's subscription ends: available for export for 30 days, then deleted from active systems within 90 days |
| Scanned pages and photos on your phone | Until you upload or discard them, then deleted from the phone |
| AI usage records | For the life of the Firm's subscription, for billing and limits |
| Security logs and deletion-attempt records | Generally up to 12 months |
| Enquiries | Up to 24 months after our last contact |
| Billing records | As long as tax and accounting law requires (generally up to 7 years) |
| Backups | Overwritten on a rolling basis, normally within 30 days |
We may keep information longer where the law requires it, to resolve disputes, or under a litigation hold.
13. Deleting your account
You can delete your account at any time in the app (Settings → Account → Delete account) or on our website. Instructions are on the Delete your account page. Deletion takes effect immediately and:
- erases your email address, password, two-step verification settings and all sessions;
- removes your access to your Firm's workspace; and
- replaces your name in the workspace with “Former member.”
Content you created in your Firm's workspace is Firm Content. Because Firms may be legally or ethically required to keep client files, that content stays with your Firm, shown as created by “Former member,” and your Firm can ask us to delete it. We keep a record that the account was deleted, with no name or email address attached, and AI usage records the Firm needs for billing.
14. Your privacy rights
We extend the following rights to all Users, wherever they live in the United States, and honour any additional rights your state's law provides:
- Access and portability: to know what personal information we hold about you and receive a copy in a portable format;
- Correction of inaccurate information;
- Deletion of your personal information, subject to the exceptions the law allows (such as information your Firm must keep);
- Opt-out of sale, targeted advertising and profiling. We do none of these, so there is nothing to opt out of; and
- Non-discrimination: we will not treat you differently for using your rights.
How to make a request
Email privacy@vantage.associates from the address on your account, or use the contact form. We will verify your identity (for example, by confirming control of your account email) and respond within 45 days, or tell you if we need up to 45 more days and why. You may use an authorised agent; we may ask for proof of the agent's authority and verify your identity directly. If your request concerns Firm Content, we may refer it to your Firm, which controls that content.
Appeals
If we decline your request, you may appeal by replying to our decision with “Appeal” in the subject line. We will respond within the time your state's law requires (generally 45 to 60 days) and explain our decision. If you are not satisfied, you may contact your state attorney general.
15. State-specific disclosures
VANTAGE serves Firms nationwide. Our home state is Louisiana, and our Terms of service are governed by Louisiana law, but privacy and breach-notification laws generally protect people based on where they live. This policy is written to meet those laws.
- California. In the past 12 months we collected the categories in section 3: identifiers, customer records, commercial information, internet and network activity, professional information, and sensitive personal information (account sign-in credentials, and any sensitive information contained in Firm Content). We use sensitive personal information only for the purposes the California Consumer Privacy Act permits, such as providing the Services and security, and do not use it to infer characteristics about you. We disclose these categories only to the service providers in section 8, for business purposes. We have not sold or shared personal information, and have no actual knowledge of selling or sharing information about anyone under 16. Retention periods are in section 12.
- Colorado, Connecticut, Virginia, Texas, Oregon and other states with comprehensive privacy laws. You have the rights in section 14, including the right to appeal. We do not process personal information for targeted advertising, sale or profiling with legal or similarly significant effects.
- Nevada. We do not sell covered information as Nevada law defines it.
- Louisiana. In addition to the breach-notification commitments in section 11, you may contact us at any time about how your information is handled.
Some of these laws apply only to businesses above certain size thresholds. We choose to honour these rights for all Users regardless.
16. Visitors outside the United States
The Services are designed for law firms in the United States, and information is stored and processed in the United States and other countries where our providers operate. If you are in the European Economic Area, the United Kingdom or Switzerland, you also have the rights given by the GDPR or equivalent laws, including to object to processing based on legitimate interests and to complain to your local data-protection authority. The legal bases we rely on are in section 5. Where the law requires, international transfers are protected by appropriate safeguards such as standard contractual clauses.
17. Cookies and similar technologies
Our websites do not use advertising or analytics cookies. Member sign-in on the website keeps your session in the page's memory only and ends when you close the page. Our hosting provider may set strictly necessary security cookies to protect the site from attacks. The mobile app does not use advertising identifiers or third-party tracking software. Because we do not track you across sites, we treat browser “Do Not Track” and Global Privacy Control signals as already satisfied.
18. App permissions
- Camera: used only while you scan a paper document. On Android, scanning runs through Google's document scanner.
- Photos and files: only the files or photos you choose through the system picker. VANTAGE cannot browse your photo library.
- Biometrics: handled by your phone's operating system. VANTAGE learns only whether the check succeeded.
- Secure storage: if you turn on biometric sign-in, a sign-in token is stored in your phone's hardware-backed secure storage and removed when you sign out or delete your account.
- Network: to connect to VANTAGE.
You can change permissions at any time in your phone's settings.
19. Children
VANTAGE is a professional service for adults. It is not directed to children, and we do not knowingly collect personal information from anyone under 18, except as it may appear in Firm Content that a Firm stores for its legal work, which the Firm controls. If you believe a child has created an account, contact us and we will delete it.
20. Changes to this policy
We will post any changes here and update the date at the top. If a change is material, we will notify Firms' coordinators by email or in the app at least 30 days before it takes effect. We will not use previously collected personal information in a materially different way without notice and, where the law requires, consent.
21. Contact us
VANTAGE
State of Louisiana, United States
Privacy questions and requests: privacy@vantage.associates
General enquiries: contact@vantage.associates
Contact form