Privacy Policy
Effective September 2, 2026 · Draft for counsel review
Two kinds of people, two roles
Firm users (attorneys and staff who create accounts): we are the controller of your account data. Prospective clients (people who contact a firm through channels the firm connects to Nightshift): the firm is the controller of your information; we process it on the firm's behalf to run their intake desk. If you contacted a law firm and have questions about your information, contact that firm — we act on their instructions.
What we collect
Account data: name, work email, password hash, firm details, actions you take in the product (kept in an audit log). Inquiry data, processed for firms: the content of messages sent to the firm (which may include health and injury details), sender contact details, call metadata and voicemail recordings/transcripts from the telephony provider, and the AI-generated case summaries and draft replies. Billing: handled by Stripe; we never see full card numbers. Technical: logs and IP addresses for security and rate limiting. We use no advertising trackers.
How inquiry data is used
Solely to provide the Service to the firm: message text is sent to our AI provider (Anthropic) to produce the structured summary and draft reply; deadlines are computed by our own code; conflict checks run against the firm's own list. We do not sell personal information, use it for advertising, or use it to train AI models. Outbound replies are sent only after a person at the firm approves them.
Subprocessors
Anthropic (AI processing of message text), Twilio (phone, SMS, WhatsApp), SendGrid (email), Stripe (payments), [HOSTING PROVIDER — e.g. Vercel] and [DATABASE PROVIDER — e.g. Neon] (hosting and storage). Each receives only what its function requires.
Security and retention
Data is encrypted in transit; access is scoped per firm and enforced on every query; passwords are hashed (bcrypt); consequential actions are recorded in an append-only audit log. We retain firm data for the life of the subscription and delete or return it on request within 30 days of termination, except records we must keep for legal or security purposes.
Your choices
Firm users can access and correct account data in the product and request deletion at [SUPPORT EMAIL]. Depending on where you live (e.g., California, EU/UK), you may have additional rights — access, correction, deletion, portability — which we honor directly for account data and support the firm in honoring for inquiry data. We respond within the time the applicable law requires.
Changes and contact
We'll post changes here and notify firm admins of material ones. Questions: [SUPPORT EMAIL] · [COMPANY LEGAL NAME], [ADDRESS].