Privacy policy

Scope and the information you choose to share

This policy describes how the InstaLaw operator identified below collects, uses, and discloses personal information through our U.S. attorney directory, accounts, community, and developer tools. It also covers professional information about listed attorneys who have not created an account. Independent attorneys, their firms, and external applications are responsible for their own privacy practices.

You can browse without an account. Private inquiries are shared with the selected attorney’s authorized account. Questions, reviews, answers, and guides publish immediately; approved profile information can also become public. Before submitting, leave out confidential case details and unnecessary information about yourself or others. Accepting our terms does not waive your privacy rights.

Information collected and why

We collect information you provide, information produced when you use the service, and professional information from public registries, law-firm websites, and authorized profile contributors. Depending on the features you use, the categories and purposes are:

• Account and contact information: email, account name, user identifier, verification status, and account timestamps to sign you in, maintain your account, and send service messages. Email-link sign-in does not ask you to create a password.
• Professional and claim information: attorney name, registration number and status, admissions, business contact and office details, education, practice information, source records, profile edits, and claim evidence. We use these to build the directory, review publication and authority to manage a profile, record decisions, and address corrections.
• Inquiries and communications: the selected attorney, title, message, matter jurisdiction, account name, replies, status, timestamps, and sharing authorization. We use these to deliver and manage conversations, notify participants, and maintain delivery and authorization records.
• Community contributions: questions, reviews, ratings, consultation or hiring relationship, answers, guides, AI model and agent names, attorney assessments of AI answers, helpful votes, reports, and removal records. We use these to publish contributions, address abuse, and let you track or withdraw your submissions.
• Saved items and preferences: saved attorney identifiers, comparisons, filters, and drafts to provide the choices you make. Some stay on your device; signed-in saved lawyers are stored with your account.
• Technical and usage information: IP address, browser or user-agent information, session identifiers, request times, requested pages and search parameters, errors, and rate-limit and audit records. We and our infrastructure providers process these to serve requests, authenticate users, diagnose failures, prevent abuse, and protect the service. An IP address can indicate an approximate location, which we use to prefill an editable search location. If you choose “Use my location” and allow browser access, your device supplies coordinates. We round them before sending them to our server, look up a nearby city using a postal dataset, and do not save the coordinates to your account or send them to an external geocoding or AI provider. Only the city appears in your search URL.
• Support information and administrative files:information you send with a support or rights request, and files uploaded by authorized administrators for operational review. These files use private storage and are not a public document-sharing feature.

An inquiry or post may reveal sensitive information about health, finances, family, immigration, criminal matters, or other people even when a form does not ask for it. Do not provide identity numbers, financial credentials, medical records, or confidential documents. We use any sensitive details you choose to provide only as needed for the feature you request, safety, or legal obligations; we do not use them to build advertising profiles or infer personal characteristics. There is no payment-card collection in the current service.

Retention depends on the category and purpose described in the retention section. You can decline optional fields or avoid submitting information; account and delivery features cannot work without their required fields.

Public profiles, contributions, and AI discovery

Published attorney profiles can include business email, phone, office location, professional background, and linked source records. Published questions, reviews, answers, and guides are visible to visitors. Attorney answers and guides are attributed to the relevant attorney. AI answers display the submitter’s self-declared model or agent name; these names are not verified identity. Published attorney assessments identify the attorney and are attached to the specific AI answer. Ordinary question and review pages do not display the author’s account email, but details in the text can still identify you. Questions display the submitter’s self-reported person or AI agent type and any optional public name. Public question submissions and AI-answer submissions do not require an account. For signed-in contributions, we retain the connection to your account internally.

Search engines, automated visitors, and our public API and read-only MCP tools can retrieve public directory and Q&A information. Others may quote, cache, redistribute, or process public content with AI. Our public discovery tools do not provide access to private inboxes, account emails, or claim evidence. The current service does not send private inquiries to a generative AI provider or use them to train AI models.

With Smart search enabled in attorney search, or Smart matching in Legal Q&A search, a short search description may be sent through Vercel AI Gateway to Google’s Gemini model to select a practice area. We send the search wording, not your account, private inquiries, or device coordinates. We request provider routing that disallows training and requires zero data retention; infrastructure security and usage records are separate. Turn off the smart search option to avoid this AI processing. Do not include confidential or sensitive details in a search. Rate limits use keyed, hashed network identifiers and counters; the application does not store the search wording in those counters.

For attorney web discovery, we send the selected practice area and city or state through Vercel AI Gateway to Google’s Gemini model and Parallel’s web search service. We do not send your original search description, account information, private inquiries, or coordinates to that web search. We store public professional findings and their source evidence in our database and use supported details to create public, unclaimed directory profiles. These profiles are labeled as source-reported; details and current licensing are not independently verified. Private account information and claim evidence are not used to populate them. Saved search results may be reused to avoid repeated provider calls.

When you claim a profile, we check your verified email against the supporting public page and firm domain, inspect DNS and domain registration records, and retain the results with your claim. We may send the attorney name, firm name, and a limited extract of the public page through Vercel AI Gateway to Google’s Gemini model to help a human reviewer compare names and identify statements about firm history. We do not include your account email, private explanation, or DNS challenge in that AI request; an email already on the public page may appear in its extract. We request zero data retention and no prompt training. AI and technical checks do not approve claims; a reviewer makes the decision. Optional DNS proof establishes domain control, not attorney identity or authority.

An external AI assistant may send us search terms at your direction; its provider controls what it does with your conversation and the results. Check that provider’s policy before sharing sensitive information. Removing content from InstaLaw cannot guarantee removal from external caches, archives, or another party’s systems.

Who receives information

• Your chosen recipient: an inquiry’s title, body, jurisdiction, account name, and subsequent replies are available to the authorized account for that attorney. That person may be an attorney or an authorized representative. Sending an inquiry is not permission to distribute it to a list of unrelated lawyers. Attorneys may retain received information under their own legal and professional obligations.
• The public: the published information described above. Community contributions publish immediately. Removed content and unpublished profile updates are excluded from public discovery.
• Service providers: Vercel supplies hosting and private file storage and AI Gateway, Google processes supported search descriptions and public professional excerpts, Parallel supplies attorney web search, Neon supplies the database, and Resend delivers sign-in and claim emails when configured. These services process the content and technical information needed for those functions. Providers may also process their own security and delivery logs.
• Authorized operators: personnel with access for publication or claim review, support, maintenance, privacy requests, security, or abuse investigations. Private storage does not mean information is inaccessible to the service operator or its necessary infrastructure providers.
• Legal and safety recipients: where reasonably necessary to comply with applicable law or valid legal process, protect rights or safety, investigate abuse, or establish or defend legal claims. We may also disclose information to advisers and a successor in a merger, financing, or business transfer, subject to applicable protections and any required notice or consent.

In the current service, we do not sell personal information, share it for cross-context behavioral advertising, or use it for targeted advertising. We do not sell private inquiries as leads. We will update the notice and provide any legally required choices before introducing materially different practices.

Cookies, local storage, and browser signals

We use necessary authentication cookies to maintain your signed-in session. Sessions are configured to expire after seven days, subject to renewal while active. Email sign-in links expire after ten minutes and are single-use. Expiration ends access; it is not a promise that every related database or log record is deleted at that time.

Browser local storage keeps your comparison selections. They remain on that browser until you remove them, clear site data, or the browser removes them. Someone using the same browser profile may be able to see them. Saved lawyers, inquiries, and submitted contributions are stored with your account on our servers.

You can clear site data in your browser, remove comparison selections, and sign out. Blocking necessary cookies prevents account features from working. Clearing browser storage does not delete your server-side account, inquiries, or public submissions.

The current application does not include advertising pixels, third-party behavioral analytics, or session-replay scripts. We do not track your activity across other websites for advertising. Browser Do Not Track signals do not change the necessary processing described here. Global Privacy Control signals indicate an opt-out of sale or sharing; because we do not engage in those activities, there is no such processing to switch off in the current service. These signals do not disable authentication or security logging.

Retention and deletion

Retention depends on the feature, whether information is public, an account or matter remains active, and any security, dispute, or legal recordkeeping needs. There is no single automatic deletion period for all information in the current service:

• Account details and saved lawyers remain available for the account until removed or a closure or deletion request is processed.
• Inquiries and replies remain in the conversation history even after it is closed. Closing an inquiry is not a deletion request. Consent and audit records may need to outlast the conversation to document authorization or resolve disputes.
• Public profiles and source records support the directory and correction history. Closing an attorney’s account does not automatically delete independently sourced professional records.
• Withdrawing a contribution removes it from public display; the submission, moderation decision, and related audit records can remain internally. Request deletion separately if you want us to review those records for removal.
• Claim evidence, support requests, administrative files, security logs, email delivery records, and backups are retained according to their operational purpose, provider settings, and applicable recordkeeping needs. Access-token expiry is separate from record retention.

When processing a deletion request, we assess which information can be deleted or deidentified and which must be retained for a lawful purpose. We will explain applicable exceptions. Backup copies may persist until overwritten or deleted under the provider’s backup process, with retained copies protected and used only for the remaining purpose. Deletion cannot recall information already received independently by an attorney or another third party.

Your choices and privacy requests

You can remove saved lawyers, withdraw your contributions from My contributions, and edit an attorney profile you are authorized to manage. To request access or a copy of your data, correct other information, close an account, delete information, or raise a privacy concern, use the contact details below. A request about a public listing does not require you to claim it or create an account. Account deletion is currently handled by request, not by an instant self-service deletion button.

Depending on where you live and which laws apply to InstaLaw, you may have rights to know about processing, access, correct, delete, or obtain portable copies of personal information; object to or restrict certain uses; withdraw consent for future processing; or opt out of sale, targeted advertising, certain sharing, or qualifying automated decisions. California residents may have rights under the CCPA, including limits on certain uses of sensitive personal information, where that law applies. Directory sorting does not make legal or similarly significant decisions about you.

We may verify a request using your account email or other information proportionate to its sensitivity. Authorized agents may submit requests with evidence of authority; additional identity verification may be required. We will respond within the deadlines required by applicable law, explain a denial or necessary extension, and will not unlawfully discriminate against you for exercising your rights. You can appeal a denial by contacting us with “Privacy appeal” and the original request details, and may complain to your state attorney general or other competent privacy regulator.

Withdrawing sharing consent cannot reverse an earlier delivery. You can stop sending messages and ask us about further processing. For copies held by an independent attorney, contact that attorney as well. Sign-in and account-status emails are service communications; agreeing to this policy is not an opt-in to marketing.

Security and processing locations

We use safeguards such as verified sign-in, authorization checks for private conversations and profile access, request limits, and private storage for administrative files. No service can guarantee complete security. Keep sign-in links private and report suspected unauthorized access using our contact details. InstaLaw is not a confidential document vault and does not promise attorney-client privilege or HIPAA-compliant intake.

The service focuses on U.S. attorneys. Our providers may process information in the United States and other locations where they operate; privacy protections can differ by location. Where transfer restrictions apply, the legally required safeguards must be used. Using the site or accepting this policy alone is not a waiver of those protections or consent to an otherwise unlawful transfer.

Children’s information

Accounts and submissions are intended for adults 18 and older. The service is not directed to children under 13, and we do not knowingly collect their personal information. Do not include identifying information about children in public posts. If you believe a child has provided personal information, contact us so we can investigate and arrange appropriate deletion or other legally required action.

Changes to this policy

We will update the date on this page when our practices change. For a material change, we will provide a prominent site notice or account communication before it takes effect and obtain consent when required by law. A revised policy does not retroactively authorize incompatible uses of information collected under an earlier notice.

Operator and privacy contact

InstaLaw — operator name awaiting confirmation

A monitored contact address must be confirmed before this policy is finalized. No privacy-request email address is available in this draft.

Include the relevant page or account email and a brief description of your request. Do not send passwords, sign-in links, government ID numbers, or confidential case documents.