How Lawma handles information — today and at launch.

A · While Lawma is in private prototype

You're here by invitation. Access to this site is granted to specific investors, advisors, counsel, and partner candidates. We treat that access as a confidential disclosure under standard nondisclosure norms, even when no separate NDA has been signed.

What we collect from you on this site, today.

• Server logs. Standard web-server logs: IP address, user agent, the URLs you load, and timestamps. Kept for operational debugging; not used for analytics or advertising. No third-party analytics scripts are loaded on this prototype.
• Browser storage. The site uses localStorage on your device for small UI preferences only (e.g., whether the floating translate widget is collapsed). Nothing leaves your browser.
• Contact form submissions. If you fill out the form on the Contact page, the email and message you send go to the Lawma team inbox. Used to reply to you; not shared.
• Partner intake submissions. If you submit a partner intake form, the answers are stored in the prototype database so the partner team can review them. Synthetic data only at this stage.

What we do NOT collect, today. No real client case data is processed through this prototype. All in-app case data is synthetic test fixtures. The attorney-supervised workflows that handle real privileged data are not yet live — they roll out under the production architecture described in our internal Engineering Plan (AWS-native, Auth0, Anthropic under a zero-data-retention agreement, multi-tenant data isolation enforced at the data layer).

Cookies.No tracking cookies. The site doesn't set a session cookie for marketing pages. The partner portal sets one HttpOnly session cookie when an authorized partner signs in — strictly for session authentication.

B · What the launched product will commit to

The launched, attorney-supervised product handles privileged legal information. Our commitments at launch — to be reflected in the production privacy policy our counsel finalizes — include:

• Encryption in transit and at rest for all case data, using managed key infrastructure (AWS KMS).
• Multi-tenant isolation enforced at the database layer with row-level security, not just at the application layer.
• Zero-data-retention LLM use. Any AI service that processes case content runs under a zero-data-retention agreement, so prompts and completions are not retained by the model provider for training or any other purpose.
• Full audit logging of who accessed which case record, with retention sufficient for both internal review and regulatory response.
• Attorney-client privilege protection at the data-architecture layer (two-party walls) — case content visible only to the supervising attorney, the client, and the small audited support staff necessary to operate the system.
• Data-deletion + portability rights consistent with California (CCPA) and applicable federal law.
• Breach response commitments with jurisdiction-appropriate notification timelines.

Questions or concerns

Email hello@lawma.co with any privacy or confidentiality question — a real person answers. For matters that need to be in writing for the file, please use the Contact pageform and we'll route you to whoever owns the answer.

Status:This is the pre-launch privacy & confidentiality notice, last updated 2026-05-30. The launch-grade privacy policy is drafted with counsel before the product is offered to clients of any law firm.