Privacy Policy

1.1 Our Role: Controller and Processor

Lawtte sells its Services to law firms, and most of the personal information we handle belongs to a firm’s callers, clients and website visitors rather than to our own account holders. For that information the law firm is the controller and Lawtte is the processor: we hold it and act on it only on that firm’s instructions and under our agreement with the firm.

In practice, if you called a firm’s AI receptionist, spoke to its website assistant, or sent it documents, the firm decides what happens to that information. Ask the firm — not Lawtte — to give you a copy of, correct, or delete information about your matter. If you write to us instead, we will tell you to contact the firm and pass your request on to it.

Lawtte is the controller of the data we collect for our own account, and of billing and website data described in Sections 2, 10 and 12.

2.1 Information You Provide Directly

We collect personal information that you voluntarily provide when you use or interact with our Services. This may include:

• Account and Contact Details: Name, email address, phone number, organization, or other contact data when creating an account or completing intake forms.
• User Intake Data: Case details, legal questions, or other preliminary information you choose to submit to our AI reception system.
• Payment Information: If you purchase services from us, our third-party payment processors may collect payment details such as card information or billing address.
• Communications: Emails, chat messages, or support inquiries you send us.

2.2 Information Collected Automatically

When you access or use our Services, we may automatically collect certain data to understand usage and improve our offerings, including:

• Device & Usage Data: IP address, browser type, operating system, device identifiers, and details about how you interact with our Site or Services.
• Cookies & Tracking Technologies: We utilize cookies, web beacons, and similar tools to enhance user experience and analyze traffic. You can manage your cookie preferences through your browser or our cookie banner (if applicable).
• Log Files & Diagnostics: System logs and crash reports that help us identify technical issues or improve performance.

2.3 Information from Third Parties

We may receive information from third parties, including:

• Public Databases & Social Media: If you choose to link your social media account or use social logins to register, we might access limited profile information from those platforms.
• Marketing Partners: Contact data or demographic information where lawful, used to offer relevant content or updates.

2.4 AI Connectors and Outbound Calling

If a Lawtte Studio account owner connects Lawtte to ChatGPT, Codex, Claude, or another supported AI client, we process only the information needed to authenticate the connection and perform the action the account owner requests. Depending on the requested action, this may include:

• Connection Data: the account user ID, connected client ID, selected Lawtte Studio, authorization grant, and connection timestamps.
• Call Instructions: the confirmed recipient name and phone number, a brief call objective, and optional task-specific context supplied by the account owner.
• Call Records: call status, date and duration, outcome, summary, transcript, recording reference, and do-not-call status where applicable.

Do not submit payment-card information, protected health information, government identifiers, passwords, authentication codes, API keys, or other credentials through an AI connector. Lawtte does not request the full conversation held in the connected client and does not use connector data for advertising or model training.

2.5 Minors’ Information

We do not knowingly collect or solicit data from anyone under the age of 18. If we learn we have inadvertently collected such information, we will promptly delete it. If you believe a minor has provided us with data, please contact us to address this issue.

6.1 Security Measures

We implement commercially reasonable technical and organizational safeguards designed to protect your data. However, no data transmission or storage system can be guaranteed 100% secure. You can help protect your data by:

• Using strong, unique passwords and updating them regularly
• Keeping your account credentials confidential
• Logging out after each session on shared devices

6.2 Retention

We retain personal information only as long as necessary for legitimate business purposes, such as:

• Providing and improving our Services
• Fulfilling legal or contractual obligations
• Resolving disputes and enforcing agreements

Once data is no longer needed, we securely delete or anonymize it in accordance with our record retention policies.

Our connector-specific retention periods are:

• OAuth connection grants are retained until the account owner disconnects the client or the Lawtte account is deleted.
• Call instructions, call records, transcripts, summaries, and recording references are retained while the Lawtte account is active so the account owner can review call history and results.
• After account closure or a verified deletion request, connector and call data is deleted or de-identified within 30 days, unless a longer period is required by law, needed to resolve a security incident or dispute, or requested by the account owner.

9.1 What We Access, and Why

• Your list of calendars (name and identifier only) — so you can choose which calendar the receptionist should book into.
• Busy times on that calendar — start and end times only, so the receptionist never offers a caller a slot you are already booked in. We do not receive event titles, descriptions, attendees, or locations for your existing events.
• Permission to create events — so a consultation a caller books is written to your calendar, with the caller as an invitee when they give an email address.
• Your email address and basic profile — to show which Google account is connected.

9.2 What We Do Not Do

• We do not read the contents of events we did not create.
• We do not modify or delete your existing calendar events.
• We do not copy your calendar into our systems beyond what is described below.
• We do not use Google user data to train, retrain, or improve any generalized or artificial intelligence or machine learning model.
• We do not sell, rent, or transfer Google user data, and we never use it for advertising.

9.3 Storage, Retention, and Deletion

• Access and refresh tokens are stored encrypted and used only to serve that firm’s own booking requests.
• Busy times are requested at the moment a caller asks about availability and are used to answer that call. They are not retained as a copy of your calendar.
• For each booking we create, we retain the event identifier and the appointment time so the booking can be traced, rescheduled, or cancelled.
• When you disconnect the calendar in Lawtte, or revoke access at myaccount.google.com/permissions, the stored credentials are deleted and we stop accessing your calendar.

9.4 Human Access

Lawtte personnel do not read Google user data, except where you have given specific consent (for example, when you ask us to investigate a booking problem), where it is necessary for security purposes such as investigating abuse, or where we are required to do so by law.

9.5 Limited Use

Lawtte’s use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

10.1 Systems a Firm Connects Itself

Separately from the providers described above, a law firm can connect its own case-management and workflow tools to Lawtte. Where a firm does that, we read from and write to the firm’s own account in that tool on the firm’s instructions — for example creating a matter, filing a document, or logging a call. Depending on what a firm has chosen to connect, this can include Clio, GoHighLevel, CasePeer, Lawmatics, DocuSign, Aloware and Slack.

These connections are per firm. No firm is required to use any of them, and most use only a few. The firm’s own agreement and privacy terms with those vendors govern what happens to data inside them.

11.1 Before You Click

• The script asks lawtte.ai whether that firm’s assistant is switched on and gets back only its appearance settings and the assistant’s name.
• It sets no cookies and writes nothing to your browser’s storage on the firm’s site, and it does not report your visit to that page to us.
• It adds a button, and loads a panel from lawtte.ai in a frame on the page. The panel is served with instructions telling search engines not to index it.
• Nothing is recorded, and your microphone is not touched, until you press the button to start a conversation.

11.2 When You Start a Conversation

• Microphone: your browser asks your permission, and the microphone is used only for the conversation you started, only while it lasts. Ending the call or closing the panel stops it. There is no listening outside a call you begin.
• Recording and transcription: the conversation is a live voice call carried over your internet connection by our voice provider, Retell AI. Retell records the audio, transcribes it, and produces a written summary of the call.
• Where it goes: the recording, the transcript and the summary are the law firm’s. When the call ends we email the firm a summary of it — including the name, callback number and email address you gave, and a link to the recording. What you say reaches the firm exactly as it would on a phone call.
• Our role: Lawtte processes all of this on the firm’s behalf and on its instructions; the firm is the controller of it (Section 1.1). We do not use your conversation to train AI models (Section 3).
• Abuse prevention: your IP address goes into a short-lived counter so that one visitor cannot start unlimited calls. That counter expires within roughly an hour and is not used to profile you.
• No analytics in the panel: unlike our own pages, the panel carries no product analytics and no session replay, and stores no identifier for you in your browser. You came to a law firm’s website, not ours, and we do not measure you there (Section 12.1).
• Treat the conversation as recorded from the moment it connects, and do not say anything you would not want the firm to keep. The assistant is not a lawyer, and talking to it does not create an attorney-client relationship.

11.3 If You Would Rather Not Use It

• You never have to. Leave the button alone, or close the panel. Reach the firm by its phone number, email address or contact form instead — the assistant is an extra way to get in touch, not the only one.
• Closing the panel ends any call in progress and releases the microphone.
• To ask what was recorded, or to have it deleted, contact the law firm whose site you were on. The firm holds the recording and decides those requests; we act on what it tells us (Section 5).

12.1 Where It Runs

• Our marketing site at lawtte.ai, and the signed-in dashboard.
• Lawtte Studio, including the setup wizard at /studio.
• The client document-upload pages we serve inside frames for a firm’s own clients.
• It does not run in the website widget panel described in Section 11 — that page is deliberately exempt, so a visitor to a law firm’s site is never enrolled in our analytics or session replay.
• It does not run on phone calls. Somebody who telephones a firm’s AI receptionist loads no web page and appears in PostHog not at all. Call audio and transcripts are never sent to PostHog.
• The widget loader a firm pastes onto its own site carries no analytics and sets nothing on that site (Section 11.1).

12.2 What It Collects

• Pages and screens viewed, clicks, and the steps taken through a flow.
• Errors and exceptions thrown by our pages.
• Session replay of those pages, configured to capture on-screen text and typed input so we can see where someone got stuck. Password fields stay masked.
• Its own identifier for your browser, stored in lawtte.ai’s cookies and local storage — not on any law firm’s own website.

12.3 The Studio Wizard Funnel

The self-serve setup wizard sends a fixed list of named events — wizard started; each step viewed, completed, gone back from or abandoned; test call started, connected, ended or failed; practice area, voice, language and booking choices; email verification; plan selected; go-live succeeded or failed. We use them to see where firms drop out of signup.

These events are deliberately written so they do not identify anyone: a firm name, email address, phone number or receptionist name is sent as a yes/no or a character count, never as the value itself, and failures are sent as a short reason code such as “card” or “bad_email” rather than the error text. When a firm finishes creating an account we link that earlier anonymous wizard session to the new account, using the account’s id, email address and firm identifier.

12.4 What We Do Not Do With It

• We do not sell what PostHog collects, and we do not use it for advertising.
• We do not use it to train AI models.
• We do not put caller or client case data into analytics events.

12.5 Marketing Measurement

Separately from PostHog, our public marketing pages load Google Analytics, a Google Ads tag and a Meta advertising pixel, so we can tell which campaigns bring visitors and signups. These run on lawtte.ai marketing pages only. They are not in the widget panel, not in the dashboard, and never on a call.

Whether they run at all depends on where you are. For visitors in the UK and the EEA we do not run them, or anything in 12.6, at all — including the PostHog session replay described above on these marketing pages. Everywhere else they run, and a notice on our marketing pages says so. You can opt out at any time using the links in 12.6, and your browser’s own cookie controls or a tracking blocker remain available regardless.

12.6 Visitor Identification

Our public marketing pages also load RB2B, a business visitor-identification tool. Where it can match a visit to a person or company in its own data, it tells us who looked at lawtte.ai so our team can follow up about Lawtte. Like the tags in 12.5, it runs on lawtte.ai marketing pages only — it is not in the website widget panel described in Section 11, not in the signed-in dashboard, not on the document-upload pages a firm’s clients use, and never on a call. It is governed by the same regional rule as the tags in 12.5, so it does not run for visitors in the UK and the EEA.

When you visit or log in to our website, cookies and similar technologies may be used by our online data partners or vendors to associate these activities with other personal information they or others have about you, including by association with your email. We (or service providers on our behalf) may then send communications and marketing to these email addresses. You may opt out of receiving this advertising by visiting https://app.retention.com/optout. You also have the option to opt out of the collection of your personal data in compliance with GDPR by visiting https://www.rb2b.com/rb2b-gdpr-opt-out.