Privacy Policy

1. Introduction

Comitie, Inc. (formerly IntakeIQ, Inc.) ("Comitie," "we," "our," or "us") provides two services to law firms: IntakeIQ, an AI-powered legal intake platform that helps law firms pre-qualify potential cases, and OrignIQ, which reads public records (such as layoff notices, visa filings, and agency actions) and turns them into monthly briefs and firm-branded web pages for subscribing law firms. This Privacy Policy explains how we collect, use, store, and protect your information when you use our website at comitie.com, the IntakeIQ platform (the dashboard at app.comitie.com, and the intake forms, client portals, and links that law firms share, at app.comitie.com and app.intakeiq.io), a law firm's IntakeIQ phone assistant, OrignIQ briefs and event pages, and our related services (collectively, the "Service").

By using the Service, you acknowledge that you have read, understood, and agree to the terms of this Privacy Policy. If you do not agree with this Privacy Policy, please do not use the Service.

2. Information We Collect

2.1 Information Provided Through Intake Forms

When a potential client completes an intake form, we may collect:

• Full name and contact information (email, phone number)
• Employment details (employer name, job title, dates of employment)
• Description of the legal matter or dispute
• Relevant dates and timelines
• Health information, such as injuries, medical treatment, disability, or medical leave, where the legal matter involves it
• Uploaded documents and supporting files
• Any other information voluntarily provided in the intake form

2.2 Sensitive Personal Information

Depending on the nature of your legal matter, information you provide through intake forms may include categories of data considered "sensitive personal information" under applicable law. This may include, but is not limited to, information revealing racial or ethnic origin, religious beliefs, disability status, sexual orientation, immigration status, or the contents of private communications.

We process sensitive personal information solely for the purpose of evaluating your potential legal case and sharing it with the subscribing law firm. We do not use sensitive personal information for profiling, advertising, or any purpose unrelated to case intake and evaluation.

Under the California Consumer Privacy Act (CCPA/CPRA) and similar state laws, you may have the right to limit the use and disclosure of your sensitive personal information. To exercise this right, please contact us using the information in Section 17.

2.3 Account and Subscription Information

For law firm users and attorneys, we collect:

• Name and professional contact information
• Law firm name and practice area details
• Payment and billing information (processed securely through Stripe)
• Credentials for integrations the firm connects (via OAuth), such as Clio, Docketwise, INSzoom, Lawmatics, DocuSign, Google, and Microsoft
• Calendar availability, where the firm connects Google Calendar or Microsoft Outlook

2.4 Information From Connected Firm Mailboxes (Email Triage)

Subscribing law firms may optionally connect a firm email mailbox (Microsoft Outlook or Google Gmail) to IntakeIQ's Email Triage feature. When a firm enables this, IntakeIQ periodically reads messages newly received in that mailbox's inbox in order to identify prospective-client inquiries. IntakeIQ never modifies, labels, archives, or deletes mail in a connected mailbox. Where the firm has enabled automatic replies, the reply to an identified inquiry may be sent from the connected mailbox itself — so the prospective client receives a reply from the address they wrote to, in the same conversation. That automatic reply is the only mail ever sent from a connected mailbox. See Section 4.2.

For each newly received message, IntakeIQ reads the sender name and address, the subject line, the message body, and the received timestamp. What is retained depends on the outcome of that evaluation:

• Messages that are evaluated: we store the sender name and address, the subject line, an excerpt of the message body (up to the first 500 characters), the received timestamp, and the classification result — including the reason the AI gave for its decision. This applies whether or not the message was identified as a prospective legal inquiry. Messages judged not to be inquiries are retained so the firm can verify what the system decided and correct it where the AI was wrong; they are filtered out of the firm's default view rather than deleted. Only messages identified as inquiries are acted on.
• Messages never evaluated at all: messages from mail-system senders (for example addresses beginning "no-reply@" or "mailer-daemon@") and messages the connected mailbox sent to itself are filtered out before any evaluation occurs. Where the firm's mailbox uses its own custom domain, other messages from that same domain (firm-internal mail) are also filtered out; this domain filter does not apply to mailboxes on shared consumer providers such as gmail.com or outlook.com, where sharing a domain does not indicate a colleague.

Mailbox access is granted by the firm through the mail provider's standard OAuth consent flow and can be revoked at any time, either from the IntakeIQ Integrations page or directly through the firm's Google or Microsoft account security settings. Revoking access stops all further reading immediately. Firms may also use Email Triage without connecting a mailbox, by forwarding messages to an IntakeIQ-provided intake address.

2.5 Automatically Collected Information

We automatically collect certain information when you use the Service, including:

• Browser type and device information
• IP address and general location data
• Pages visited and interaction patterns
• Analytics and advertising data collected through Google Tag Manager, Google Analytics 4 (GA4), Google Ads conversion tracking, and the LinkedIn Insight Tag, as described in Section 14. GA4 does not store full IP addresses. We use this data to understand how people find and use comitie.com and to measure our own advertising.
• Your IP address and browser details, which your browser sends to Google Fonts and Fontshare when a page loads its typefaces

2.6 Public Records (OrignIQ)

OrignIQ is built from records that government bodies publish: state WARN (Worker Adjustment and Retraining Notification) reports, U.S. Department of Labor labor condition application disclosure data, USCIS employer data, and court and agency filings. These records describe employers and events — a company name, a county, a number of positions affected, notice and separation dates, job titles — and we process them as business information. They do not identify the individual workers affected, and we do not attempt to identify, locate, or compile information about those individuals from any source. Every figure in an OrignIQ brief or event page is cited to the public record it came from.

2.7 Brief Requests and Website Forms

When you request a brief or otherwise contact us through a form on comitie.com, we collect your name, work email address, firm name, the metro and practice area you asked about, and any message you include. We store this information in HubSpot, our customer relationship management system, to send you what you asked for and to follow up about Comitie's products. You can ask us to stop at any time by replying to any message we send or by contacting us as described in Section 17.

2.8 Inquiries Through OrignIQ Event Pages; Advertising

An OrignIQ event page is published under a subscribing law firm's name and describes a specific public event, such as a layoff. If you choose to contact the firm from that page, your inquiry is delivered to that firm — through the firm's IntakeIQ intake form, in which case Sections 2.1, 2.2, 4, and 5 of this Policy apply, or directly to the firm's own case-management system, in which case we process your inquiry only as needed to deliver it and the firm's own privacy practices govern it from there.

Subscribing firms may approve advertisements, drafted with OrignIQ, that point to their event pages. Those advertisements run in the firm's name on advertising platforms (such as Google, LinkedIn, and Meta) under each platform's own terms and privacy policy; we receive aggregate campaign statistics and do not provide any platform with information from intake forms or inquiries. We never purchase or use lists of affected workers, and we never target advertising at identified individuals.

2.9 Calls to a Law Firm's Phone Assistant

A subscribing law firm may have IntakeIQ's AI phone assistant answer its calls and take messages. Every call begins with a notice that the call is recorded and, unless the firm turns it off, that you are speaking with a virtual assistant. When you call, we collect:

• Your phone number and the time and length of the call
• A transcript of the conversation, including what you say about your matter. The assistant may ask what happened, when and where, whether anyone was hurt and, if the firm has turned on practice-area questions, questions about your situation such as whether you have seen a doctor
• The name, call-back number, and (if you offer one) email address you confirm on the call

No audio of the call is recorded or stored, by us or by our phone providers. The call is carried by Twilio and the conversation is handled by ElevenLabs (see Sections 4.4 and 6.5). Please do not share medical details on the call that the firm does not need in order to call you back.

3. Legal Basis for Processing

We process your personal information on the following legal bases:

• Consent: When you voluntarily submit an intake form, you consent to the processing of your information for case evaluation purposes. You may withdraw consent at any time by contacting us, though this will not affect the lawfulness of processing prior to withdrawal.
• Contractual Necessity: For subscribing law firms and attorneys, we process account and subscription information as necessary to perform our contractual obligations under the service agreement.
• Legitimate Interests: We process automatically collected information (such as analytics data) based on our legitimate interest in improving and securing the Service, provided these interests are not overridden by your rights and freedoms.
• Public Records and Brief Requests (OrignIQ): We process public records about employers and events on the basis of our legitimate interest in providing OrignIQ to law firms; these records are business information published by government bodies. We process brief requests and website form submissions on the basis of your consent when you submit the form, which you may withdraw at any time.
• Legal Obligations: We may process information as necessary to comply with applicable laws, regulations, or legal processes.

4. AI Processing and Third-Party AI Providers

IntakeIQ uses a multi-model consensus scoring system to evaluate and score potential legal cases. Each intake form submission is evaluated by multiple foundation models to generate independent assessments. AI processing of intake forms, documents, email triage messages, and case data is performed through Amazon Bedrock, a service of Amazon Web Services (AWS). The AI phone assistant is the one exception (Section 4.4).

4.1 How Your Data Is Handled During AI Processing

Every foundation model we use for intake forms and case data runs within Amazon Bedrock, Amazon's managed AI service, in AWS data centers in the United States. The models currently used are Anthropic Claude, Amazon Nova, and Mistral, with Amazon Titan for text embeddings. Because these models run inside Amazon Bedrock, your data is not transmitted to the model developers (such as Anthropic or Mistral); AWS operates the models on our behalf.

• One AI provider for written data: Intake and case data is sent for AI processing only to Amazon Bedrock.
• No retention by the AI service: Amazon Bedrock does not store prompts or responses, and we have not turned on Bedrock's optional logging of them. The results (such as scores and summaries) are stored in IntakeIQ for the law firm.
• No training: Your data is never used to train or improve any foundation model.
• Business Associate Agreement: Amazon Bedrock is a HIPAA-eligible AWS service covered by our Business Associate Agreement (BAA) with AWS.

Your data is transmitted to Amazon Bedrock solely to provide the Service: for example, to generate a case evaluation score and summary, follow-up questions, or answers to the firm's questions about a case.

4.2 AI Processing of Email Triage Messages

Where a subscribing law firm uses the Email Triage feature (see Section 2.4), the sender, subject, and body excerpt of an inbound message are transmitted to AWS Bedrock for a single purpose: determining whether the message is a prospective legal inquiry and, if so, its likely practice area, urgency, and language. The same protections described in Section 4.1 apply — Amazon Bedrock does not store the input or output, the content is never used to train any foundation model, and it is covered by our BAA with AWS.

Where a firm has enabled automatic responses, IntakeIQ replies to messages identified as prospective legal inquiries with a link to that firm's intake form, so an inquiry can be answered promptly without waiting for someone at the firm to read it. This applies both to messages forwarded to an IntakeIQ intake address and, where the firm has enabled inbox scanning and automatic replies for it, to inquiries found in a connected mailbox. Automatic replies are sent only above a confidence threshold the firm controls; less certain inquiries are listed for the firm without any reply being sent. Where a firm has additionally enabled AI-drafted replies, the same subprocessor generates the response text.

Automatic replies identify themselves as automated and are sent on behalf of the subscribing law firm. Where the firm's mailbox connection permits sending, the reply is sent from the firm's own mailbox and appears in the same conversation as the original inquiry; otherwise it is sent by IntakeIQ on the firm's behalf. IntakeIQ never sends any other mail from a connected mailbox, and never modifies, labels, or deletes messages in it.

We regularly review the data handling policies of AWS. If our AI processing arrangements materially change, we will update this section and notify subscribing law firms. The references above were last verified as of the effective date of this Privacy Policy.

4.3 AI Processing of Public Records (OrignIQ)

OrignIQ uses the same subprocessor, AWS Bedrock, to read public filings, match them against related records (for example, an employer's prior filings or its visa petitions), score events for a subscribing firm, and draft the briefs, event pages, advertisements, and outreach messages that the firm reviews. The inputs are the public records described in Section 2.6 and the subscribing firm's own settings; no intake form data, inquiry, or other personal information submitted through the Service is used in this processing. The protections in Section 4.1 apply: Amazon Bedrock does not store the input or output, and nothing is used to train any foundation model.

4.4 AI Processing of Phone Calls

The phone assistant described in Section 2.9 works differently. During the call, your voice is carried by Twilio and the conversation is handled by ElevenLabs, whose speech models hear what you say and generate the assistant's replies. We do not have a Business Associate Agreement with Twilio or ElevenLabs, and phone calls are not covered by our Business Associate Addendum with law firms. ElevenLabs keeps the call transcript for seven (7) days and then deletes it; no audio is recorded. After the call, ElevenLabs sends the transcript to us; we store it encrypted and use Amazon Bedrock (Section 4.1) to turn it into a message or intake for the law firm.

When a firm's staff try the assistant from their browser ("Try it" test calls), the conversation is handled by ElevenLabs in the same way, without Twilio. We clear the content of test calls after seven (7) days.

5. No Attorney-Client Relationship; No Referral Service; Confidentiality

An attorney-client relationship is only formed when a licensed attorney explicitly agrees to represent you, typically through a signed engagement or retainer agreement.

Information submitted through intake forms may not be protected by attorney-client privilege. While we implement technical safeguards to protect the confidentiality of your submissions (including encryption in transit and at rest, access controls, and restricted sharing solely with the subscribing law firm), the transmission of information through the Service does not create a privileged communication.

We strongly recommend that you do not include highly sensitive or privileged information in your intake form submission beyond what is necessary to describe your legal matter in general terms. Detailed privileged communications should be shared directly with your attorney after a formal engagement has been established.

Subscribing law firms are independently responsible for their own ethical obligations regarding confidentiality, conflicts of interest, and the formation of attorney-client relationships.

Comitie is not a lawyer referral service. We do not select a lawyer for anyone, do not pass anyone's details to a law firm unless that person chose to contact the firm, and are not paid per lead, per inquiry, or per case. OrignIQ event pages and advertisements are published under the subscribing firm's own name, and only the firm's licensed attorneys decide whom to represent. We never contact the people affected by a layoff or other public event — no calls, texts, emails, letters, or messages — and subscribing firms agree not to use OrignIQ to do so in violation of the solicitation rules that apply to them.

7. How We Use Your Information

We use the information we collect for the following purposes:

• To process and evaluate potential legal cases using AI-powered scoring
• To generate case summaries and qualification assessments for attorneys
• To facilitate communication between potential clients and law firms
• To process payments and manage subscriptions via Stripe
• To integrate with the practice-management, e-signature, calendar, and email services a law firm connects, as the firm authorizes
• To schedule consultations, and to add them to the law firm's calendar where the firm has connected one
• To answer a law firm's calls with its phone assistant and pass the caller's message to the firm
• To produce OrignIQ briefs, scored event lists, event pages, and firm-approved advertisements from public records, and to deliver them to subscribing law firms
• To send briefs you request and to follow up about Comitie's products, using the details you give us on comitie.com
• To improve and optimize our Service through analysis of aggregate, de-identified usage patterns and system performance metrics. We do not use identifiable intake form data for product improvement, analytics, benchmarking, or internal model training. Any analysis for service improvement purposes is performed only on anonymized or aggregated data from which individual intake submissions cannot be identified.
• To comply with legal obligations

8. Data Storage and Security

Intake and case data is processed and stored on HIPAA-eligible AWS services in the United States (the US-East-1 region, with Amazon Bedrock processing in other U.S. AWS regions). Specific safeguards include:

• Amazon ECS on AWS Fargate for the application, behind a load balancer that only accepts traffic from Amazon CloudFront
• Amazon RDS PostgreSQL with AES-256 encryption at rest and TLS connections, in a private network
• Amazon S3 with server-side encryption under a Comitie-managed AWS KMS key for uploaded files
• Amazon CloudFront with TLS 1.2+ and AWS WAF (web application firewall)
• AWS Secrets Manager for credential management (no hardcoded secrets)
• AWS CloudTrail for infrastructure-level audit logging
• Amazon CloudWatch for monitoring and alarms

While we take reasonable measures to protect your data, no method of transmission over the Internet or electronic storage is 100% secure. We cannot guarantee absolute security of your information.

9. Data Breach Notification

In the event of a data breach that compromises your personal information, we will take the following steps:

• We will investigate and contain the breach as promptly as practicable upon discovery.
• We will notify affected subscribing law firms without unreasonable delay, and in no event later than ten (10) business days after discovering a breach that is reasonably likely to have compromised personal information. For health information covered by our Business Associate Addendum, the Addendum's notice terms apply.
• We will notify affected individuals as required by applicable state and federal law, within the timeframes mandated by each applicable jurisdiction.
• Notifications will include, to the extent known: a description of the nature of the breach, the categories of information affected, the approximate date of the breach, the steps we are taking in response, and contact information for further inquiries.
• We will cooperate with applicable regulatory authorities and law enforcement as required by law.

We maintain a written incident response and breach notification plan and review our security risks at least once a year to minimize the risk of unauthorized access to your data. To report a suspected security issue, email support@comitie.com.

10. Data Sharing and Disclosure

We do not sell your personal information. We do not "share" your personal information for cross-context behavioral advertising as defined under the California Consumer Privacy Act (CCPA/CPRA). We may share your information in the following circumstances:

• With Subscribing Law Firms: Intake form submissions and AI-generated case evaluations are shared with the law firm whose intake form you completed.
• With AI Providers: As described in Section 4, your intake data is processed by foundation models on Amazon Bedrock (Amazon Web Services), covered by our Business Associate Agreement with AWS, and is not used for training. Phone calls are handled by ElevenLabs (Section 4.4).
• With Service Providers: We use the sub-processors listed in Section 10.2 to operate the Service. They receive only the data needed to perform their specific functions. AWS is the only one with which we have a Business Associate Agreement.
• With services a law firm connects: When a firm connects its own account with a service such as Clio, Docketwise, INSzoom, Lawmatics, DocuSign, Google, or Microsoft, we send that service the information the firm directs (for example, a new matter, a calendar event with the client's name and contact details, or a document for signature). Those services act for the firm under the firm's own agreements with them.
• With HubSpot and Advertising Platforms (OrignIQ and comitie.com): Brief requests and website form submissions are stored in HubSpot, which processes them on our behalf. Advertisements a subscribing firm approves run on advertising platforms under the firm's name; the platforms receive the advertisement and its targeting settings, never information from intake forms or inquiries.
• As Required by Law: We may disclose your information if required by law, regulation, legal process, or governmental request.

10.1 International Data Transfers

Your information may be transferred to and processed in the United States and other countries where our AI providers and service providers maintain servers. These countries may have data protection laws that differ from the laws of your jurisdiction. By using the Service, you consent to the transfer of your information to the United States and other jurisdictions as described in this Policy. Where required by applicable law (such as the EU General Data Protection Regulation), we will ensure that appropriate safeguards are in place for international transfers, such as Standard Contractual Clauses approved by the European Commission.

Intake and case data is stored and processed in the United States. Contact details submitted through forms on comitie.com (Section 2.7) are stored in HubSpot's European Union data center. Our phone providers, Twilio and ElevenLabs, process call data under their own terms.

10.2 Sub-processors

We use the following service providers to operate the Service:

We will update this list before a new sub-processor begins to receive intake or case data.

11. Data Retention

Intake form data and associated case evaluations are retained for as long as the subscribing law firm maintains an active account or as required by applicable law. The following specific retention rules apply:

• Active accounts: Intake data is retained for the duration of the law firm's active subscription. We do not automatically delete intake data while the account is active.
• Rejected intakes: Intakes a law firm rejects are moved to the firm's archive after 30 days. They are archived, not deleted. A law firm may ask us to delete specific intake records.
• Account termination: Upon account termination, all associated intake data, including all stored versions of uploaded files, will be deleted within 90 days after a 30-day period in which the firm may retrieve its data, unless retention is required by applicable law or the law firm requests earlier deletion. Copies in our database backups are deleted as those backups expire (currently after 7 days).
• Individual deletion requests: Individuals who submitted intake forms or called a firm's phone assistant may request deletion of their data by contacting us. Because we hold that data on behalf of the law firm, we will refer your request to the firm and act on its instructions within 45 days, subject to any legal obligations requiring continued retention.
• Phone calls: ElevenLabs keeps call transcripts for 7 days and then deletes them. Our encrypted copy of the transcript and the message or intake created from it are kept with the firm's other intake data, as above. The content of staff test calls is cleared after 7 days.
• Earlier versions of files: When a file is replaced or deleted during the subscription, we keep earlier versions for up to six years so they can be recovered, and delete them all when the account is closed.
• Email Triage records: Records created from inbound email (see Section 2.4) are retained for the duration of the law firm's active subscription and deleted on the same schedule as intake data above. Records for messages judged not to be prospective inquiries are retained for 90 days and then deleted automatically, since their only purpose is to let the firm verify and correct the AI's decisions. Disconnecting a mailbox stops further reading immediately; a firm may dismiss individual triage records from its dashboard at any time and may ask us to delete them.
• Brief requests and website forms: Contact details you give us on comitie.com are retained until you ask us to stop contacting you or to delete them, which we will do within 45 days. Public records processed by OrignIQ are business information and are retained as part of our records of the events they describe.

Law firms may request deletion of intake records by contacting us at compliance@comitie.com. For health information covered by our Business Associate Addendum, the Addendum's return-and-destruction terms apply.

12. Data Processing Agreements

IntakeIQ offers a standard Data Processing Agreement (DPA) to subscribing law firms. The DPA governs IntakeIQ's processing of personal data on behalf of the law firm and addresses:

• The scope, nature, and purpose of data processing
• Obligations of both parties regarding data protection
• Sub-processor management and notification procedures
• Data breach notification commitments
• Audit rights and cooperation with regulatory authorities
• Data return and deletion upon termination

Law firms that require a DPA for compliance with their own ethical obligations, bar association rules, or applicable data protection laws may request one by contacting us at compliance@comitie.com. Health information is covered by our Business Associate Addendum, which every firm accepts as part of our Terms of Service. We encourage all subscribing law firms to execute a DPA with IntakeIQ.

13. Your Rights

Depending on your jurisdiction, you may have certain rights regarding your personal information. Below we describe rights available under applicable law.

13.1 General Rights

All users may have the following rights:

• The right to access the personal information we hold about you
• The right to request correction of inaccurate information
• The right to request deletion of your personal information
• The right to opt out of certain data processing activities
• The right to data portability

13.2 California Residents (CCPA/CPRA)

If you are a California resident, you have the following additional rights under the California Consumer Privacy Act, as amended by the California Privacy Rights Act (CCPA/CPRA):

• Right to Know: You may request that we disclose the categories and specific pieces of personal information we have collected about you, the sources of that information, the business purposes for collection, and the categories of third parties with whom we share it.
• Right to Delete: You may request deletion of your personal information, subject to certain exceptions permitted by law.
• Right to Correct: You may request correction of inaccurate personal information.
• Right to Opt Out of Sale/Sharing: We do not sell your personal information or share it for cross-context behavioral advertising. Therefore, there is no need to opt out of such activities.
• Right to Limit Use of Sensitive Personal Information: You may request that we limit our use of sensitive personal information to only what is necessary to perform the Service.
• Right to Non-Discrimination: We will not discriminate against you for exercising any of your privacy rights.

To submit a request, please contact us at the information provided in Section 17. We will respond to verified requests within 45 days. If we need additional time, we will notify you of the extension and the reason. You may designate an authorized agent to make a request on your behalf. If you are not satisfied with our response, you have the right to appeal by contacting us with a description of your concern, and we will respond within 45 days of receiving your appeal.

13.3 Other U.S. State Privacy Laws

Residents of other states with comprehensive privacy laws (including but not limited to Virginia, Colorado, Connecticut, Utah, Texas, Oregon, and Montana) may have similar rights to access, correct, delete, and opt out of certain processing. Please contact us using the information in Section 17 to exercise your rights. We will respond in accordance with the timelines and procedures required by your state's applicable law.

13.4 European Economic Area, UK, and Other International Users

If you are located in the European Economic Area (EEA), United Kingdom, or another jurisdiction with applicable data protection laws, you may have additional rights including the right to lodge a complaint with your local data protection authority. Please contact us to exercise your rights, and we will respond in accordance with applicable law.

To exercise any of these rights, please contact us at the information provided in Section 17.

15. Third-Party Links and Integrations

The Service may contain links to third-party websites or integrate with third-party services (such as Clio, DocuSign, Google, Microsoft, Stripe, and HubSpot), and OrignIQ event pages and advertisements may link to a subscribing firm's own website or run on advertising platforms. We are not responsible for the privacy practices of these third parties. We encourage you to review the privacy policies of any third-party services you interact with through the Service.

15.1 Connected Email Mailboxes — Limited Use Commitments

IntakeIQ's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We make the same commitments for mailbox data accessed through Microsoft Graph. Specifically, data obtained from a connected mailbox is:

• Used only to provide and improve the Email Triage feature — identifying prospective-client inquiries for the firm that connected the mailbox — and for no other purpose;
• Never transferred to others, except as necessary to provide that feature (see the AWS Bedrock disclosure in Section 4.2), to comply with applicable law, or as part of a merger or acquisition following notice and consent as required by law;
• Never used for advertising, marketing, profiling, or resale;
• Never used to train, fine-tune, or otherwise improve generalized artificial intelligence or machine learning models. The models that classify inbound messages are pre-trained third-party models run inside AWS Bedrock, which retains no input or output after a request completes;
• Never read by a human, except with the firm's explicit consent for a specific purpose (such as support troubleshooting the firm requests), where necessary for security purposes such as investigating abuse, to comply with applicable law, or where the data has been aggregated and anonymized.

A firm may revoke IntakeIQ's mailbox access at any time from the IntakeIQ Integrations page, or directly through its Google account permissions or Microsoft account settings.

16. Children's Privacy

IntakeIQ is not directed to individuals under the age of 18. We do not knowingly collect personal information from children. Intake forms include an age affirmation requiring users to confirm they are 18 years of age or older before submitting. If you believe a child under the age of 13 has provided us with personal information, please contact us immediately and we will promptly investigate and delete such information in compliance with the Children's Online Privacy Protection Act (COPPA). For individuals between 13 and 17, we will delete their information upon request from a parent or guardian.

17. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us at:

For CCPA/CPRA requests specifically, you may also submit a request through our website at comitie.com/privacy or contact us via email. We will verify your identity before processing any rights request.

18. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify users of material changes by:

• Posting the updated policy on our website with a revised effective date
• Sending email notification to subscribing law firms for material changes
• Displaying a prominent notice within the Service dashboard for at least 30 days following material changes

Your continued use of the Service after any changes constitutes your acceptance of the updated Privacy Policy. We encourage you to review this Privacy Policy periodically.

19. Frequently Asked Questions