Privacy policy

Last updated 1 September 2026

Legalease is case management software operated by a single law firm for its own staff. It is not a public service and has no public sign-up: accounts are created by the firm for its own people. This policy explains what the application stores, why, who can see it, and how it is removed.

Who is responsible

The firm operating this installation of Legalease is the data controller for everything held in it, including client information and correspondence. Questions about data held about you, or requests to access or delete it, should be directed to the firm.

What the application stores

Staff accounts. Name, work email address, role, a hashed password, and — if the person chooses to register one — the public half of a passkey. Passwords are stored only as bcrypt hashes and cannot be read back.
Matter records. Client and matter details entered by staff: names, contact details, matter type, status, dates, notes and assigned staff.
Documents. Files uploaded or written by staff, and every prior version of them. Versions are immutable by design and are not deleted when a document changes.
Correspondence. Email filed to a matter, including message bodies, participants, dates and attachments. See “Google user data” below.
Activity log. A record of consequential actions — who created, changed, filed, sent or deleted what, and when. This is a professional-obligations record and is intentionally not editable.
Technical data. Session cookies, and browser push subscription endpoints for staff who enable notifications.

Legalease does not use analytics or advertising trackers, does not embed third-party tracking scripts, and does not sell or share data with advertisers or data brokers.

Google user data

A firm may connect a Google Workspace or Gmail mailbox so that client correspondence is filed to the matter it belongs to. This is optional; the rest of the application works without it.

What is requested

Connection uses Google OAuth. Legalease never receives or stores a Google password. Exactly two permissions are requested:

gmail.readonly — to read messages so that correspondence can be filed to the correct matter and shown inside it.
gmail.send — to send a message that a member of staff has written and pressed send on.

Legalease does not request permission to delete mail, modify labels, or alter the mailbox in any other way, and it cannot do so.

How it is used

Messages are matched to a matter by the email addresses on them. A match is proposed, and a member of staff confirms it; once a conversation is filed, later replies in that conversation follow it.
Filed messages — sender, recipients, subject, date, body and attachments — are stored so that a matter’s record survives someone tidying their inbox, and so that reading a matter does not depend on Google being reachable.
Mail is sent only when a person composes it and presses send. There is no automated sending, no templates that fire on a status change, and no scheduled messaging.

Shared and personal mailboxes

A shared firm mailbox is firm correspondence by definition and is synchronised in full, so that enquiries can be triaged. A personal mailbox connected by an individual member of staff is treated differently: only messages that match a matter are stored at all. Everything else is never written to the database, never indexed, and never visible to anyone else. There is no screen anywhere in Legalease that shows another person’s mailbox.

How it is protected

OAuth refresh and access tokens are encrypted at rest with AES-256-GCM, and are never stored in plain text.
Message HTML is sanitised on arrival against a strict allowlist, and remote images are blocked until a person explicitly loads them — so senders are not told when the firm read their message.
Filed correspondence follows matter access. Whoever may see the matter may see its correspondence; staff restricted to assigned matters stay restricted.

Limited Use

Legalease’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Specifically: data obtained from Google APIs is used only to provide and improve the correspondence features described here; it is not transferred to others except as necessary to provide those features, to comply with applicable law, or as part of a merger or acquisition; it is not used for advertising; it is not sold; and it is not used to develop, train or improve generalised artificial intelligence or machine learning models. No human reads this data except the firm’s own staff acting on the matter, and the operators of the application where strictly necessary to support or secure it.

Where data is held

The application and its database are hosted with Vercel and Supabase. Files and mail attachments are stored in Supabase storage. Push notifications, if enabled, are delivered through the browser vendor’s push service. These providers process data on the firm’s behalf.

Retention and deletion

Matter records, documents, versions and filed correspondence are kept for as long as the firm’s professional obligations require it to keep the file, and are removed on the firm’s instruction.
Disconnecting a mailbox stops all synchronisation and revokes the access token with Google. Correspondence already filed to a matter is retained, because it forms part of that matter’s record. Anything still untriaged is deleted.
Access can also be withdrawn at any time from your Google account’s third-party access settings, independently of this application.

Changes

Material changes to this policy will be reflected in the date at the top of this page. Because this application is operated for one firm, staff are told about changes directly.