This Privacy Policy explains how Turbo Law ("Turbo Law," "we," "us," or "our") handles personal information when you visit www.turbolaw.ai or use our products, apps, and support channels (the Services). We built this policy to be practical and global. It covers U.S. state privacy laws (e.g., CPRA and similar state statutes) and international regimes (e.g., EEA/UK/Swiss GDPR). Where local law requires additional terms, those will control. If you do not agree with this Policy, please do not access or use the Services.

1. Scope & Roles

Scope: Website, app, product UIs/APIs, and our support/communications channels.

Controller vs. Processor: For Website visitors, leads, and marketing contacts, Turbo Law is a controller. For Customer Content that organizations submit to our platform (e.g., case files, documents, medical records), we act as a service provider/processor and handle that content only to provide the Services and as permitted by the customer agreement.

2. Information We Collect

We collect information in three ways: (a) you provide it, (b) we collect it automatically, and (c) we receive it from your organization or third parties.

Example

• Identifiers & contact: name, email, phone, firm, role, account credentials

• Device & network activity: IP address, browser/device type, pages viewed, app events, crash/error logs, cookie and advertising identifiers.

• Commercial & usage: subscription tier, transactions, in-product activity (features used), and support interactions

• Communications & content: messages, tickets, chat/call recordings (where lawful), and feedback

• Customer Content (your organization's data): case files, documents, attachments, and other data your organization submits to the Services.

• Job applicant data: resume/CV details, work/education history, and information you provide during hiring.

• Sensitive data: may appear only inside Customer Content (e.g., health/medical details). We do not collect this from Website visitors for marketing.

We do not knowingly collect information from children. See 12

3. Sources of Information

You and your organization (account setup, support, product use)

• Your devices/browsers (automatic collection via cookies/SDKs)

• Public and enterprise sources (e.g., business contact directories) and business-data and advertising partners (e.g., Apollo.io and LinkedIn), where lawful

4. How We Use Information

Provide, operate, and secure the Services; authenticate users; prevent, detect, and remediate fraud/abuse

• Troubleshoot and support; communicate about the Services

• Analyze usage to improve stability, performance, and features

• Send transactional messages (e.g., security and product notices) and (where permitted) product updates/marketing (you can opt out anytime)

• Comply with legal requirements and enforce our terms

AI & data use: We do not use Customer Content to train or improve foundation models. Any evaluation or fine-tuning on Customer Content occurs only at the customer's direction. When we use third-party AI infrastructure (e.g., cloud/LLM providers), they are contractually prohibited from training their models on your data for other customers.

Legal bases (EEA/UK/Switzerland where applicable): performance of a contract; legitimate interests (e.g., security, product improvement); consent (e.g., certain cookies/marketing); legal obligations; vital interests (rare).

5. Cookies and Online Tracking

We use cookies and similar technologies for operations, security, and analytics. Manage cookies in your browser and, where offered, in our cookie banner.

The Site uses these third-party and first-party technologies:

Google Analytics / Google Tag Manager for Site analytics. Framer for hosting and site analytics.

Apollo.io website tracking. Apollo's script sets a cookie and sends information about your visit (such as IP address, pages viewed, referrer, timestamps, and browser/device information) to Apollo. Apollo uses it to identify the company, and in some cases the professional, associated with the visit, and returns business information to us. Apollo states that it may use information it receives from customers, including website visitor IP addresses, to build and enrich its own business-contact database, which it makes available to its other customers. See https://www.apollo.io/privacy-policy.

LinkedIn Insight Tag. It measures conversions from our LinkedIn ads and builds website audiences for ad targeting. LinkedIn sets cookies and identifiers in your browser, may associate this activity with LinkedIn member accounts, and uses the data for its own purposes. See https://www.linkedin.com/legal/cookie-policy.

Campaign attribution cookie (framerFormsUTMTags). If you arrive through a link containing campaign tags (utm_source, utm_medium, utm_campaign, utm_term, utm_content) or a Google Ads click ID (gclid), we store those values in a first-party cookie for 90 days to attribute later form submissions to that campaign.

• We do not respond to legacy Do-Not-Track (DNT) signals

• To opt out of the "sale" or "sharing" of your personal information or targeted advertising, email privacy@turbolaw.ai with the subject line "Do Not Sell or Share."

6. When We Disclose Information

We disclose information to:

• Service providers/Processors for hosting, storage, analytics, communications, customer support, billing/payments, security, and AI infrastructure, under contracts limiting use to our instructions

• Third parties that use information for their own purposes: Apollo.io and LinkedIn, through the website technologies described in Section 5, under their own privacy policies.

• Your organization (if your firm administers your account)

• Legal & safety purposes (e.g., to comply with law, protect rights, investigate misuse)

• Business transfers (e.g., merger, acquisition, financing), with appropriate safeguards

We do not sell personal information for money. Making website-visit information (such as IP address, identifiers, and pages viewed) available to Apollo and LinkedIn through their website technologies may be considered a "sale" or "sharing" for cross-context behavioral advertising, or "targeted advertising," under some U.S. state privacy laws. You can opt out by emailing privacy@turbolaw.ai.

7. Retention

We retain Website/marketing data for about 13–24 months from last interaction unless a longer period is required by law or necessary for legitimate business needs. Customer Content retention and deletion are governed by the customer agreement (and, where applicable, a HIPAA BAA). When retention ends, we delete or de-identify information consistent with our policies and applicable law.

8. Security

We use administrative, technical, and physical safeguards (e.g., encryption in transit/at rest where appropriate, access controls, logging/monitoring, secure development practices). No system is 100% secure. Please use strong, unique passwords and enable available security features.

9. International Data Transfers

We may transfer and store information in countries other than yours (including the U.S.). Where required, we use approved safeguards (e.g., EU Standard Contractual Clauses and the UK Addendum/IDTA). Summaries of these safeguards are available upon request (subject to redactions).

10. Your Privacy Rights

Your rights depend on your location. Subject to legal limits, you may have rights to:

• Access/Know whether we process your data and obtain a copy

• Correct/Rectify inaccurate data

• Delete/Erase data

• Portability of certain data

• Object/Restrict certain processing (e.g., marketing; legitimate-interest processing)

• Opt-out of sale/share/targeted advertising and certain profiling (see Section 6)

• Withdraw consent where processing relies on consent

How to exercise: Email privacy@turbolaw.ai (for opt-outs, use the subject line "Do Not Sell or Share"), or use the Your Privacy Choices link in the footer or product if available. We may verify your request and, in some regions, you may use an authorized agent. Where required (e.g., CO/CT/VA), we offer an appeal process if we deny your request. We will not discriminate against you for exercising your rights.

EEA/UK/Swiss individuals: You may contact your local supervisory authority if you believe our processing violates applicable law; please contact us first so we can help.

11. HIPAA, Privelege and Confidentiality

If we handle Protected Health Information (PHI), we act as a business associate and will sign a Business Associate Agreement (BAA). We do not use PHI for marketing or to train foundation models. We do not assert or waive attorney-client privilege or work product protections on your behalf. Access to Customer Content is limited to authorized personnel for legitimate purposes (e.g., support, security) as allowed by contract.

12. Children

Our Services are intended for professional/business use and are not directed to children. We do not knowingly collect information from children under 18 (or the age defined by local law). If you believe a child has provided information, contact us and we'll take appropriate steps.

13. Changes to This Policy

We may update this Policy from time to time. The "Effective date" shows when it last changed. If we make material changes, we'll provide notice as required by law. Your continued use of the Services after changes means you accept the updated Policy.

14. Contact Us

Email: privacy@turbolaw.ai (privacy requests) · info@turbolaw.ai (general)
If you are a business customer and need our sub-processor list or have data-handling questions, contact your account representative or email info@turbolaw.ai.