This Data Processing Agreement ("DPA") is incorporated into and forms part of the Counsltrac Terms of Service. It applies between Counsltrac LLC (the "Operator") and the organization that installs or uses the Service (the "Customer"). By installing or using the Service, Customer agrees to this DPA; no signature is required.
1. Definitions
- "Customer Data" means all data submitted to, stored in, or processed by the Counsltrac service on behalf of Customer, including structured matter data, the optional Opening Notes, Closing Notes, and reopen-reason fields, user identifiers, and workspace configuration.
- "Personal Data" means any information relating to an identified or identifiable natural person within Customer Data, as defined under applicable data protection law.
- "Processing" means any operation performed on Personal Data, including collection, storage, retrieval, use, disclosure, transmission, or deletion.
- "Subprocessor" means any third party engaged by the Operator to Process Customer Data.
- "Security Incident" means any unauthorized access to, disclosure of, or destruction of Customer Data.
2. Scope and Purpose of Processing
- Subject matter: Operation of the Counsltrac legal-matter tracking service, delivered entirely within Slack
- Duration: For the term of the governing agreement, plus any retention period specified in Section 9
- Nature of processing: Intake, storage, retrieval, reporting, export, and AI-assisted querying of legal matter data within Slack
- Purpose: To enable Customer's legal team to open, track, and close legal matters from Slack threads
- Categories of data subjects: Customer's employees, contractors, candidates, or other individuals who are the subject of a matter, plus the attorneys and legal/HR staff who participate in matters
- Categories of Personal Data: Names, Slack user IDs, email addresses, matter assignments, professional role information, and any personal data the user chooses to type into Opening/Closing Notes or into Slack threads. By design, no field identifies the individual who is the subject of a matter; such identifying data remains in Slack and is referenced by pointer, not copied into the database.
- Special categories: Not intentionally collected. Privileged or sensitive legal content may appear in Slack threads and notes; see Section 5 for how this is handled in AI processing
3. Operator Obligations
The Operator shall:
- Process Customer Data only on documented instructions from Customer, except as required by applicable law;
- Ensure that persons authorized to Process Customer Data are bound by appropriate confidentiality obligations;
- Implement and maintain the technical and organizational security measures described in Section 7;
- Not engage any Subprocessor without prior notice to Customer and, where Customer objects, work in good faith to resolve the objection;
- Assist Customer in fulfilling its obligations to respond to data subject rights requests;
- Delete or return all Customer Data upon termination of the governing agreement, at Customer's election;
- Provide Customer with information reasonably necessary to demonstrate compliance with this DPA;
- Notify Customer without undue delay — and in any event within 72 hours — upon becoming aware of a Security Incident.
4. Customer Obligations
Customer shall:
- Ensure that its use of the Counsltrac service complies with applicable data protection law;
- Provide lawful instructions to the Operator and ensure it has a valid legal basis for Processing;
- Be aware that the AI-assisted features transmit Slack message and thread content to the AI subprocessor (see Section 5), and govern its team's use of those features accordingly;
- Notify the Operator promptly of any changes to its data protection requirements that affect Processing;
- Provide any notice required by applicable law to its own personnel or other data subjects regarding the processing of their information through the Service. As between Customer and Operator, Customer is the data controller with respect to its own personnel and other individuals who are the subject of a matter, and is solely responsible for establishing a lawful basis for, and providing any required notice of, such processing.
5. AI Processing — What Is Sent and How It Is Protected
The optional AI-assisted features are powered by Anthropic's Claude API. Customer should understand exactly what is transmitted:
- On opening a matter, the originating Slack message text is sent to the AI subprocessor to suggest matter fields and generate the First-Pass Review (intake follow-up questions).
- On closing a matter, the full Slack thread (up to 200 messages) is sent to the AI subprocessor to suggest close-out values. This thread content may include privileged attorney-client communications. Logging a past matter likewise sends the full Slack thread to the AI subprocessor to pre-fill the historical open- and close-out fields.
- For natural-language Q&A, the user's question, recent conversation history, and structured matter metadata are sent. The Opening Notes, Closing Notes, and reopen-reason database fields are not included in Q&A prompts.
Protections:
- Under the AI subprocessor's commercial API terms, inputs and outputs are not used to train its models.
- Zero Data Retention: the Operator requested a Zero Data Retention (ZDR) agreement with the AI subprocessor. The subprocessor has indicated that ZDR is currently available only to organizations meeting its enterprise eligibility criteria — usage volume and annual contract value — which the Operator does not yet meet, and has indicated it will revisit eligibility as usage grows. The Operator intends to re-request ZDR at that time. Until ZDR is in place, the subprocessor's standard API retention terms apply, described below, and Customer acknowledges this.
- Retention window: the AI subprocessor automatically deletes API inputs and outputs from its systems within 30 days of receipt or generation, subject to narrow exceptions such as enforcement of its usage policies or legal requirements. Data is not retained indefinitely.
- Data Processing Addendum: the AI subprocessor's own DPA, including Standard Contractual Clauses for international data transfers, is incorporated into the commercial terms governing the Operator's use of its API.
- Certifications: the AI subprocessor maintains SOC 2 Type II, ISO/IEC 27001, and ISO/IEC 42001 certifications covering how it secures customer data across its commercial API, not only for ZDR customers.
The AI features are read-only with respect to Customer Data and cannot create, modify, or delete records.
In-product caution on free-text notes: to limit the personal data entering the system, the Open Matter, Close Matter, and Reopen Matter forms display a caution such as the following beneath each free-text field: "Do not enter employee names or other personal identifiers, or any privileged or confidential details. Keep this to brief, non-identifying context."
6. Subprocessors
The Operator currently uses the following Subprocessors. Customer acknowledges and consents to these Subprocessors. The Operator itself holds no independent certifications; those listed below are held by the respective Subprocessors.
- Supabase, Inc. — Database, authentication, storage · AWS us-east-1, USA (pinned) · SOC 2 Type II, ISO 27001, HIPAA, GDPR
- Anthropic, PBC — AI inference (optional features) · United States · ISO 27001, ISO 42001, SOC 2 Type II
- Render Services, Inc. — Hosting for the Slack bot (compute only) · United States · SOC 2 Type II, ISO 27001
The Operator will provide at least 30 days' advance notice before adding or replacing any Subprocessor. Customer may object within that period by providing written notice to the Operator.
7. Security Measures
The Operator maintains the following technical and organizational measures:
- Encryption: TLS in transit; AES-256 at rest (via Supabase)
- Access control: Row Level Security on database tables; every query filtered by workspace ID; channel-based access so users see only matters from their Slack channels; Counsltrac admin users, where designated by the Customer, may view matter records across all channels in the workspace (but never the underlying Slack messages in channels they do not belong to — only the structured matter record), and they can also manage account settings — option lists, channel routing, and admins — from within Slack; designated attorney users may similarly hand off matters to a covering attorney during an OOO period (OOO Coverage), who sees the structured record for each matter handed to them — including on their own dashboard for the coverage period — regardless of channel membership, again without access to the underlying Slack messages
- Data minimization: By design, no field stores the identity of the individual who is the subject of a matter; matters are described only by type, business unit/department, and jurisdiction. Subject-identifying data remains in Slack rather than being copied into the database, reducing data-privacy exposure and privilege concerns in the event of a database breach
- Authentication: Workspace identity derived from the authenticated Slack context; never trusted from client-supplied input
- Privileged access: Administrative database key restricted to the bot process; never exposed to end users (there is no web application that could expose it)
- AI data protection: Inputs/outputs not used for model training; 30-day automatic deletion (ZDR requested, not yet eligible); AI features are read-only and cannot modify data
- Logging: Structured JSON logs with timestamp, workspace ID, user ID, and action; notes content and Slack message bodies are never logged
- Dependency management: All software dependencies pinned to exact version numbers
- Incident response: Customer notified within 72 hours of a confirmed Security Incident
8. Data Subject Rights
The Operator will, upon Customer's written request and at Customer's cost, assist Customer in responding to data subject rights requests under applicable law, including requests for access, correction, deletion, restriction, or portability of Personal Data.
9. Data Retention and Deletion
Upon termination or expiration of the governing agreement, the Operator will, at Customer's election and within 30 days of receiving written instruction, either delete all Customer Data from the Counsltrac database or return it to Customer in a machine-readable format. The Operator may retain Customer Data longer only as required by applicable law and will notify Customer of any such requirement.
During the term, the Operator retains Customer Data on the following schedule: active matters are retained for as long as the account is active; closed matters are retained for seven (7) years, consistent with standard recordkeeping practice for legal matters; the text of an AI query is cleared within 24 hours of submission; and the underlying AI query log record (workspace ID and timestamp only, with no question text) is retained for ninety (90) days to enforce the monthly usage limit, then deleted. These periods apply in addition to, and do not limit, the deletion-or-return right described above.
10. International Data Transfers
Customer Data is processed and stored in the United States. The Operator and its Subprocessors apply appropriate safeguards for international transfers where required by applicable law (including, for EU/EEA data, Standard Contractual Clauses or other approved mechanisms). Supabase's Transfer Impact Assessment is available on request.
11. Audits
The Operator will make available to Customer, upon written request (no more than once per calendar year), information reasonably necessary to demonstrate compliance with this DPA, provided that audits are conducted with at least 30 days' notice, at Customer's expense, and without unreasonable disruption to operations. Because Counsltrac relies on third-party infrastructure, certain assurances are satisfied through the Subprocessors' own audit reports.
12. Limitation of Liability
Each party's liability under this DPA is subject to the limitations and exclusions set out in the governing agreement.
13. Governing Law
This DPA is governed by the laws of the State of Wyoming. Disputes arising under this DPA shall be resolved in accordance with the dispute-resolution provisions of the governing agreement.
14. Acceptance
This DPA requires no signature. It is accepted when Customer installs or uses the Service, as described above.
Operator (Data Processor): Counsltrac LLC
Address for Notice: c/o Northwest Registered Agent Service Inc, 30 N Gould St Ste N, Sheridan, WY 82801
15. Contact
For questions regarding this Data Processing Agreement, contact Counsltrac LLC — privacy@counsltrac.com.