Product: Frix Law
Controller / Operator: Frix Labs LLC (“Frix,” “we,” “us”)
Effective date: August 1, 2026
Last updated: August 10, 2026
Contact: privacy@frixlaw.com
This Privacy Policy explains how we collect, use, disclose, and protect personal information in connection with https://frixlaw.com, https://app.frixlaw.com, and the Frix Law Service.
If you are a law firm customer, you typically act as the controller (or “business”) of your clients’ and callers’ data; Frix Labs LLC acts as a processor (or “service provider”) under our DPA. This Policy describes our practices as operator of the platform and as controller of account and billing data.
1. Scope
This Policy covers:
- Firm users (attorneys, staff, admins) who create accounts;
- Visitors to our marketing sites;
- Personal data processed on behalf of Customers inside the Service (call recordings, intakes, documents, and similar), described so end-users understand the ecosystem—Customer’s own privacy notices also apply to callers and clients.
This Policy does not cover third-party websites or Customer’s own websites.
2. Categories of personal information we collect
2.1 Account and firm information
- Name, email, phone, password (hashed), role, firm name, firm website, location (state and city), assigned phone numbers;
- Billing contact details and payment metadata from our payment processor (we do not store full card numbers);
- Support communications.
2.2 Usage and device data
- IP address, browser and user agent, approximate location derived from IP;
- Log data, feature usage, diagnostic and performance metrics;
- Cookies and similar technologies on our sites (see Section 8).
2.3 Customer Data processed for Customers (processor role)
Depending on how the Customer configures the Service:
- Caller and client contact details (name, phone, email, address);
- Call audio, transcripts, SMS content, booking details;
- Intake narratives, injury and accident facts, insurance, medical, employment, and similar sensitive matter data;
- Uploaded documents, OCR text, embeddings, transcripts of audio and video evidence;
- Calendar event details synced when Customer connects Google Calendar or similar;
- Team activity logs.
Sensitive categories (health, voice-derived identifiers, precise location if provided) may appear in Customer Data. We process them only under Customer instructions and the DPA.
2.4 Information from third parties
- Telephony and messaging providers (call metadata, delivery status);
- Identity and calendar providers if Customer connects them;
- Public firm website content crawled during onboarding when Customer supplies a URL.
3. How we use personal information
We use personal information to:
- Provide, operate, secure, and support the Service;
- Authenticate users and prevent fraud and abuse;
- Process payments and send transactional emails (password reset, invitations, welcome);
- Improve product quality through aggregated and de-identified analytics;
- Comply with law and enforce our Terms;
- Communicate product updates and, where permitted, marketing (you may opt out of marketing emails);
- Run AI features solely to provide the Service. We do not use Customer Data to train publicly available foundation models.
4. Legal bases (EEA and UK where applicable)
Where GDPR or UK GDPR applies to us as controller: contract performance, legitimate interests (security, product improvement with safeguards), consent (where required, such as certain cookies or marketing), and legal obligation.
Where we act as processor, Customer’s legal bases govern the processing we perform on their behalf.
5. AI processing
Voice AI, OCR, transcription, embeddings, and Donna use automated systems, including third-party LLM and speech providers. Content you submit may be sent to those subprocessors solely to provide the feature. See the subprocessor list in the DPA. Human review of content may occur for abuse, security, or support when you request it.
6. How we share information
We do not sell personal information. We share as follows:
| Recipient | Purpose |
|---|---|
| Subprocessors | Cloud hosting, telephony, SMS, email, AI and speech, payments — bound by contract |
| Customer-authorized users | Team members and roles Customer invites |
| Share links | Recipients of document shares Customer creates |
| Professional advisors | Legal and accounting, under confidentiality duties |
| Authorities | When required by law or to protect rights and safety |
| Business transfers | Merger, acquisition, or asset sale with notice as required |
Callers’ data is visible to the Customer firm that received the call; Frix does not use it for advertising.
7. Retention
- Account data: for the life of the account plus a reasonable period for legal and billing records;
- Customer Data: per Customer configuration and the DPA; after termination we delete or return within the periods stated in the DPA, subject to legal holds and backups rotated on a defined schedule;
- Logs and security records: typically up to 365 days unless needed longer for investigations.
8. Cookies
We use essential cookies for authentication and security, and may use analytics cookies on marketing pages. Where required, we request consent for non-essential cookies. You can control cookies via browser settings; disabling essentials may break login.
9. Security
We implement administrative, technical, and organizational measures appropriate to the risk, including encryption in transit, access controls, logging, and vendor diligence. See also Cyber Liability Insurance. No method of transmission or storage is 100% secure.
10. Your rights
Depending on your location, you may have rights to access, correct, delete, port, restrict, or object to certain processing, and to withdraw consent.
- Firm users and website visitors: contact privacy@frixlaw.com.
- Callers and clients of a law firm: contact that firm first; we will assist the firm as processor under the DPA.
We may need to verify your identity. You may lodge a complaint with a supervisory authority where applicable.
California (CPRA): We act as a “service provider” for Customer Data. We do not sell or “share” personal information for cross-context behavioral advertising as those terms are defined. California residents may exercise rights via privacy@frixlaw.com. We will not discriminate for exercising privacy rights.
11. International transfers
We primarily host in the United States (Amazon Web Services, us-east-1). Transfers from the EEA, UK, or Switzerland use appropriate safeguards such as the Standard Contractual Clauses, as described in the DPA.
12. Children
The Service is not directed to children under 18. We do not knowingly collect personal information from children. If you believe we have, contact privacy@frixlaw.com.
13. Changes
We may update this Policy by posting a new version with a revised “Last updated” date. Material changes will be notified by email or in-app notice where appropriate.
14. Contact
Privacy inquiries: privacy@frixlaw.com
Legal: legal@frixlaw.com
Operator: Frix Labs LLC, United States