You are trusting us with a client’s file. In short: your case material is yours, it is used only to provide Versal to you, it is never used to train AI models, and we do not sell information or run advertising trackers.
This policy is part of our Terms of Use.
1. What this policy covers
This policy covers the Versal website and the Versal workspace. It describes two different kinds of information, and we treat them differently:
- Account information is about you, the person using Versal: your name, your email address, how you sign in.
- Case material is what you put into a case: the discovery you upload, and the notes, corrections and chronology you build on top of it. It belongs to you and your client. We hold it only to provide the service to you.
2. Account information we collect
- What you give us. Your name, email address and password when you sign up. We store the password only as a salted hash. If you turn on two-step verification we store the secret your authenticator app uses, and your backup codes.
- Your organization. The firm or practice you create or join, who its members are, their roles, and the invitations sent from it.
- Sign-in records. Each session records the IP address and browser it came from, and when it was created and expires. This is how you can see and end your own sessions, and how we notice misuse.
- Connected apps. If you authorize another application to reach your workspace, we keep a record of the application, the organization and the permissions you granted, so that you can revoke it.
- Billing. If you buy a paid plan, payment is handled by Stripe. We receive your plan, its status and Stripe’s identifiers for your organization. We never receive or store your card number.
- What you write to us. Messages you send to support.
- Server logs. Our servers log requests and errors so we can keep the service running. Logs are kept for thirty days.
3. Case material
Discovery in a criminal case is full of other people: your client, witnesses, complainants, officers. It can include medical records, criminal history, video, and the contents of phones. We know what it is, and the rules below are written for it.
- We process case material on your behalf and on your instructions, to show it to you, search it, and prepare the summaries, citations and suggestions you see in the workspace.
- We do not sell it, share it for advertising, or use it to build profiles of anyone.
- Only the members of your organization you have given access to a case can open it in Versal.
- Our staff do not read your case material, except when you ask us to look at something for support, or when we must in order to fix a fault, keep the service secure, or comply with the law.
- Putting material into Versal is not intended to waive attorney-client privilege, work-product protection, or any other protection that applies to it.
If you are named in material a lawyer has uploaded, that lawyer decides how it is used. Write to them first. If you write to us, we will pass your request on to the lawyer concerned.
4. How AI is used
Versal uses AI models to read case material and to draft what it shows you. Those models run on Amazon Bedrock, inside Amazon Web Services.
- Your material is never used to train AI models.
- Your material is never shared with AI model providers.
- Requests that AWS’s automated abuse-detection systems flag may be retained by AWS for up to 30 days, for abuse detection only. That retention is outside our control, so we will not tell you that nothing is ever retained.
5. How we use account information
- To create your account, sign you in and keep it secure.
- To send the email the service depends on: address verification, password resets, invitations, and notices about your account or these terms.
- To answer you when you write to us.
- To bill you, if you are on a paid plan.
- To find and fix faults, and to prevent abuse.
- To comply with the law.
We do not sell account information, and we do not share it for advertising.
7. Who processes information for us
We use a small number of providers, each under a contract that limits what it may do with the information:
- Amazon Web Services hosts everything: the database, file storage, AI processing through Amazon Bedrock, and outgoing email. Case material stays inside AWS.
- Stripe processes payments for paid plans. It receives billing details, never case material.
An application you connect to your workspace yourself receives what you authorize it to receive; its own terms govern what it does next.
8. When we disclose information
Apart from the providers above, we disclose information only:
- when you ask us to;
- if the business is sold or merged, to the successor, which will be bound by this policy; or
- when the law requires it.
If we receive a subpoena, warrant or other legal demand for your case material, we will tell you before we disclose anything, unless the law forbids us to, so that you can assert privilege and any other objection yourself. We will direct the requester to you where we can, and disclose no more than the demand requires.
9. Where it is kept and how it is protected
Everything is stored in AWS data centers in the United States. Information is encrypted in transit and at rest. Documents are kept in private storage that is never publicly reachable. Access to a case is checked against current membership on every request, and accounts can be protected with two-step verification.
No system is perfectly secure. If we learn of a breach affecting your information or your case material, we will tell you promptly, with what we know, so that you can meet your own obligations.
10. How long we keep it, and deletion
We keep account information and case material for as long as your organization’s account is open. You can ask us to delete a case, or your whole account, at any time by writing to [email protected]. We will delete it from the live service and confirm when that is done.
Database backups are kept for seven days and then expire, so deleted material can persist in a backup for up to seven days after it leaves the live service. Server logs are kept for thirty days. We may keep a minimal record that a deletion took place, and billing records for as long as the law requires.
11. Your choices and rights
You can see and correct your name and email address in your account settings. You can ask us for a copy of your account information, or to correct or delete it, by writing to [email protected]. Depending on where you live, the law may give you further rights over your personal information; we will honor a request that the law entitles you to make, and we will not treat you differently for making it.
The email we send is about your account and the service. We do not send marketing email.
12. Children
Versal is a tool for lawyers and their staff. It is not directed to anyone under 18, and we do not knowingly collect account information from children.
13. Changes to this policy
If we change this policy we will post the new version here with a new effective date. If a change materially affects how we handle your information or your case material, we will email your organization’s owners before it takes effect.
14. Contact
Questions about this policy, or about your information: [email protected].