Privacy Policy

Information we collect

We collect the following from you, the subscriber:

• Account. Email address, a one-way hash of your password (argon2id; we never see the plain text), display name, and the Virginia attorney record we matched you to (if any).
• Payment. Billing is handled by Stripe. We receive a Stripe customer identifier, subscription status, trial end date, and the last four digits of your card. We never receive or store your full card number.
• Workflow data. The matters you save, the charge and jurisdiction slices you load, the notes you write, and any officer overlays you open. This is scoped to your account and is not shared with other subscribers.
• Logs. Server logs include IP address, user agent, request path, and timestamp. Used for security, abuse prevention, and incident response. Retained 90 days.
• Audit log. Every authentication event, password change, subscription change, and administrative action is recorded against your account. Retained for the life of the account plus 24 months.

Information we do NOT collect

• Client identities. The product is not a client database. We never ask for, never display, and never store the names or identifying details of your clients.
• Matter contents. Notes you write inside VCF Intelligence are scoped to you and capped at a length that makes client-fact storage impractical by design. We strongly recommend you do not put client facts in notes; we do not enforce it programmatically.
• Court records about your clients. The court-data side of the product is an aggregate read of public Virginia court records — charge × jurisdiction × year statistics. It is the same data the free VirginiaCourtFile site publishes. It is not tied to your individual matters.
• Third-party tracking. No Google Analytics, no Facebook Pixel, no Hotjar or Clarity-style session replay. No advertising identifiers.

How we use what we collect

• To authenticate you and keep your session active.
• To bill you and let you manage your subscription.
• To deliver the product — render your /intel briefing, send you the Morning Brief if you opt in, surface notes against the right matter.
• To respond to support requests and investigate suspected abuse or fraud.
• To meet legal obligations (tax, subpoena response, compliance with applicable law).

We do not sell subscriber data. We do not share subscriber data with marketing partners. We do not train external AI models on subscriber data.

Subprocessors

The following third parties process subscriber data on our behalf:

• Stripe. Payment processing and billing management.
• Resend. Transactional email delivery (verification, password reset, billing notices, Morning Brief).
• Railway. Application hosting and database storage.

Each subprocessor is contractually obligated to protect your data and use it only to provide their service to us.

Data retention

Account and subscription records are retained for the life of your account. Server logs are retained for 90 days. The audit log is retained for the life of the account plus 24 months for security and compliance investigations. If you close your account, account records are deleted within 30 days except where retention is required by law.

Cookies and similar technologies

We use a single first-party session cookie (intel_session) signed with HMAC-SHA256 and scoped to intel.virginiacourtfile.com. It is httpOnly, SameSite=Strict, and marked Secure in production. It is required for the product to function. We use no other tracking cookies and do not honor third-party tracking pixels.

Your rights

You may, at any time:

• Export your account data in machine-readable form.
• Delete your account and all associated data.
• Update your account information.
• Withdraw consent for non-essential processing (we have none currently — there is no non-essential processing you can opt into or out of).

To exercise any of these rights, email privacy@courtfile.com from the email on your account. We respond within 30 days.

Security

Passwords are stored as argon2id hashes. Sessions are HMAC-signed with a secret that lives only in our deploy environment. The application runs over HTTPS only. The database is hosted in a private network and backed up daily. We will notify affected subscribers within 72 hours of confirming a personal data breach.

Children

VCF Intelligence is a professional product sold to licensed Virginia attorneys. It is not directed to children and we do not knowingly collect information from anyone under 18.

Changes to this policy

Material changes will be announced by email to active subscribers at least 14 days before they take effect. Non-material changes (typos, clarifications) may be made without notice; the "Last updated" date at the top will always reflect the most recent revision.

Contact

CourtFile LLC
Virginia Beach, Virginia
privacy@courtfile.com