Privacy Policy

SharedAlly (“SharedAlly,” “we,” “us,” or “our”) builds systems, automation, and applied-AI tools for businesses and professional practices, and provides marketing and consulting services. Confidentiality is central to that work, and this policy explains how we treat the information involved in it.

This Privacy Policy describes how SharedAlly collects, uses, discloses, retains, and protects personal information in connection with sharedally.com (the “Site”); our communications, proposals, and business relationships; and the products and services we provide, including Ally, our legal-operations product (together with the Site, the “Services”).

A note on how to read this policy. SharedAlly handles two very different kinds of information, and the distinction runs through everything below. Information about you that we collect for our own business — a form you submit, an email you send us — is described in the sections on our own processing. Information a client places into our systems for us to work on is described as Client Content, and our obligations for it come primarily from our agreement with that client. Section 2 explains the difference.

By accessing or using the Site or the Services, you acknowledge the practices described in this Privacy Policy. If you do not agree with them, please do not use the Site or the Services.

This Privacy Policy does not amend any signed agreement between SharedAlly and a client. Where a services agreement, data processing addendum, confidentiality agreement, or similar contract addresses the handling of Client Content, that agreement governs and this policy yields to it.

1. Scope and Application

This policy applies to personal information SharedAlly handles through the Site and the Services. It does not apply to the independent practices of third parties, including any platform a client connects to our Services or any site we link to.

2. Our Two Roles

Information we handle for our own purposes

When you browse the Site, submit a form, request a demonstration, correspond with us, engage us, or otherwise deal with SharedAlly directly, we decide how and why that information is used. This covers site visitors, prospective clients, client personnel, vendors, contractors, and other business contacts.

Client Content we handle on a client’s instructions

Clients use our Services to work on their own material. A law firm using Ally, for example, may connect or provide correspondence, documents, records, calendars, matter information, and similar material — which can contain personal information about that firm’s own clients, employees, opposing parties, witnesses, medical providers, and others.

We call that material Client Content. For Client Content, SharedAlly acts as a service provider or processor: we handle it to deliver the service the client has engaged us for, on that client’s instructions, under our agreement with them and applicable law. We do not decide what a client places into its own files.

If your personal information appears in a client’s Client Content, the client — not SharedAlly — is the right party to contact about it. They control that material and can act on it. Where we are required or contractually obligated to help a client respond to such a request, we will.

3. Information You Provide to Us

We collect what you choose to give us, which may include your name, business email address, telephone number, organization, role or title, a description of your business needs or technology environment, the content of your messages, and anything else you include. If we engage in a paid relationship, we or our payment processor may handle billing and transaction information.

Please do not send confidential, privileged, medical, financial, or otherwise sensitive information through the Site’s contact form or ordinary email. If sensitive material is genuinely needed, we will provide an appropriate method for sending it.

4. Information Collected Automatically

When you visit the Site, we and the providers that host and protect it may process technical information, including IP address, browser and device type, operating system, referring page, pages viewed, timestamps, and diagnostic or security log data. General location may be inferred from an IP address.

We use this to deliver the Site, keep it secure and available, diagnose problems, and understand aggregate usage.

5. Information From Connected Systems

Where a client directs us to connect the Services to another system — email, calendar, document storage, a CRM, a case-management platform, or similar — we receive information from that system to the extent the client’s configuration and granted permissions allow. What we receive depends entirely on which integration the client selects and what access they authorize.

6. Categories of Client Content

Depending on how a client configures and uses the Services, Client Content may include matter and case files, correspondence and email, documents and their metadata, medical and treatment records, chronologies, claim and coverage information, calendar entries and deadlines, intake material, notes, research, templates, and information drawn from connected systems.

Client Content can therefore contain sensitive personal information and information subject to professional, statutory, regulatory, or contractual confidentiality obligations. We treat it accordingly.

7. How and Why We Use Information

We use personal information we handle for our own purposes to:

• operate, maintain, secure, support, and improve the Site and Services;
• respond to inquiries and provide consultations or demonstrations;
• evaluate, establish, and manage business relationships;
• deliver and administer engagements, including billing;
• communicate about our Services, including material you request;
• monitor performance and availability;
• detect, investigate, and prevent fraud, abuse, security incidents, and unlawful activity;
• keep ordinary business and operational records;
• comply with legal obligations, enforce our agreements, and establish, exercise, or defend legal claims.

Client Content is used to deliver the service the client engaged us for, and for the other purposes that client’s agreement permits. We do not use Client Content for our own marketing, and we do not mine it to build products for unrelated customers.

We may create aggregated or de-identified information that does not reasonably identify anyone and use it for analytics, security, capacity planning, and improving our Services. Where the law requires, we maintain such information in de-identified form and do not attempt to re-identify it.

8. Artificial Intelligence and Automated Processing

Parts of our Services use artificial intelligence and machine-learning technology to assist with tasks such as reading and extracting information from documents, organizing and summarizing material, preparing drafts, supporting research, routing work, and automating steps in a workflow.

Several commitments govern that processing:

Your material is not used to train general-purpose models. Where we use third-party AI providers to process Client Content, we do so under terms that prohibit those providers from using the material to train their general-purpose models.

We do not train shared models on client material. Unless a client authorizes it in writing, SharedAlly does not use one client’s Client Content to build or improve models, templates, or capabilities offered to unrelated clients.

People stay in control of the output. Our Services are designed so that a qualified human reviews and approves work product before it is sent, filed, or acted on, where the workflow calls for it. Automated processing supports professional judgment; it does not replace it.

AI providers are subprocessors. Any third-party model provider handling Client Content is engaged as a service provider or subprocessor, subject to the restrictions above and to our agreement with the client.

9. Cookies, Analytics, and Privacy Preference Signals

The Site does not use advertising or tracking cookies. We do not build advertising profiles, and we do not follow visitors across unrelated websites.

Where we measure Site usage, we use privacy-preserving analytics configured without advertising cookies and without persistent identifiers stored on your device, so visits are not linked together over time. Automatic click capture and session recording are disabled.

Providers that host, secure, and deliver the Site necessarily process technical request information — IP address, browser type, timestamps, server logs — to do so.

Opt-out preference signals. Some browsers and extensions transmit signals such as Global Privacy Control. Where applicable law requires a business to treat such a signal as an opt-out of the sale or sharing of personal information, we honor it. Because SharedAlly does not sell or share personal information for cross-context behavioral advertising (see Section 10), such a signal does not change anything we currently do — there is no such activity to stop.

Do Not Track is a separate, older browser setting with no agreed industry standard for how sites should respond. We do not currently alter Site behavior based on a Do Not Track header. The privacy-protective posture described above applies to every visitor regardless of any signal.

10. We Do Not Sell or Share Personal Information

As of the Last Updated date above, SharedAlly does not sell personal information for monetary or other valuable consideration, and does not share personal information for cross-context behavioral advertising, as those terms are used in California privacy law. We have not done so in the preceding twelve months.

We do not knowingly sell or share the personal information of anyone under 16.

If this ever changes, we will update this policy and implement any required notice, consent, or opt-out mechanism before beginning the activity.

11. How We Disclose Information

We do not disclose personal information indiscriminately. Disclosure occurs in these circumstances:

Service providers

Vendors that perform functions for us or help us deliver the Services — hosting and infrastructure, AI processing, information technology and security, communications and email delivery, scheduling, analytics, payment processing, and professional services. They are permitted to use the information only to perform those functions.

At a client’s direction

When a client instructs us to connect to, transmit to, or retrieve from another system or recipient, we carry out that instruction.

Professional advisers

Attorneys, accountants, auditors, insurers, and similar advisers, under obligations of confidentiality.

Legal and safety

Where we reasonably believe disclosure is necessary to comply with law, regulation, subpoena, court order, or lawful government request; to investigate or prevent fraud or unlawful activity; to enforce our agreements; or to protect the rights, security, or safety of SharedAlly, our clients, or others. Where a demand seeks Client Content and we are legally permitted to do so, we will attempt to redirect the requesting party to the client and to notify the client.

Business transactions

In connection with a merger, acquisition, investment, financing, reorganization, insolvency, or sale of assets, subject to appropriate confidentiality protections.

With your direction or consent

Where you or the applicable client authorize the disclosure.

12. Confidential, Legal, and Health-Related Material

Some clients use our Services in settings involving privileged legal material, medical records, or other sensitive records. We apply administrative, technical, organizational, and contractual measures appropriate to that material and to the engagement.

A client remains responsible for determining whether it may lawfully provide particular material to us, and for configuring its use of the Services accordingly.

This policy is not a Business Associate Agreement. Where the Health Insurance Portability and Accountability Act applies to an engagement, obligations concerning protected health information are addressed in a separate business associate agreement and the associated contractual and security terms — not here.

Nothing in this policy creates an attorney-client relationship between SharedAlly and any Site visitor, client, client’s client, or other person. SharedAlly is not a law firm and does not provide legal advice through the Site or the Services.

13. Security

We maintain administrative, technical, and organizational safeguards designed to protect information under our control against unauthorized access, acquisition, disclosure, alteration, loss, and destruction. These are designed to include access controls and authentication, encryption appropriate to the information and system involved, monitoring, and limits on personnel and vendor access.

No website, network, transmission method, or storage system is perfectly secure, and we cannot guarantee absolute security.

Clients are responsible for the security of their own accounts, credentials, devices, personnel, and the systems they connect to our Services.

14. Retention

We keep personal information only as long as reasonably necessary for the purpose it was collected for — delivering the Services, maintaining security, meeting contractual and legal obligations, resolving disputes, keeping ordinary business records, and establishing or defending legal claims. Retention periods vary by category and context.

Client Content is retained, returned, or deleted according to the client’s agreement and instructions. When material is deleted, copies may persist briefly in routine backups until those backups expire or are overwritten in the ordinary course, unless the law requires longer retention.

15. Your Privacy Rights

Depending on where you live and which laws apply, you may have rights to: confirm whether we process your personal information; access it or obtain a copy, including in a portable format where technically feasible; correct inaccuracies; request deletion; opt out of sale, sharing, targeted advertising, or certain profiling; limit certain uses of sensitive personal information; withdraw consent where processing relies on consent; and appeal a decision on a privacy request. You also have the right not to receive discriminatory treatment for exercising a privacy right.

These rights are subject to the exceptions and limits the applicable law provides.

Where your information appears only in a client’s Client Content, we will direct your request to that client, or tell you that it should go to them, and assist them as required.

16. California Residents

If the California Consumer Privacy Act applies to our processing of your personal information, you may have the following rights, subject to statutory exceptions:

• Right to know and access — the categories of personal information we collected, the sources, the business purposes, the categories of recipients, and the specific pieces of personal information we hold about you.
• Right to delete — personal information we collected from you.
• Right to correct — inaccurate personal information.
• Right to opt out of sale or sharing — as stated in Section 10, we do not sell or share personal information, so there is currently no such activity to opt out of.
• Right to limit use of sensitive personal information — where we use sensitive personal information beyond the purposes that do not require a limitation right.
• Right to non-discrimination — we will not deny service, charge different prices, or provide a different level of quality because you exercised a privacy right.

Categories of personal information. In the past twelve months, we have collected identifiers (such as name, business contact details, and IP address), commercial information (such as services inquired about or purchased), internet and network activity information (such as Site interaction data), professional or employment-related information (such as job title and employer), and inferences drawn from that information. Client Content may contain additional categories, including sensitive personal information, which we process on client instructions rather than for our own purposes.

Sources, purposes, and recipients are described in Sections 3 through 7 and Section 11.

Verification. We may need to verify your identity before acting on a request, and will use the information you provide for that purpose only. An authorized agent may submit a request on your behalf with appropriate proof of authority; we may still ask you to verify your identity directly.

17. Residents of Other States

Several other states provide comparable rights, which may include access, correction, deletion, portability, opting out of targeted advertising or sale, and appealing a denied request. Where such a law applies to our processing, we honor the rights it grants. To make a request, use the contact method in Section 20 and tell us which state you reside in.

18. Visitors Outside the United States

SharedAlly operates in the United States, and information we handle is processed there. If you access the Site or Services from another country, you understand that your information will be transferred to and processed in the United States, where data protection laws may differ from those where you live. We do not target our Services to individuals in the European Economic Area or the United Kingdom.

19. Children

The Site and Services are built for businesses and professional users and are not directed to children. We do not knowingly collect personal information from children under 13 through the Site.

Client Content may contain information about minors where a client lawfully includes it — a case file, for instance. In that situation we process the information on the client’s behalf, not by soliciting it from the child.

If you believe a child has provided personal information directly to us through the Site, please contact us and we will take appropriate steps.

20. Contact Us and How to Submit a Privacy Request

Questions about this policy, or requests to exercise a privacy right, may be submitted by either method:

• Email: privacy@sharedally.com
• Online: our contact page

Please include enough detail for us to understand your request and determine whether we hold information about you. Do not send sensitive personal information by ordinary email for verification purposes unless we ask you to through an appropriate method.

We respond to verified requests within the time the applicable law requires. If that law provides a right to appeal a denial, our response will explain how.

21. Changes to This Policy

We may update this policy to reflect changes in our Services, technology, practices, or legal obligations. When we do, we will revise the Last Updated date above. If a change materially affects how we use personal information already collected, we will provide any additional notice or obtain any consent the law requires.