Privacy Policy

Data We Process

• Account data: names, usernames, role and permission metadata.
• Operational data: matters, contacts, notes, assignments, and event metadata.
• Document data: uploaded files and related metadata.
• Telemetry data: performance and reliability events when enabled by permissions.
• Connected mailbox data when email integrations are enabled, including email metadata, thread identifiers, and message content needed to save emails to matters, classify workflow context, and detect replies or follow-up status.

How We Use Data

• Provide and secure the service.
• Operate workflow features requested by the customer.
• Support troubleshooting, auditability, and platform reliability.
• Comply with legal obligations.

Browser Extension and Gmail Workflows

The Ladra browser extension is designed to help authorized users work directly from Gmail. When a user or firm enables these workflows, Ladra may read the currently open Gmail message or thread context in order to create draft actions, save an email into a matter, send the email into an approved workflow, or track whether a reply has been received.

Ladra uses Gmail-connected data only to support the workflow requested by the customer, such as matter-linked email saving, follow-up tracking, reply detection, and related productivity features. Ladra does not sell Gmail-connected data and does not use it for unrelated advertising purposes.

Connected Mailbox Permissions

Mailbox access is initiated only after an authorized user or firm administrator completes a connection flow through Ladra. Connected account identity data is used to confirm which mailbox is linked and to display mailbox connection status inside the product.

Depending on the enabled workflow, Ladra may process message content, sender and recipient metadata, subject lines, thread identifiers, timestamps, and attachment metadata to help organize legal work. Customers remain responsible for enabling only the integrations appropriate for their practice and compliance requirements.

Customer Control

Customer administrators control user access and permissions, including AI and telemetry permissions.

Customers can export records and manage retention/archive behavior using provided administrative tools.

Customers can disconnect supported integrations and control whether browser-extension and mailbox-based workflows are enabled for their users.

Data Sharing

We do not sell customer data.

Data is shared only with approved subprocessors required to operate the service and with authorized legal requests where required by law.

Security and Retention

We use technical and organizational controls designed to protect confidentiality, integrity, and availability, including AES-256 encryption at rest for sensitive data and encryption in transit.

Retention and deletion handling is described in the Data Retention and Deletion Process.

Controller and Processor Roles

When a law firm uses Ladra, the firm is the controller (or business) of the client and matter data it submits, and Ladra LLC acts as a processor (or service provider) that handles that data only on the firm’s documented instructions, as described in our Data Processing Addendum.

For account-registration data and information collected through ladralegal.com, Ladra acts as the controller.

Cookies and Analytics

Our website uses strictly necessary cookies to operate and a privacy-focused analytics service (Vercel Analytics) to understand aggregate, non-advertising usage. We do not use third-party advertising or cross-site tracking cookies.

You can control cookies through your browser settings; disabling non-essential cookies will not affect core functionality.

Sale and Sharing of Personal Information

We do not sell your personal information, and we do not share it for cross-context behavioral advertising, as those terms are defined under the CCPA/CPRA.

Your Privacy Rights

Depending on where you live, you may have rights under laws such as the California Consumer Privacy Act (CCPA/CPRA) and the EU/UK General Data Protection Regulation (GDPR):

• Right to know and access the personal information we hold about you.
• Right to correct inaccurate personal information.
• Right to delete personal information, subject to legal and contractual retention limits.
• Right to data portability.
• Right to opt out of any sale or sharing of personal information (we do not sell or share).
• Right to non-discrimination for exercising these rights.
• Under GDPR: the additional rights to restrict or object to processing and to lodge a complaint with a supervisory authority. Our lawful bases include performance of a contract, legitimate interests, and compliance with legal obligations.

Data Retention Periods

• Account and profile data: retained for the duration of your subscription and for up to 12 months after account closure, unless a longer period is required by law.
• Customer Data (matters, documents, communications): retained according to the firm’s configured retention settings and instructions, then deleted following the Data Retention and Deletion Process.
• Backup copies: retained until they expire under the normal backup lifecycle.
• Telemetry and analytics: retained in aggregated or limited form for service reliability.

International Data Transfers

We operate primarily in the United States. If you access the service from outside the United States, your information may be transferred to and processed in the United States. Where required, we rely on appropriate safeguards such as standard contractual clauses for such transfers.

Children’s Privacy

The service is intended for law firms and their authorized professional users. It is not directed to children, and we do not knowingly collect personal information from anyone under 16.

Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be posted here with an updated effective date and, where appropriate, communicated through additional notice. We review this policy at least annually.

How to Exercise Your Rights and Contact Us

Where a firm controls your data as our customer, we will refer your request to that firm and assist as its processor. To exercise rights for data we control, or for any privacy question, contact us at privacy@ladralegal.com or the address published on ladralegal.com. We will verify your request before responding.