MG Privacy policy
Draft for attorney review before the first subscription. Effective date to be set.
Version 2026-10-11.
This website
This site sets no cookies and loads no tracking script. Cloudflare, which serves the site, counts each page view for us as it serves it: the page, the country, the site the visitor came from, whether the request looked like a crawler, and a hash of the visitor's address that changes each day, so we can count a day's visitors without identifying anyone. We do not receive the address itself. The only page that collects anything else is the sign-up form, and it collects only what the next section lists. If you email us, we keep the email.
The assistant
The MG Legal Ops assistant runs on the subscribing firm's own computers. MG Legal Ops LLC does not receive, store, or process the firm's email, documents, matters, time entries, contacts, or calendar. Those remain in the firm's Microsoft 365 and Clio accounts and on the firm's computers, under the firm's own agreements with those providers.
What we receive
- Account and billing information for the firm: firm name, the name and work email of the person who signs up, how many attorneys the firm pays for, and the identifiers our payment processor (Stripe) gives us for the firm's subscription. Card details go directly to Stripe; we never see or store card numbers.
- The people a firm tells us about. The names and work email addresses of the firm's billing contact, its attorneys who use the assistant, and its IT and Clio administrators, given at sign-up or on the setup page, so we can tell the right person about changes that affect them: a change to the terms, a problem that affects the firm, a trial that is ending. Anyone may ask to receive essential service notices only.
- The firm's connection details, if the firm chooses. The setup page offers to keep the firm's connection details (which Microsoft 365 organization approved the assistant, and the firm's email domains; never anyone's login and never a secret, since no firm holds one) on file, encrypted, so that a colleague the firm's administrator approves can download their own setup folder. Untick the box and nothing is kept; they go only into the folders the firm downloads. Details kept on file are deleted after thirty days without use, and any of the firm's administrators can have them deleted sooner, from the assistant.
- Clio sign-in and refresh, in passing. The assistant signs in to Clio through one application that MG Legal Ops owns. Clio requires that application's secret when a sign-in is completed and when an access token is renewed, about once a month, so those two requests pass through our account service, which adds the secret and hands Clio's answer back to the attorney's computer. The service keeps nothing from them: no sign-in code, no token, no log of either. The tokens live only on the attorney's own computer.
- Subscription checks. Once a day the assistant on each attorney's computer confirms with our account service that the firm's subscription is current. That check carries the firm's key, a one-way hash of the attorney's email address (so we can count how many attorneys use it, without knowing who), and the version of the software. It also says whether files in the assistant's project folder were changed on that computer, which update channel (or branch) and code repository the computer follows, when the assistant last started, and whether its automatic update worked at that start. It also carries a one-way hash of an identifier the software makes at random on that computer the first time it checks in, so that an attorney who uses two computers is one attorney with two computers rather than two attorneys: it is not the computer's name, serial number or address, and it tells us nothing about the computer or the person using it. We do not receive the email address itself.
- Problem reports filed by the assistant when it encounters an error, if the firm has enabled them. Email addresses, message identifiers, subjects, and names are removed before sending. Reports contain technical detail about the error only.
- Monthly usage counts, if the firm has agreed to share them: numbers of time entries, hours, emails filed, and similar. No content.
- Questions typed into the website's question box, with the answer given and the page they were asked on, so the site's answers can be improved. The visitor's address is kept only as a hash that changes each day. A note sent to the team from the box, with the reply address if one is given, goes to our private issue tracker.
- A sign-in check on the sign-up page. Verifying Microsoft 365 or Clio by signing in leaves us the organization's identifier and its email domain, and nothing else: no password, no token, no mailbox.
- A sign-in that proves who is asking. Before a firm's administrator sees or changes the firm's account, and before a person downloads their own setup folder from a link, they sign in with their work Microsoft account. We keep that account's organization identifier and account identifier, linked to the person the firm told us about, so the next sign-in can be matched to them - never a password, a token, or anything from the mailbox.
Who else is involved
- Anthropic provides Claude under the firm's own subscription and terms. We are not a party to that processing. The website's question box sends the question, with the site's own text, to Anthropic under our account to compose the answer.
- Stripe processes payments and holds card details under its own privacy policy. We receive confirmation that a payment succeeded or failed, never the card.
- Cloudflare hosts this website, our account service, and its database.
- Resend delivers the email our account service sends: approval links, setup download links, and service notices. It receives the recipient's address and the message, and keeps a record of them for thirty days.
- GitHub stores problem reports, usage counts, and notes sent from the website's question box as issues in a private repository.
Retention and access
Only MG Legal Ops LLC personnel can read what we receive, and the accounts that hold it require two-factor sign-in.
- A sign-up that is never completed is deleted after thirty days.
- Daily subscription checks are kept for ninety days. The latest facts for each attorney (the email hash, the version, what the check said about the computer, and when it first and last checked in) are kept with that attorney's seat on the firm's account for as long as the account exists, as are the same facts for each of that attorney's computers; a computer that has not checked in for ninety days is deleted.
- Questions typed into the website's question box are kept, with the answer given, for one year.
- Page-view counts for this website are kept by Cloudflare for three months.
- What became of each email our account service sent (the address, the subject, and whether it was delivered or bounced, never the message) is kept for ninety days, so that we can tell a firm when a link did not arrive.
- A sign-in check that is not followed by a sign-up is deleted after seven days; one that is followed by a sign-up becomes part of the firm's account record.
- The record of a sign-in that proves who is asking is deleted after a day; the account identifiers it links to a person are part of the firm's account record.
- A firm's connection details kept on file are deleted after thirty days without use: thirty days in which no setup folder was built for the firm and none of its administrators acted on its account. Any of the firm's administrators can have them deleted sooner, at any time.
- Account and billing records are kept while the firm is a customer and for one year after, then deleted, or sooner at the firm's request except where a tax or accounting rule requires us to keep an invoice record.
- Problem reports and usage counts are kept as long as they are useful for maintaining the software. A record of an error in our own service is deleted after thirty days; it holds the address inside our service that failed, the error, and which firm's request it was, never the contents of the request. The daily counts we keep about our own service, which identify nobody, are deleted after two years. Monthly totals drawn from those counts, which identify nobody, are kept in our business records for as long as we keep our books. A firm may ask us to delete the daily counts at any time.