Privacy Policy

Information you provide directly:

• Intake form data: Inmate name, BOP register number, facility name and location, filer name, email, phone number, relationship to inmate, issue category, issue description, staff involved, witnesses, and remedy sought.
• Account information: Name and email address when you create an account through our authentication provider.
• Contact form submissions: Name, email, phone, subject, relationship, and message content.
• Document vault uploads: Files you upload to your case vault, including their names, types, and metadata.
• Payment information: Processed securely by Stripe. We store only your Stripe customer ID and subscription ID — never your card number, CVV, or billing address.

Information collected automatically:

• Usage data: Pages visited, features used, and interaction patterns to improve our service.
• Session cookies: Used to maintain your login state. We do not use advertising or tracking cookies.

We use the information we collect to:

• Process and manage your administrative remedy case submissions.
• Provide deadline tracking, reminders, and case status updates.
• Store and organize your case documents securely.
• Process membership payments and manage your subscription.
• Respond to your contact form inquiries.
• Send you service-related communications (deadline reminders, case updates).
• Improve our service, tools, and educational content.

We will never:

• Sell your personal information to third parties.
• Share your case details with law enforcement unless required by law.
• Use your data for advertising or marketing purposes unrelated to our service.
• Contact your incarcerated loved one directly without your explicit permission.

Your data is stored on secure, encrypted servers. Documents uploaded to your vault are stored in Amazon S3 with server-side encryption. Database records are protected by TLS encryption in transit and at rest.

While we implement industry-standard security measures, no system is completely immune to breaches. We encourage you to use a strong, unique password for your account and to avoid sharing your login credentials.

We share your information only with:

• Service providers: Stripe (payment processing), Amazon Web Services (data storage), and our authentication provider — each bound by their own privacy policies and data protection agreements.
• Our team: Authorized staff who manage cases, respond to inquiries, and provide member support.
• Legal requirements: If required by law, subpoena, or court order, we may disclose information to the extent legally necessary. We will attempt to notify you before doing so unless prohibited by law.

We retain your case data for as long as your account is active or as needed to provide our services. Given the nature of administrative remedy proceedings — which can span months or years and may be needed for future court filings — we err on the side of retaining records longer rather than shorter.

You may request deletion of your account and associated data at any time by contacting us. We will process deletion requests within 30 days, except where retention is required by law or necessary to protect our legal interests.

You have the right to:

• Access: Request a copy of the personal information we hold about you.
• Correction: Request that we correct inaccurate or incomplete information.
• Deletion: Request that we delete your personal information, subject to legal retention requirements.
• Portability: Request your data in a machine-readable format.
• Withdraw consent: You may stop using our service at any time.

To exercise any of these rights, please contact us using the information below.

If you have questions about this Privacy Policy or wish to exercise your data rights, please contact us through our Contact page.

This policy may be updated from time to time. We will notify registered users of material changes via email. The "Effective Date" at the top of this page indicates when the policy was last revised.