Privacy Policy
Effective date: TBD — final policies will be published before launch.
Decree handles some of the most sensitive data in civil practice — financial records, children's information, and personal identifiers. This draft describes how we intend to collect, use, and protect that data. It is a pre-launch placeholder, not the final policy, and it is not legal advice.
Data we store
Account data. Your name, email address, and organization membership, managed through our authentication provider (Clerk).
Matter data. Information you or your clients enter about matters: parties, children, income, deductions, calculations, and form contents. Sensitive identifiers (Social Security numbers, driver's license numbers) are encrypted at rest with a dedicated application-level key.
Documents. Files you upload (paystubs, tax returns, bank statements) are stored encrypted and scoped to your organization.
Usage data. Basic product analytics and an audit log of changes within your organization.
How we use your data
To operate the product: running calculations, generating forms, and — when you ask for it — extracting figures from documents you upload. We do not sell your data, and we do not use your matter data to train AI models.
Subprocessors
We rely on a small set of infrastructure providers, all with US data residency:
- Clerk — authentication and organization management
- Neon — Postgres database hosting
- Amazon Web Services (S3) — encrypted document storage
- Anthropic — AI document extraction, only on documents you submit for extraction
- Stripe — billing and payments
A complete, current subprocessor list will be published at launch.
Retention and deletion
You can export your matters as PDF and CSV at any time. Deletions in the product are soft-deletes you can recover; on account cancellation we retain encrypted backups for 30 days and then permanently delete your data.
Security
Encryption in transit (TLS) and at rest, tenant isolation by organization, least-access internal controls, and an audit log of changes. SOC 2 readiness is on our roadmap; we do not currently hold a SOC 2 report.
Your rights
You can access, export, correct, or delete your data. Washington residents may have additional rights under the Washington My Health My Data Act and other state law; the final policy will address these in detail.
Contact
Questions about this draft? Email hello@decree.app.