Privacy Policy

Section 01

Notice at Collection & Your Choices

At or before the point of collection, here is a concise summary of how we handle your information. Full detail follows in the sections below.

• Categories we collect: identifiers (name, email, phone), firm and business details, internet and usage activity (analytics and cookies), and company information inferred from your IP address. We do not use sensitive personal information to infer characteristics about you.
• Purposes: to respond to your inquiries, deliver and improve our services, measure marketing, secure the site, and meet legal obligations.
• Retention: only as long as needed for those purposes — see 'How Long Do We Keep Your Information?' below.
• We do not sell your personal information for money. Our use of analytics and advertising cookies and pixels may be considered a 'sale' or 'share' for cross-context behavioral advertising under California law (CPRA), which you can opt out of at any time.

How we ask for cookie consent (region-aware)

Visitors from the EU, EEA, or UK: non-essential analytics and advertising cookies stay OFF until you opt in through our cookie banner (GDPR). Visitors from the United States and elsewhere: those cookies are ON by default and you may opt out at any time (the CCPA/CPRA opt-out model). Essential cookies that run the site and protect against fraud are always on and are exempt from consent.

How to opt out or change your choice

Use the 'Cookie preferences' link in our website footer to review or change your choices at any time, or the 'Do not sell or share my info' link (for California residents) — both reopen our consent controls where you can reject analytics and advertising cookies. We also honor the browser-level Global Privacy Control (GPC) signal as an opt-out for U.S. visitors, and you can manage cookies through your browser settings.

Section 02

What Information Do We Collect?

Personal Information You Provide

We collect personal information that you voluntarily provide to us when you express interest in our services, contact us, or participate in activities on our website. This may include:

• Name and contact information (email address, phone number)
• Firm name and business information
• Practice area and location details
• Marketing goals and budget information
• Any information you provide in forms or communications

Automatically Collected Information

When you visit our website, we automatically collect certain information about your device and browsing activity, including:

• IP address and browser type
• Pages visited and time spent on our site
• Referring website or source
• Device information and operating system

This information is collected through cookies and similar tracking technologies to improve our services and understand user behavior.

Section 03

How Do We Process Your Information?

We process your personal information for the following purposes:

• To respond to your inquiries and provide requested information
• To deliver marketing services and manage client relationships
• To send administrative communications and service updates
• To analyze website performance and improve user experience
• To comply with legal obligations and protect our rights
• To detect, prevent, and address fraud or security issues

We process your information based on your consent, our legitimate business interests, contractual necessity, and legal compliance requirements.

Section 04

When and With Whom Do We Share Your Information?

We may share your personal information in the following situations:

• Service Providers: With third-party vendors who perform services on our behalf (Google Analytics, Google Ads, Microsoft Clarity for product analytics and session replay, Cloudflare, Twilio for messaging, Resend for email, Vercel for hosting, Sanity for content management, and Supabase for application data)
• Business Transfers: In connection with any merger, acquisition, or sale of company assets
• Legal Requirements: When required by law, subpoena, or government request
• Consent: With your explicit consent for specific purposes

We do not sell your personal information for money. However, our use of analytics and advertising cookies and pixels may be considered a 'sale' or 'share' for cross-context behavioral advertising under California law (CPRA); you can opt out at any time using the 'Do not sell or share my info' or 'Cookie preferences' links in our website footer (we also honor the Global Privacy Control signal). We require all service providers to maintain the confidentiality and security of your information.

Section 05

Google User Data (Connected Google Accounts)

If you use the GavelGrow platform (app.gavelgrow.com), you can choose to connect Google services that belong to your firm — Google Search Console, Google Analytics 4, Google Ads (including Local Services Ads), and Google Calendar — through Google's own sign-in and consent screen. Nothing is connected unless you complete that screen. This section explains what we access when you do, how we use it, and how to stop.

What we access, and only with your permission

• Google Search Console (read-only): the search performance of the website property you choose — clicks, impressions, average position, and your top queries and pages.
• Google Analytics 4 (read-only): traffic and conversion reports for the property you choose — sessions, users, engaged sessions, key events, channels, landing pages, and traffic sources, including visits that arrive from AI assistants.
• Google Ads and Local Services Ads: campaign names, spend, and performance for the ad accounts you choose, and lead details delivered through Local Services Ads. If you turn on Smart Conversions, we also send conversion events (a new lead or a signed case, carrying a Google click identifier or hashed contact details) back to your own Google Ads account, so Google can optimize your bidding toward signed cases.
• Google Calendar: reading and creating events on the calendar you choose, so consultations booked in GavelGrow appear on your calendar and vice versa.
• Basic account profile (name and email address): only to show you which Google account is connected.

How we use it

Only to provide the feature you connected it for: showing your own Search Console, Analytics, and Ads data inside your GavelGrow dashboard and reports; alerting you to unusual changes in that data; matching your ad spend to your leads and signed cases; and keeping your calendar in sync. We do not use Google user data to build advertising profiles, to serve ads, to train machine-learning or AI models, or for any purpose unrelated to the feature you connected. Some features use an AI model operated by a service provider (Anthropic) to draft text for you — for example, a suggested reply to a Local Services lead. The provider processes that text only to produce the draft and does not use it to train its models.

How we store and protect it

Search Console and Analytics reports are fetched from Google each time you open the page and are not stored in our database. Google Ads campaign metrics, Local Services leads, and calendar events are stored in your GavelGrow account so they can be shown alongside your other firm data. The access and refresh tokens Google issues are encrypted at rest (AES-256-GCM), are never shown in the product, and are used only by our servers to call Google on your behalf over encrypted connections.

Who can see it

We do not sell Google user data, share it with third parties for advertising, or transfer it to data brokers. Our hosting and database providers (Vercel and Supabase) process it on our behalf under contract and only to run the service. No GavelGrow employee reads your Google user data except (a) with your explicit permission, to help you with a support request, (b) when necessary for security or to investigate abuse, or (c) when required by law.

How to disconnect or delete it

You can disconnect any Google service at any time in Settings → Integrations inside the platform. Disconnecting deletes the stored tokens for that service immediately, so GavelGrow can no longer read it. To also withdraw GavelGrow's permission on Google's side, remove GavelGrow under Third-party apps & services in your Google Account (myaccount.google.com/permissions); that removes it for every connected service at once. Ads metrics, leads, and calendar events already stored in your account remain there until you delete them or close your account, and you can ask us to delete them at any time using the contact details below. You can also remove GavelGrow's access directly from your Google Account at myaccount.google.com/permissions.

Limited Use

GavelGrow's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Read the Google API Services User Data Policy

Section 06

SMS / Text Message Communications

If you opt in to receive text messages from GavelGrow or a subscribing law firm operating through our platform, we collect your mobile phone number, opt-in timestamp and method, and the content of messages you send to or receive from us.

No Sharing for Marketing

We do not sell, rent, or share mobile phone numbers or SMS opt-in data with third parties or affiliates for their own marketing purposes. Phone numbers and SMS opt-in data are used solely to deliver the messages you have consented to receive and to operate the SMS program (for example, routing messages through our carrier aggregator, Twilio).

How to Opt Out

You can opt out of SMS at any time by replying STOP to any message. Additional opt-out keywords accepted: UNSUBSCRIBE, END, QUIT, CANCEL. Reply HELP for support.

Message and data rates may apply. Message frequency varies. For full details, see our SMS Terms of Service at gavelgrow.com/sms-terms.

Section 07

How Long Do We Keep Your Information?

We retain your personal information only for as long as necessary to fulfill the purposes outlined in this Privacy Policy, unless a longer retention period is required by law.

• Client information: Retained for the duration of our relationship and up to 7 years after for legal and tax purposes
• Inquiry information: Retained for up to 2 years if no client relationship is established
• Website analytics: Retained for up to 26 months as permitted by Google Analytics
• Marketing communications: Until you unsubscribe or request deletion

When we no longer need your information, we will securely delete or anonymize it.

Section 08

How Do We Protect Your Information?

We implement appropriate technical and organizational security measures to protect your personal information, including:

• Encryption of data in transit and at rest
• Secure server infrastructure with regular security updates
• Access controls limiting who can view your information
• Regular security audits and vulnerability assessments
• Employee training on data protection and confidentiality

However, no method of transmission over the internet is 100% secure. While we strive to protect your information, we cannot guarantee absolute security.

Section 09

What Are Your Privacy Rights?

Depending on your location, you may have the following rights regarding your personal information:

• Access: Request a copy of the personal information we hold about you
• Correction: Request correction of inaccurate or incomplete information
• Deletion: Request deletion of your personal information
• Opt-Out: Unsubscribe from marketing communications at any time
• Portability: Request transfer of your data in a machine-readable format
• Objection: Object to processing of your information for certain purposes

To exercise these rights, email [email protected], call (888) 384-9891, or write to us at the postal address in this policy. We will respond to your request within 30 days.

Section 10

Cookies and Tracking Technologies

We use cookies and similar tracking technologies to enhance your experience on our website:

• Essential Cookies: Required for website functionality
• Analytics Cookies: Help us understand how visitors use our site, including which pages are useful (Google Analytics) and where visitors get stuck (Microsoft Clarity session replay and heatmaps)
• Marketing Cookies: Used for advertising and remarketing campaigns (Google Ads, Meta Pixel, LinkedIn Insight, Reddit, Outbrain)
• Preference Cookies: Remember your settings and preferences

Microsoft Clarity: We use Microsoft Clarity to understand how visitors use and interact with our website through behavioral metrics, heatmaps, and session replay, which helps us improve our products and services. This data is captured using first- and third-party cookies and other tracking technologies. Clarity runs only after you allow analytics cookies (it stays off for EU, EEA, and UK visitors until they opt in, and you can opt out at any time via the footer cookie controls). Microsoft may also use the data it collects for its own product improvement and advertising. For details, see the Microsoft Privacy Statement at https://www.microsoft.com/privacy/privacystatement.

Non-essential cookies are governed by our region-aware consent model (see 'Notice at Collection' above): opt-in for the EU, EEA, and UK; opt-out for the United States and elsewhere. You can change your choice at any time via the 'Cookie preferences' or 'Do not sell or share my info' links in our footer, through your browser settings, or via the Global Privacy Control (GPC) signal, which we honor as an opt-out for U.S. visitors. Disabling cookies may affect website functionality.

Section 11

Do We Collect Information From Minors?

We do not knowingly collect personal information from individuals under 18 years of age. Our services are directed to legal professionals and law firms. If we learn we have collected information from a minor, we will delete it promptly. If you believe we have information from a minor, contact us immediately.

Section 12

Do We Make Updates to This Policy?

We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or business operations. The updated version will be indicated by a revised 'Last Updated' date at the top of this policy.

If we make material changes, we will notify you by email (if you have provided one) or by posting a prominent notice on our website. We encourage you to review this policy periodically.