What we collect, and what we leave alone.

Who we are

Candor is software for law firms that records how the firm uses AI. Candor is not a law firm and does not give legal advice. "We" and "us" on this page mean Candor.

On this website

• Server logs. Our website host, Vercel, keeps standard request logs (such as IP address, browser type and the page requested) to deliver pages and protect against abuse.
• Fonts. Pages load their typefaces from Google Fonts, so your browser contacts Google when a page opens.
• Our own step counter. To see where firms lose interest, the site counts four steps: a visit, opening the start page, clicking through to checkout, and reaching the welcome page after checkout. Your browser sends only the name of the step. We keep a total per step per day and nothing else: no cookie from us, no visitor ID, no IP address, no record of which pages you read.
• Advertising measurement. If we advertise on Google, the site loads Google's tag, which uses cookies to tell Google when an ad led to a checkout or a trial. It is not loaded for browsers that send a Global Privacy Control or Do Not Track signal. When it is active, Google's own privacy policy applies to what it collects.
• The Contact form. A message you send from the Contact form, with the name, firm, firm size and email address you give, is emailed to Candor's inbox so we can reply. Candor does not store it. A copy stays in our email provider's sent log for its usual retention period and in that inbox. Messages that look like they contain client details are refused and not sent. We use your IP address only for a few minutes to stop abuse, and never store it.
• Tracker updates. If you sign up on the AI sanctions tracker for updates, we keep your email address, that you asked for tracker updates, and when you signed up, confirmed or unsubscribed. We email you once to confirm, and nothing more unless you press Confirm. Every update has a one-click unsubscribe link. We use your IP address only for a few minutes to stop abuse, and never store it.
• Starting a trial. The start page passes the plan you choose, your firm name, attorney count and email to Stripe, which runs the checkout. The form's contents are never sent to our step counter.

If we emailed you

We contact law firms about Candor using business contact details the firm or the lawyer has published, for example on a firm website or a bar directory. We keep those details, and notes about our conversations, in our own outreach records. We use AI tools to help draft outreach, and those tools may process the business details we hold about your firm. If you would rather not hear from us, reply or email us and we will remove you.

When your firm uses Candor

Your account

People sign in through Clerk, our sign-in provider, which holds each person's name, email address and sign-in details. Candor stores each person's role at the firm (staff, attorney or administrator).

The record

Candor keeps the firm's record of AI use: which matter, which tool, what kind of task, who did it and when, plus the firm's sign-offs, policies and acknowledgments, client consent records and verification results. The record is append-only, so entries are never edited or deleted in place, and it is sealed so that tampering is detectable. By default Candor records that an action happened, not its content.

What Candor does not keep

• Screened text. The confidentiality check runs in the browser. The text you screen is not uploaded or stored. We keep only that a check ran and which kinds of sensitive details it found.
• AI prompts and answers. These are not kept unless your firm turns on conversation history. If it does, the history follows the retention period your firm sets, and an administrator can delete it at any time.
• Your client list. When a firm connects a practice-management system such as Clio, Candor reads the matter list when needed and does not copy it into our storage. If the firm turns on Clio write-back (off by default), Candor adds a note of each logged AI use (tool, task, who, when; never a prompt or an answer) to the matching Clio matter, under the person's own Clio login.

Services Candor calls for you

• Your firm's own AI model. Candor uses the AI account your firm connects, with your firm's own key. The key is stored encrypted and used only to make your firm's calls. What that provider does with a request is governed by your firm's agreement with it.
• CourtListener. To check a case citation, Candor sends only the bare citation string (for example, "410 U.S. 113") to CourtListener, run by the Free Law Project. It never sends case names, the surrounding text, client names or matter names.
• Cornell and the GPO. To check a statute, Candor sends only the U.S. Code title and section number (for example, "42" and "1983") to the Legal Information Institute at Cornell Law School, and, when enabled, to the U.S. Government Publishing Office's govinfo service.

The Firm AI Risk Assessment

The optional fourteen-day assessment is aggregate by design. Its records carry no person, device or matter, so its results cannot be traced to any individual at the firm.

What we see

The tools we use to operate Candor show counts, such as how many entries and paired browsers a firm has and whether its record's seal verifies. They do not show what your firm wrote.

If you contact us from the app

The Help page's Contact Candor form sends your message, your name, your firm and the reply address you give to our own inbox, so we can answer by email. It is checked for client details first, and a message that looks like it contains them is not sent. Candor itself keeps only that a message arrived: your firm, your name, the topic and the time, never the message. To have your emails with us deleted, ask and we will.

Billing

Stripe handles payment. We never see or store card numbers. We keep the email, plan, firm name and attorney count from checkout, and Stripe's reports of the subscription's status (for example, in trial, paid, or ended) and amounts paid.

Who helps us run Candor

• Vercel: hosts this website.
• Render: hosts the Candor software and its database, in the United States.
• Clerk: sign-in, and the invitation emails a firm administrator sends to add people to the firm.
• Stripe: payments.
• Resend: delivers Candor's email. It sends our own internal note that a firm has signed up (the firm name as entered at signup, plan, attorney count, signup time, whether the workspace was set up automatically, and Candor's and Stripe's reference numbers for the signup; never the buyer's name or email), the welcome email and setup, trial and billing reminders to the person who signed up, which carry their email address and the sign-in link, nothing else, the confirmation email to anyone who asks for AI sanctions tracker updates, messages people send us from the app's Help page, and messages from the site's Contact form (both delivered to our inbox).
• Google: our email, the website's fonts, and advertising measurement when we advertise.
• Free Law Project (CourtListener): case citation lookups, as described above.
• Legal Information Institute (Cornell Law School) and the U.S. Government Publishing Office (govinfo, when enabled): statute lookups, as described above.
• AI providers: your firm's chosen model for its own work in Candor; for our own outreach drafting, the providers we use.

We do not sell personal information, we do not use a firm's record to train AI models, and there is no advertising inside the Candor software.

Security

Data is encrypted in transit and at rest, each firm's record is kept separate from every other firm's, and access follows least privilege. The security page explains the design in more detail.

How long we keep things, and deleting them

• While your firm has an account, we keep its record, including after a free trial ends. A firm whose trial or subscription has ended can still open, read and export everything; it just cannot add new entries until it pays.
• Export anytime. Any firm can export everything Candor holds for it, at any time, without asking.
• Deletion. Because the record is append-only, the software cannot delete it by itself. Email us from an administrator's address and we will delete your firm's record and account and confirm in writing. Copies in our hosting provider's automatic backups expire on its schedule, currently seven days.
• Outreach records are kept until you ask us to remove them or they are no longer useful to us.
• Tracker updates. Unsubscribing takes one click and takes effect at once. We keep a note that the address unsubscribed, so we never email it again by mistake. To have the address removed entirely, email us and we will.

Your choices and rights

You can ask us what we hold about you, ask us to correct it, or ask us to delete it. Depending on where you live, the law may give you further rights; tell us what you are asking for and we will honor the rights that apply. Browsers that send Global Privacy Control or Do Not Track are not shown Google's advertising tag.

Children

Candor is a business tool for law firms and is not directed at children.

Changes

If we change this policy, we will update the date at the top. If a change affects how we handle a firm's record, we will tell the firm's administrators before it takes effect.

Contact

Email jesse@candor.legal.