Privacy Policy

1. Scope and Applicability

This Privacy Policy ("Policy") applies to the website located at courtcounsel.ai, the CourtCounsel mobile application, and all related services, features, and tools (collectively, the "Platform") operated by HBZ Holdings, LLC, a Florida limited liability company doing business as CourtCounsel ("CourtCounsel," "Company," "we," "us," or "our").

This Policy applies to all individuals who access or use the Platform, including:

• Attorneys — licensed attorneys who register on the Platform to accept and fulfill court appearance requests;
• Clients — law firms, AI legal services companies, solo practitioners, and other organizations that post court appearance requests;
• Visitors — individuals who browse the Platform without creating an account; and
• Applicants — attorneys or organizations who apply to join the Platform but have not yet been approved.

By accessing or using the Platform, you acknowledge that you have read, understood, and agree to this Policy. If you do not agree, you must not access or use the Platform.

2. Information We Collect

2.1 Information You Provide Directly

Account Registration Information

• Full legal name
• Email address
• Phone number
• Mailing address and business address
• Username and password (passwords are stored only in hashed form)

Attorney-Specific Information

• Bar license number(s) and jurisdiction(s) of admission
• Date of bar admission for each jurisdiction
• Current bar standing and disciplinary history
• Professional malpractice insurance policy details (carrier, policy number, coverage limits, expiration date)
• Professional resume, areas of practice, and courthouse familiarity
• Government-issued photo identification for identity verification
• Social Security Number or Tax Identification Number (for 1099 tax reporting and identity verification)
• Bank account or payment information (for receiving appearance fees via Stripe Connect)
• Professional headshot and biography
• Availability schedule and geographic service area

Client-Specific Information

• Firm or organization name and type of entity
• Business registration information
• Billing contact and authorized representative information
• Payment method details (credit card, ACH; stored and processed by Stripe)
• Case information submitted with appearance requests (case number, court, hearing type, case materials)

Communications and Correspondence

• Messages exchanged through the Platform between Attorneys and Clients
• Customer support inquiries and correspondence
• Contact form submissions
• Newsletter subscription information
• Survey responses and feedback

2.2 Information Collected Automatically

When you access the Platform, we automatically collect certain technical and usage information, including:

• IP address and approximate geographic location derived from IP
• Device identifiers, device type, operating system, and browser type and version
• Pages viewed, features used, links clicked, and time spent on each page
• Referring URL and exit pages
• Date and time stamps of Platform access
• Mobile device identifiers (if accessing via mobile application)
• Crash reports and performance data

2.3 Information from Third Parties

We may receive information about you from third-party sources, including:

• State bar associations and legal regulatory bodies: Bar license status, disciplinary actions, and standing verification
• Background check providers (Checkr, Inc.): Criminal background check results, identity verification, and sanctions screening (see Section 9)
• Stripe, Inc.: Payment processing status, transaction history, and identity verification for connected accounts
• Malpractice insurance carriers: Policy verification, coverage confirmation, and lapse notifications
• Publicly available sources: Public court records, professional directory listings, and state bar public records

2.4 Sensitive Information

Certain information we collect may be considered sensitive, including Social Security Numbers, government-issued identification, financial account information, and background check results. We collect sensitive information only when strictly necessary for identity verification, tax compliance, payment processing, or platform safety. Sensitive information is subject to enhanced security protections as described in Section 10.

3. How We Use Your Information

We use collected information for the following purposes:

3.1 Platform Operations

• Creating and managing user accounts
• Matching Attorneys with appearance requests based on location, jurisdiction, availability, courthouse familiarity, practice area, and ratings
• Facilitating communication between Attorneys and Clients regarding appearance details
• Processing payments from Clients and disbursing appearance fees to Attorneys via Stripe Connect
• Generating and delivering post-appearance Outcome Reports
• Managing the attorney review and rating system

3.2 Verification and Trust

• Verifying Attorney bar license status and good standing on an ongoing basis
• Confirming active malpractice insurance coverage
• Conducting background checks on Attorney applicants through Checkr
• Verifying identity to prevent fraud and unauthorized access
• Monitoring compliance with Platform policies and professional conduct standards

3.3 Communications

• Sending transactional emails and notifications (appearance confirmations, payment receipts, Outcome Report delivery)
• Providing customer support and responding to inquiries
• Sending administrative notices regarding policy changes, system updates, or security alerts
• Sending marketing communications (only with your opt-in consent; you may unsubscribe at any time)

3.4 Platform Improvement and Analytics

• Analyzing usage patterns to improve matching algorithms and platform features
• Conducting aggregate statistical analysis (no individual identification)
• Monitoring platform performance, uptime, and error resolution
• Developing new features and services

3.5 Legal and Compliance

• Complying with applicable federal, state, and local laws and regulations
• Complying with IRS reporting requirements (1099-NEC forms for Attorney payments)
• Responding to valid legal process (subpoenas, court orders, government requests)
• Protecting against fraudulent, unauthorized, or illegal activity
• Enforcing our Terms of Service and resolving disputes

4. How We Share Your Information

We do not sell, rent, or trade your personal information to third parties for their marketing purposes. We share your information only in the following circumstances:

4.1 Between Platform Users

When an Attorney accepts an appearance request, we share certain information between the parties to facilitate the engagement:

• Shared with Clients about Attorneys: Name, bar number(s), jurisdictions of admission, bar standing status, malpractice insurance verification status (not full policy details), courthouse familiarity ratings, professional biography, overall rating and review history, and contact information for coordination.
• Shared with Attorneys about Clients: Firm or organization name, case information and materials necessary for the appearance, hearing details (court, judge, date, time, case number), billing contact information, and specific instructions for the appearance.

Case-specific information is shared only with the specific Attorney assigned to that appearance and is not visible to other Platform users.

4.2 With Service Providers

We share information with third-party service providers who perform services on our behalf, subject to contractual obligations of confidentiality and data protection. See Section 5 for a detailed list of service providers.

4.3 With Bar Associations and Regulatory Bodies

We may share Attorney information with state bar associations and legal regulatory bodies as required for license verification and in response to ethics inquiries or disciplinary proceedings. We may also report suspected violations of professional conduct rules to the appropriate disciplinary authority.

4.4 For Legal Compliance

We may disclose information when required by law, regulation, legal process, or enforceable governmental request, including:

• Subpoenas, court orders, or search warrants
• Government regulatory investigations
• Requests from law enforcement where we reasonably believe disclosure is necessary to prevent harm
• Tax reporting requirements (IRS Form 1099-NEC)

4.5 Business Transfers

In the event of a merger, acquisition, reorganization, bankruptcy, or sale of all or a portion of our assets, your information may be transferred as part of the transaction. We will notify you of any such transfer and any choices you may have regarding your information.

4.6 With Your Consent

We may share information with third parties when you have given us explicit consent to do so.

5. Third-Party Service Providers

We engage the following categories of third-party service providers who may receive your personal information:

Provider	Purpose	Data Shared
Stripe, Inc.	Payment processing, marketplace payouts via Stripe Connect, identity verification, fraud prevention	Name, email, bank account details, SSN/TIN (for Attorneys), payment card information (for Clients), transaction data
Checkr, Inc.	Criminal background checks, identity verification, sanctions screening for Attorney applicants	Name, date of birth, SSN, address, government ID
Vercel, Inc.	Website hosting and content delivery	IP address, browser data, usage analytics
Google LLC (Analytics)	Website analytics and usage tracking	IP address (anonymized), device information, browsing behavior
Cloud infrastructure providers	Application hosting, data storage, database hosting	All data stored on the Platform (encrypted at rest)
Email service providers	Transactional and marketing email delivery	Email address, name, email content
Customer support tools	Help desk and support ticket management	Name, email, support correspondence

Each service provider is bound by data processing agreements that restrict their use of your information to the specific services they perform for us. We do not permit service providers to use your personal information for their own marketing or other purposes.

6. Attorney Data vs. Client Data

Due to the nature of our legal marketplace, we process Attorney data and Client data differently:

6.1 Attorney Data

Attorney data undergoes more extensive processing because of verification, compliance, and trust requirements. This includes:

• Ongoing bar license monitoring: We periodically re-verify bar status with state bar associations throughout your registration on the Platform.
• Insurance monitoring: We track malpractice insurance expiration dates and request proof of renewal.
• Public profile visibility: Certain Attorney information (name, jurisdictions, courthouse familiarity, rating, biography) is visible to Clients on the Platform. You may control which optional information is displayed in your profile settings.
• Performance data: We track appearance completion rates, Outcome Report timeliness, Client ratings, and cancellation history to maintain marketplace quality.
• Tax reporting: Attorney payment information is reported to the IRS as required for independent contractor payments (Form 1099-NEC).

6.2 Client Data

Client data is processed primarily for account management, billing, and case facilitation:

• Billing data: Payment methods are tokenized and stored by Stripe; CourtCounsel does not store full credit card numbers.
• Case information: Case materials uploaded to the Platform are shared only with the assigned Attorney and are not used for any purpose other than facilitating the specific appearance.
• Usage data: We track appearance volume, spend history, and attorney preferences to improve service recommendations.

7. Confidentiality of Case Information and Outcome Reports

We recognize that case information and Outcome Reports contain highly sensitive legal materials that may be subject to attorney-client privilege and work product protections. We implement the following safeguards:

• Case materials and Outcome Reports are encrypted in transit (TLS 1.3) and at rest (AES-256).
• Access to case information is restricted to the specific Client and Attorney involved in that appearance through role-based access controls.
• CourtCounsel personnel do not access case-specific legal content except when necessary to resolve a formal dispute between parties, and then only to the minimum extent required.
• Outcome Reports are retained in encrypted form and are accessible only to the parties to that appearance.
• Attorneys on the Platform are independently bound by their professional obligations of confidentiality under applicable rules of professional conduct (including ABA Model Rule 1.6 and state equivalents).
• Case information is never used for machine learning training, aggregate analytics, or any purpose beyond facilitating the specific requested appearance.
• CourtCounsel does not assert any ownership interest in case materials or Outcome Reports.

8. Attorney Credential Verification Disclaimers

Regarding our verification processes:

• Bar license verification confirms that an attorney holds an active license as reported by the relevant state bar association at the time of verification. Bar status may change between verification periods.
• Malpractice insurance verification confirms that an attorney has provided documentation of a malpractice insurance policy meeting our minimum coverage requirements. CourtCounsel does not independently audit insurance policies or guarantee their validity or sufficiency for any particular matter.
• Background check results reflect information available in public records databases at the time of the check and are subject to the limitations and disclaimers of our background check provider (Checkr, Inc.).
• Verification is conducted at the time of onboarding and periodically thereafter but is not continuous or real-time. There may be gaps between a change in an Attorney's credentials and CourtCounsel's awareness of that change.
• Clients are encouraged to independently verify Attorney credentials for any appearance involving matters of significant complexity or exposure.

9. Background Checks

As part of the Attorney onboarding process, CourtCounsel may conduct background checks through Checkr, Inc., a consumer reporting agency regulated under the Fair Credit Reporting Act ("FCRA"), 15 U.S.C. § 1681 et seq. These checks may include:

• Criminal history record search (federal, state, and county levels)
• Sex offender registry search
• Government sanctions and watch list screening (OFAC, OIG, SAM)
• Identity verification

Attorneys are notified before a background check is initiated and must provide written authorization as required by the FCRA. If adverse information is discovered that may affect an applicant's eligibility, CourtCounsel will:

1. Provide a pre-adverse action notice to the applicant, including a copy of the consumer report and a summary of rights under the FCRA;
2. Allow the applicant a reasonable period (at least five business days) to dispute the accuracy or completeness of the information;
3. Make a final determination only after the dispute period has elapsed.

Background check reports are not shared with Clients. Only the verification outcome (approved or not approved) is reflected in the Attorney's Platform status.

10. Data Security

We implement comprehensive technical and organizational security measures designed to protect your information, including:

10.1 Technical Safeguards

• TLS 1.3 encryption for all data in transit
• AES-256 encryption for data at rest, including database encryption and encrypted backups
• Secure password storage using bcrypt hashing with per-user salts
• Multi-factor authentication (MFA) available for all accounts and required for administrative access
• Role-based access controls (RBAC) limiting data access to authorized personnel and Platform users
• Web application firewall (WAF) and DDoS protection
• Regular automated vulnerability scanning and third-party penetration testing
• Intrusion detection and monitoring systems
• Automated alerts for unusual access patterns or potential security events

10.2 Organizational Safeguards

• Employee and contractor confidentiality agreements and security training
• Principle of least privilege for all internal access to user data
• Documented incident response plan with defined notification procedures
• Regular security audits and access reviews
• Secure software development lifecycle practices
• Vendor security assessments for all third-party service providers

10.3 PCI Compliance

Payment card information is processed exclusively by Stripe, a PCI DSS Level 1 certified service provider. CourtCounsel does not store, process, or transmit payment card data on our own servers.

10.4 Breach Notification

In the event of a data breach that compromises the security of your personal information, we will notify affected individuals and applicable regulatory authorities as required by the Florida Information Protection Act (Fla. Stat. § 501.171), the CCPA, and any other applicable breach notification laws, within the timeframes required by such laws (generally not later than thirty (30) days after discovery).

No Guarantee: Despite our efforts, no method of transmission over the Internet or method of electronic storage is 100% secure. We cannot and do not guarantee the absolute security of your information.

11. Data Retention and Deletion

11.1 Retention Periods

Data Category	Retention Period	Legal Basis
Active account data	Duration of account + 2 years after deletion request	Contractual necessity, dispute resolution
Appearance records and Outcome Reports	7 years from appearance date	Legal record-keeping; statute of limitations for malpractice claims (Fla. Stat. § 95.11)
Payment and transaction records	7 years from transaction date	IRS record-keeping requirements (26 U.S.C. § 6501)
Attorney credential verification records	Duration of account + 7 years	Regulatory compliance, liability protection
Background check authorization and results	5 years from date of check	FCRA compliance, EEOC guidance
Platform communications (messages)	3 years from message date	Dispute resolution, quality assurance
Marketing consent records	Duration of consent + 3 years after withdrawal	Compliance documentation (CAN-SPAM, TCPA)
Server logs and analytics data	13 months	Security monitoring, platform improvement
Cookie and tracking data	Per cookie policy (max 13 months)	Analytics, session management

11.2 Deletion Requests

You may request deletion of your personal information by emailing privacy@courtcounsel.ai. We will acknowledge your request within ten (10) business days and complete processing within thirty (30) days, subject to the following limitations:

• We may retain information necessary to comply with legal obligations (tax records, court orders, regulatory requirements).
• We may retain information necessary to complete pending transactions or resolve open disputes.
• We may retain information necessary to detect and prevent fraud or enforce our Terms of Service.
• Appearance records and Outcome Reports may be retained for the full retention period even after account deletion, due to legal record-keeping requirements and the legitimate interests of the other party to the appearance.
• De-identified or aggregated data that cannot reasonably be used to identify you may be retained indefinitely for statistical purposes.

11.3 Account Deactivation vs. Deletion

You may deactivate your account at any time through your account settings. Deactivation removes your profile from public visibility but retains your data in our systems. Full deletion requires a written request to privacy@courtcounsel.ai and is subject to the retention limitations described above.

12. Cookies, Tracking, and Analytics

12.1 Types of Cookies Used

• Strictly Necessary Cookies: Required for Platform functionality (session management, authentication, security tokens, CSRF protection). These cannot be disabled without impairing Platform use.
• Performance and Analytics Cookies: Help us understand how users interact with the Platform (page views, navigation patterns, error rates). We use Google Analytics with IP anonymization enabled.
• Functional Cookies: Remember your preferences and settings (language, display preferences, timezone).
• Marketing Cookies: Used to deliver relevant advertising and measure campaign effectiveness. Marketing cookies are only set with your explicit opt-in consent.

12.2 Managing Cookies

You can control cookies through your browser settings. Most browsers allow you to block or delete cookies. However, blocking strictly necessary cookies may impair Platform functionality. You may also opt out of Google Analytics by installing the Google Analytics Opt-out Browser Add-on.

12.3 Other Tracking Technologies

We may use pixel tags, web beacons, and similar technologies in emails and on the Platform to measure engagement and improve our services. You can prevent email tracking by disabling image loading in your email client.

13. Your Privacy Rights

Depending on your jurisdiction, you may have some or all of the following rights regarding your personal information:

• Right to Access: Request a copy of the personal information we hold about you.
• Right to Correction: Request correction of inaccurate or incomplete personal information.
• Right to Deletion: Request deletion of your personal information, subject to legal retention requirements.
• Right to Portability: Receive your personal information in a structured, commonly used, machine-readable format.
• Right to Opt Out: Opt out of the sale or sharing of personal information (note: we do not sell personal information).
• Right to Restrict Processing: Request that we limit our processing of your information in certain circumstances.
• Right to Withdraw Consent: Withdraw consent for processing activities based on consent, at any time, without affecting the lawfulness of prior processing.
• Right to Non-Discrimination: We will not discriminate against you for exercising your privacy rights.

To exercise any of these rights, contact us at privacy@courtcounsel.ai. We will verify your identity before processing your request and respond within the timeframe required by applicable law (typically 30 to 45 days, with extensions available in complex cases upon notice to you).

14. California Privacy Rights (CCPA/CPRA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act of 2020 (collectively, "CCPA"), Cal. Civ. Code § 1798.100 et seq.:

14.1 Categories of Personal Information Collected

In the preceding twelve (12) months, we have collected the following categories of personal information as defined by the CCPA:

• Identifiers (Cal. Civ. Code § 1798.140(v)(1)(A)): Name, email, phone number, mailing address, IP address, bar license number, SSN/TIN
• Personal Information under Cal. Civ. Code § 1798.80(e): Name, address, telephone number, employment history, bank account number, insurance policy information
• Commercial Information: Transaction records, payment history, service usage patterns
• Internet/Electronic Network Activity: Browsing history, search history, interactions with Platform
• Geolocation Data: Approximate location derived from IP address
• Professional/Employment Information: Bar license, jurisdictions, malpractice insurance, practice areas, courthouse familiarity
• Sensitive Personal Information: SSN/TIN (for tax reporting), government-issued ID (for identity verification). We use sensitive personal information only for the purposes authorized by the CCPA and do not use or disclose it for inferring characteristics about you.

14.2 Sale and Sharing of Personal Information

CourtCounsel does not sell personal information as defined by the CCPA. CourtCounsel does not share personal information for cross-context behavioral advertising purposes. We have not sold or shared personal information in the preceding twelve (12) months.

14.3 Right to Limit Use of Sensitive Personal Information

You have the right to limit our use of your sensitive personal information to purposes necessary to provide the services you request. Because we only use sensitive personal information for permitted business purposes (identity verification, tax compliance, and fraud prevention), no additional limitation is necessary, but you may submit a request to confirm this at any time.

14.4 Authorized Agent

You may designate an authorized agent to submit a privacy request on your behalf. The agent must provide a written authorization signed by you, and we may require you to directly verify your identity with us before processing the agent's request.

14.5 Financial Incentives

We do not offer financial incentives or price differences in exchange for the collection, retention, sale, or deletion of personal information.

15. Florida Privacy Rights

CourtCounsel is headquartered in St. Petersburg, Florida. Florida residents may have additional rights under the Florida Digital Bill of Rights (FDBR), Fla. Stat. § 501.701 et seq., effective July 1, 2024, if they meet the statute's threshold requirements. These rights include:

• The right to confirm whether we are processing your personal data
• The right to access your personal data
• The right to correct inaccuracies in your personal data
• The right to delete personal data we have collected from or about you
• The right to obtain a copy of your personal data in a portable, readily usable format
• The right to opt out of the processing of personal data for purposes of targeted advertising, the sale of personal data, or profiling in furtherance of decisions that produce legal or similarly significant effects

To exercise these rights, contact us at privacy@courtcounsel.ai. We will respond within forty-five (45) days as required by the FDBR. You may appeal a decision regarding your request by contacting us at the same address; we will respond to your appeal within sixty (60) days.

16. International Users and GDPR

CourtCounsel is based in the United States and our Platform is currently designed for use within the United States. If you access the Platform from outside the United States, you understand and consent to the transfer of your information to, and storage and processing in, the United States, where data protection laws may differ from those in your country of residence.

For users in the European Economic Area (EEA), United Kingdom, or Switzerland: when we expand our services to serve international users, we will implement appropriate safeguards for cross-border data transfers, including Standard Contractual Clauses (SCCs) approved by the European Commission or equivalent transfer mechanisms. At that time, we will update this Policy with detailed GDPR-specific disclosures, including:

• Lawful bases for processing under Article 6 and Article 9 of the GDPR
• Data Protection Officer (DPO) contact information
• Procedures for filing complaints with supervisory authorities
• Data Protection Impact Assessment (DPIA) results where applicable

17. Children's Privacy

The Platform is a professional marketplace intended exclusively for use by licensed attorneys and authorized legal organizations. The Platform is not directed to individuals under the age of eighteen (18), and we do not knowingly collect personal information from anyone under 18. If we discover that we have inadvertently collected information from a person under 18, we will delete that information promptly. If you believe a child under 18 has provided personal information to us, please contact us immediately at privacy@courtcounsel.ai.

18. Do Not Track Signals

Some web browsers transmit "Do Not Track" (DNT) signals to websites. Because there is no universally accepted standard for interpreting DNT signals, we do not currently alter our data collection and use practices in response to DNT signals. We will update this Policy if a uniform industry standard for DNT is adopted in the future.

19. Third-Party Links and Integrations

The Platform may contain links to third-party websites, services, or integrations that are not operated by CourtCounsel. This includes, without limitation, links to state bar association websites, court electronic filing systems, Stripe payment pages, and other external resources. We are not responsible for the privacy practices, security, or content of these third-party services. We encourage you to review the privacy policies of any third-party services before providing them with your personal information.

20. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. When we make material changes, we will:

• Update the "Effective Date" and "Last Updated" dates at the top of this page
• Post a prominent notice on the Platform for at least thirty (30) days
• Send email notification to all registered users for material changes that affect how we collect, use, or share personal information

Your continued use of the Platform after changes become effective constitutes your acceptance of the revised Policy. If you do not agree with the revised Policy, you must stop using the Platform and may request deletion of your account as described in Section 11.

21. Contact Information and Data Protection Inquiries

For questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

CourtCounsel (a product of HBZ Holdings, LLC)
Attn: Privacy and Data Protection
7901 4th St N STE 300
St. Petersburg, FL 33702
Email: privacy@courtcounsel.ai
General Inquiries: info@courtcounsel.ai

We aim to respond to all privacy inquiries within thirty (30) days of receipt. For CCPA-specific requests, you may also submit requests through our online privacy request form at courtcounsel.ai/privacy-request (available upon Platform launch).