This is version 2026-10-10-web-form, which takes effect October 16, 2026. Version 2026-10-05-r5, effective October 6, 2026, is the one in effect now; version 2026-10-07-home-services takes effect October 16, 2026, then version 2026-10-07-towing takes effect October 16, 2026, then version 2026-10-08-msft-site takes effect October 16, 2026, then version 2026-10-08-small-business takes effect October 16, 2026, then version 2026-10-09-site-demo-link takes effect October 16, 2026, then version 2026-10-09-headline-test takes effect October 16, 2026, then version 2026-10-09-sample-call-email takes effect October 16, 2026, then version 2026-10-09-signup-trail takes effect October 16, 2026, then version 2026-10-09-visitor-request takes effect October 16, 2026, then version 2026-10-09-form-events takes effect October 16, 2026, then version 2026-10-09-one-tap takes effect October 16, 2026, then version 2026-10-09-video-play takes effect October 16, 2026, then version 2026-10-09-leave-question takes effect October 16, 2026, then version 2026-10-09-demo-web-call takes effect October 16, 2026, then version 2026-10-09-hero-cta-test takes effect October 16, 2026, then version 2026-10-09-chat-voice takes effect October 16, 2026, then version 2026-10-09-after-hours-line takes effect October 16, 2026, then version 2026-10-09-engaged takes effect October 16, 2026, then version 2026-10-10-dead-click takes effect October 16, 2026.

Privacy Policy

Effective date: 2026-09-23 Last updated: 2026-10-10

Scope — who this policy covers

"Intake Gateway", "we" and "us" mean Intake Gateway LLC, a New Mexico limited liability company.

This policy covers three different groups of people, because the Service touches all three:

Firms and their authorized users — the law firms, home-services businesses, towing businesses and other small businesses who subscribe to Intake Gateway and the people at those firms who log into the dashboard. For this data, Intake Gateway is the data controller (we decide why and how we process it, to run and bill for the Service).
Callers, and visitors who use a Firm's website chat or contact form — people who call a Firm's phone number, or who write to the chat a Firm has placed on its own website, and are answered by the Service on that Firm's behalf, and people who send a Firm's own website contact form that the Firm has connected to the Service. For this data, the Firm is the data controller (it's their prospective-client relationship) and Intake Gateway acts as the Firm's data processor / service provider, under the terms of our Data Processing Addendum. If you are a caller, or a visitor who used a Firm's chat, with a question about your own call or chat, your fastest path is to contact that Firm directly — they hold the underlying relationship and can instruct us on your request. You can also reach us at the contact below and we will forward your request to the relevant Firm, which is responsible for deciding on it and responding to you. Our caller-request page does the same without waiting on us (see "From visitors to our public site" below).
Callers to our public demonstration line. We operate one: its number is published on our own website so that anyone can hear how the Service works, that line is ours rather than a Firm's, and Intake Gateway is the data controller for those calls. Our website's "Talk to it now" button reaches the same line from your browser, using your microphone once you allow it; such a call is handled like any other call to that line, except that no phone number exists to keep or to send the example email to. To limit how many such calls one address can start, we keep your IP address and delete it within two days. It says at the start that it is a demonstration and that anyone who needs a lawyer should call a law firm directly; it is not connected to any real Firm, it never creates a lead, nothing said on it reaches a Firm, and no attorney-client relationship can arise from it. The one copy that leaves us is the example of what a Firm would have received, emailed to someone who asks for it on our site with the number the call came from, the short code the line reads out at the end of that call, and an email address (see "From visitors to our public site"). Those calls are recorded and disclosed as such like any other, and nobody should use that line to describe a real legal matter. We delete each such call's recording, transcript and intake details, and the number it came from, 48 to 72 hours after the call (unless a legal hold requires us to keep a particular call, in which case when the hold ends); the call's record of times, duration and outcome stays 13 months.

The same goes for our demonstration chat. On our own site, at an address we publish for it, you can also try the Service by typing to the same demonstration firm. That chat is ours rather than a Firm's, and Intake Gateway is the data controller for it. It opens with a written notice, which you must accept to start, saying that it is a demonstration, that it is an AI assistant and not a lawyer, and that anyone who needs a lawyer should contact a law firm directly (the notice names the demonstration firm, Example Injury Law (Demo), which is ours, as the one that saves what you write); it is not connected to any real Firm, it never creates a lead, nothing typed in it reaches a Firm, and no attorney-client relationship can arise from it. We keep the messages you type and the assistant's replies, any intake details you give it, which notice you accepted and when, the chat's language and times, and a one-way code made from your IP address and a shortened description of your browser; the same abuse limits and the Cloudflare check as on a Firm's chat apply (see "From visitors who use a Firm's website chat"), and the AI model provider that writes the replies (Google, reached through Vercel's AI Gateway) receives each message while it does, under its own terms. We delete the messages, the intake details and the one-way code 48 to 72 hours after the chat's last message, the same as the demonstration line's calls (unless a legal hold requires us to keep a particular chat, in which case when the hold ends); the chat's record of times, language, outcome, accepted notice, the page it was opened on and the model's usage counts stays for the 13 months we keep a chat's metadata. Nobody should use that chat to describe a real legal matter.

This policy is written for a US-only product (English and Spanish); we do not claim or intend GDPR applicability, though some of the structure below (controller/processor language) is industry-standard regardless of jurisdiction.

What we collect

From callers, when the Service answers a call on a Firm's behalf:

Call audio recordings and AI-generated transcripts.
Structured intake data the caller provides in response to the AI's questions: name, contact information, and details about the incident and any injuries relevant to the Firm's evaluation of a potential personal-injury or workers' compensation claim -- for a work injury, where the Firm has switched workers' compensation on, also when the employer was told, the claim's status (denied, benefits cut off or delayed), light duty or a return-to-work date, a company doctor, and any letter or hearing notice. This includes what treatment the caller says they have had -- the intake asks, because a firm evaluating a claim needs it -- so it is health-related information the caller volunteers, not merely a description of an injury. We are not a covered entity or a business associate, so HIPAA does not govern it; state health-privacy and general privacy law may.
Where the Firm has switched criminal defense on, a caller about an arrest or a criminal charge (their own or a relative's) is asked, instead of the injury questions, for the name of the person charged and the caller's relation to them, any other person named in the matter (for the Firm's conflict check), whether the person is in custody and where (with a booking number if the caller has it), the charge as the caller understands it, when and where the arrest was, the next court date and, for a DUI, whether a driver's license was taken. The intake does not ask what happened and keeps anything the caller volunteers about it out of the structured intake; the call recording and transcript still contain whatever was said. This is information about an arrest or a criminal charge, which some laws treat as sensitive.
Where the Firm has switched family law on, a caller about a divorce, custody, support or a protective order (their own or a family member's) is asked, instead of the injury questions, whether they already have a lawyer on the matter, for their name and, if the matter is someone else's, that person's name and relation to them, the other party's name (for the Firm's conflict check), whether it is safe for the Firm to call them back and to leave a message (and a safer number or time if not), what the matter is about, whether children under 18 are involved and how many (never their names), the state and county where they live, whether a case is open in court, the next hearing date and the court, and any order already in place. The intake does not ask about abuse; if a caller mentions it, a few plain words are noted in the intake summary, and the call recording and transcript contain whatever was said. This can include information about domestic violence and about children, which some laws treat as sensitive.
Where the Firm has switched other legal matters on, a caller asking for help with a new legal matter that no other intake takes (a will or an estate, a job, a home or a lease, a business or a contract, a benefits claim, a ticket and the like; their own or someone else's) is asked, instead of the injury questions, whether they already have a lawyer on the matter, for their name and, if the matter is someone else's, that person's name and relation to them, the name of any person or business on the other side (for the Firm's conflict check), what they would like the attorney's help with (noted in their words), the state and the city or county, and any coming hearing or court date, closing, or date to file, answer or move out by. For a matter about the caller's job, the caller is also asked whether the number and email they give are their own rather than work ones, and whether the Firm may leave a message; the answers are in the call recording and transcript, not in the structured intake, and the Firm alone acts on them. A child who calls is asked only for a parent's or another adult's name and number. The intake asks nothing more about the matter; the call recording and transcript contain whatever was said. What a caller says about the matter can include information about their health, finances, employment, family or a ticket or other offense, which some laws treat as sensitive.
Where the Firm has switched immigration on, a caller asking for help with an immigration matter (a visa, residency, citizenship, asylum, a petition for a family member, a work permit, removal or someone held by immigration; their own or someone else's) is asked, instead of the injury questions, whether they already have a lawyer on the matter (a notario, consultant or preparer they mention is noted in the summary in their words), for their name and, if the matter is someone else's, that person's name and relation to them, the name of any employer or petitioner (for the Firm's conflict check), whether it is safe for the Firm to call the number they give and to leave a message there (and, if not, a safer number or time), what they would like the attorney's help with (noted in their words), whether the person is held by immigration now and, if so, the facility and its city and state, the state and the city or county, and any coming hearing, interview or date to file, respond or leave by. If the caller names a criminal charge as part of the matter, the charge's name is noted in the intake summary as they said it, and nothing of what happened. A caller who says it is not safe to call or to leave a message is not asked for an email. A caller from detention is asked for someone outside who can be called back. A child who calls is asked only for a parent's or another adult's name and number. The intake never asks for anyone's immigration status, nationality, country, how or when they entered, or any immigration number, and keeps them out of the structured intake and the summary; but the call recording and transcript (or the chat transcript) contain whatever was said, which can include that information and information about past arrests, family and health, which some laws treat as sensitive. The Firm alone acts on the caller's answers about whether it is safe to call or to leave a message.
Where the Firm is a home-services business (heating and cooling, plumbing and similar trades), a caller is asked, instead of any of the questions above, for their name, the callback number, the address where the work is needed, the problem in their words, how urgent it is, a time to call back and an email address, and, where the Firm asks it, how they heard of the Firm.
Where the Firm is a towing business, a caller is asked, instead of any of the questions above, for their name, the callback number, where the vehicle is, whether they are somewhere safe, the vehicle and what happened; a time to call back or an email address is recorded only if the caller gives one.
Where the Firm is another kind of small business, a caller is asked, instead of any of the questions above, for their name, the callback number, why they are calling in their words, a time to call back and an email address.
Call metadata: phone number, timestamp, duration, and outcome (e.g. booked, callback requested, transferred, spam-flagged).

From visitors who use a Firm's website chat, where the Firm has placed it on its own site:

The messages you type and the replies the assistant writes (the chat transcript), and the same structured intake details as a call, above, if you give them. The chat takes typed text only: no files or photos. Where the Firm offers it, the chat's "Talk to us" button calls the Firm's line from your browser, using your microphone once you allow it; such a call is handled like any other call to that line, above, except that no phone number exists to keep. The IP limit described below applies to such calls too.
The written notice shown before your first message, which version of it you accepted and when; the address of the page the chat was opened on and the website it is on; and the language the chat ran in, English or Spanish, chosen from the one your browser asks for where the Firm offers Spanish.
Chat metadata: when it started and ended, its language and its outcome.
To limit how many chats one address can start and to stop abuse, a one-way code made from your IP address and a shortened description of your browser, kept with the chat, and a separate one-way code made from your IP address alone, kept with a count of chats that ended because they reached their message limit, and deleted within two days of the last such chat: three of them within 24 hours block that code from starting or continuing a chat for 24 hours. To limit how many chats one address can start in an hour and a day, we also keep your IP address, apart from the chat, and delete it within two days. Before the chat starts, the same Cloudflare check described under "From visitors to our public site" below runs in your browser.

From visitors who send a Firm's website contact form, where the Firm has connected it to the Service:

Your name, your phone number or email or both, and your message, which we keep as an intake and send to the Firm; the address of the page the form was sent from and the website it is on; and when it was sent and its language.
To limit how many forms one address can send in an hour and a day, we keep your IP address, apart from the form, and delete it within two days.

From Firms and their authorized users:

Account and billing information (name, firm name, email, payment details processed by Stripe — we do not store full card numbers ourselves).
Configuration data: the credentials you connect and the settings you choose for your agent — the number urgent calls ring and when, your office facts, how your callback is promised, whether Spanish is on, and your own phone numbers, so your test calls are not screened as spam and, before you add a card, so your line answers them.
If you turn on text alerts: the mobile number you entered; until the six-digit confirmation code we texted it is entered, replaced or cleared by a later save, a one-way hash of that code (never the code itself), when it was texted and how many wrong codes were entered; once confirmed, when you entered the code and which consent wording you saw; and -- if that number replied STOP and a later alert or confirmation text was refused for that reason -- that it was and when (see "Text alerts to Firms" below). If you install the website chat: the websites you register it for, how you have it look, and on which of them, and when, it was last seen running.
Operational data about calls and chats (times, durations, outcomes). It is not used to bill you: the plan is a flat monthly price. Before you add a card, your test calls and their minutes are counted, only to apply the test-call limit; for the chat, what its replies cost us is counted against the daily and monthly limits we set, never to bill you; nothing else about your calls or chats is counted or metered.

From visitors to our public site:

Page views of our public pages, counted in aggregate. Our hosting provider, Vercel, counts them for us with its web analytics: which pages are read, which site a visitor came from, the visitor's browser, operating system and type of device, and the country the visit came from. We set no cookie for this. The page address we send is the page's path alone: any query string and fragment are removed first, so an advertising click identifier such as Google's "gclid" (below) is not in it. Like any web request, the report also carries your IP address, your browser's description and the address of the page that linked you to ours, from which Vercel derives the country, browser, operating system, device and referring site it shows us. The pages you see once you are signed in, the signup, login and password-reset pages, the caller-request page and the page a demonstration link from one of our emails opens are not counted. We use the counts only to see which of our pages are read, never to follow anyone across other sites, and Vercel handles them under its own privacy terms. Nothing else is collected from a visitor unless you sign in, use one of our account forms, use the caller-request page, ask for a demonstration call's example email, set up a demonstration call from a link in one of our emails (the three described below) or start a call to our demonstration line from your browser (described above), apart from the Google ad-click identifier, Google's sign-in script, a marketing agency's referral code and our own record of each visit to our public pages (the bullets below). We run no advertising or tracking cookies on intakegateway.com. Apart from the one cookie Google's sign-in script may set (below), the only cookies we set are the session cookies our authentication provider needs to keep you signed in, and they are set once you sign up or log in, not when you read the site. While you are signing up we also set one cookie, lasting half an hour, that holds the email address we sent your confirmation link to, so the page can show you where it went and resend it.
If you reach our site from one of our Google ads, Google adds a click identifier (its "gclid") to the link. Our own page keeps it in your browser's storage for that tab -- not in a cookie -- until you close the tab. Apart from our hosting provider's short-lived request logs, which record the address of each page requested, we keep it only if you sign up, when it is sent with the signup form. We then keep it with your firm's account so that we can report to Google what the ad led to: that an account was created, that a trial started, and that a first payment was made. Each report is sent from our server after the event and carries the identifier, which of those events it was and when it happened -- nothing else, and never your name, email address or firm. We make these reports to learn which of our ads lead to customers. Google can connect the identifier to the ad click it recorded, which may be linked to your Google account if you were signed in when you clicked, and handles it under its own privacy terms. We delete the identifier once Google's window for such reports has passed, measuring that window from your signup; the click came earlier, so this is never before Google's own cut-off.
While signup is open, our home page and our ad pages load Google's sign-in script, so that a visitor signed in to Google can choose to create an account with it. Loading the script lets Google see that visit, and Google handles it under its own privacy terms. If you close its prompt, the script may set one cookie on our site, g_state, holding only how long to wait before showing the prompt again. If you choose to continue, Google sends us your name, email address, profile picture link and Google account identifier, and we use them only to create your account or sign you in. No other Google code runs on our site.
We also advertise on Microsoft Advertising (Bing). If you reach our site from one of those ads, Microsoft adds its own click identifier (its "msclkid") to the link. Our site does not keep it (apart from our hosting provider's short-lived request logs, as above), no Microsoft code runs on our site, and nothing is sent to Microsoft. Such a visit is recorded, as below, as coming from one of our Microsoft ads, which our page tells from the identifier's presence on the link; the identifier itself is not part of that record -- or from one of our Google ads, if the same tab came from one earlier.
If you reach our site from a link a marketing agency gave your firm, the link carries that agency's referral code ("ref=" followed by a short code that identifies the agency, not you). Our own page keeps the code in your browser's storage for that tab -- not in a cookie -- until you close the tab, and takes it off the address bar. Apart from our hosting provider's short-lived request logs, which record the address of each page requested, we keep it only if you sign up, when it is sent with the signup form, and only if it is a code we issued to an agency we still work with; we then keep it with your firm's account, written once and never changed, so that we know which agency referred your firm and can pay that agency the referral fee we agreed with it. That fee comes out of our price, never on top of what you pay. The code identifies the agency, says nothing about you, is never sent to the agency, and goes into none of the visit records described below. It is deleted with your firm's account. Our page keeps no code and the form sends none while we are not running a referral program.
When you read our public pages, our page keeps a random visit identifier in your browser's storage for that tab -- not in a cookie, and gone when you close the tab -- and sends our own server short records under it. On the first page of the visit it sends where you came from: one of our Google ads or one of our Microsoft ads, with the name of the site that showed the Microsoft ad (each known from its click identifier above, or for Google on some iPhones a similar "gbraid" or "wbraid" mark, none of which is sent), a search engine, another website (its name only, such as example.org, never the page or address within it), one of our own pages, a page shared with our "Send to a partner" button, or none of these; and your screen's width in one of four ranges (under 400, 400 to 767, 768 to 1,279, or 1,280 pixels and wider). For each of our public pages you view in that tab: the page's path (never the query string or fragment), the time, and the type of device (phone, tablet or computer, worked out from your browser's description, which is not stored); when the page is hidden or closed, the time you left it; which sections of the page came into view; the page on which you first scrolled, moved the pointer, tapped, clicked or pressed a key, but not where or which key; each section of the page in which you clicked on something that did nothing, but not what or where; which of our sign-up and early-access buttons you pressed, and that you accepted Google's sign-in prompt, if you did; that you pressed our "Send to a partner" button, and on which page, if you did; that you tapped our demonstration line's number, if you did; that you started and ended a call to it from your browser, if you did; and that you started playing our sample call recording or our setup walkthrough video, and on which page, if you did; and, if you seemed about to leave a public page before our signup form, which fixed answer you picked, if any, to our question about what you needed first, and on which page. On some of our pages we show one of two versions of the headline, and one of two versions of the buttons at the top of the page, each picked at random once for the tab and kept in that tab's storage (not in a cookie, and gone when you close the tab); for those pages we also record which versions you were shown, and when you open our signup form, which version of the buttons. On some of our pages, when your device's clock reads before 8 AM, from 6 PM, or on a weekend, we show a line naming that time; for those pages, and when you open our signup form, we record whether we showed it. On our signup page and the confirmation page after it: that you opened the signup page, with the type of device; that you tapped our demonstration line's number, if you did; that you started filling in the form -- never what you typed; that we suggested a fix to the email address's spelling, and whether you took it, if we did; that you submitted it, or pressed one of the sign-up-with-another-account buttons, and which; that, if your browser would not send the form, it asked you to complete or correct the email address -- never what you typed; if you left the page without sending the form, the last part of it you touched (the email field, the Create account button or the security check) and whether the security check had finished; which answer you picked, if any, to our question about what is missing; and, if it was sent back to you, the general reason (for example, that the email address did not look valid, or the security check failed). We do not record visits from browsers that identify themselves as automated. These records are stored in our own database and shared with no one. Like any request to our site, each of these records reaches our server through our hosting provider, whose short-lived request logs are described above. We do not link them to the click identifier, to a referral code, to an account, a name, an email address or a firm, and no IP address or browser description is stored with them. A visit that ends in a signup could be matched to that signup by its time; we do not do so. To limit how many records one address can send, we also keep your IP address, apart from these records, and delete it within two days. We delete the records 90 days after the visit. We keep them to learn which pages visitors read, where they come from, and where they stop -- on a page or in the signup form -- so we can improve the site.
On the signup, sign-in-link, password-reset and resend-confirmation forms and the caller-request page, and when you press our "Talk to it now" button, a check from Cloudflare (Turnstile) runs in your browser to tell people from automated scripts. Cloudflare receives your IP address and information about your browser for that check and handles it under its own privacy terms; we receive only whether the check passed, and we pass your IP address to Cloudflare with the check.
On the caller-request page (intakegateway.com/caller-request), someone who called a law firm that uses the Service can give us the phone number they called from, roughly when they called, what they would like the firm to do, and an optional message. We use these only to find the firm or firms that number reached, to pass the request to them by email, and to limit how many requests one address or one number can send in a day. We never tell the visitor whether a firm was found. We keep the request only until every firm it is sent to has it, and at most 14 days. For the daily limits we also keep your IP address and a one-way code made from the number, and delete both within two days. The email provider that delivers the request keeps its own copy of the message for a limited time; it is one of the service providers listed in the Data Processing Addendum.
If, after calling our demonstration line, you ask on our site for the example email a Firm would have received about that call, you type the number you called from, the short code the line read out at the end of that call, and your email address; without the right code, nothing is sent. We use them only to find that call and send that one email to that address, and to limit how many requests one IP address or one number can send in a day -- nothing else. We share them with no one but the email provider that delivers the email; it keeps its own copy of the message for a limited time and is listed in the Data Processing Addendum. We keep the request only until that email is sent, and at most 7 days. For the daily limits we also keep your IP address and a one-way code made from the number, and delete both within two days.
If one of our emails gave you a link to hear our demonstration line answer with your firm's name, the link identifies your firm: it carries a random code that stands for your firm's name and nothing about you, and the page it opens shows that name. On that page you type the number you will call from. We keep a one-way code of that number, made with a secret key we hold, tied to your firm's link, for 30 minutes, so that a call from that number within those 30 minutes is answered with your firm's name in place of the demonstration firm's; we delete it within a day after, use it for nothing else and share it with no one. Your firm's name is then part of that call, which is recorded, disclosed and handled like any other call to the line ("Callers to our public demonstration line" above). The link itself holds only your firm's name, stops working when it expires and is deleted within a day after that. To limit how many numbers one address can set up and how often one number can be, we also keep your IP address and a one-way code made from the number, and delete both within two days. Apart from our hosting provider's short-lived request logs, which record the address of each page requested, we do not record who opened the link.
If you type your firm's name on our site to hear our demonstration line answer with it, we make the same kind of link for you, and everything in the bullet above applies to it. That link stops working after 7 days. To limit how many links one address can make, we keep your IP address and delete it within two days.
If you ask on our site to have our sample call sent to you, you type your email address. We use it only to send that one email, which links the sample call, gives our price and links our signup page, and we share it with no one but the email provider that delivers the email; it keeps its own copy of the message for a limited time and is listed in the Data Processing Addendum. We do not keep your address. We keep a one-way code of it, made with a secret key we hold, for 30 days, only so that the same address is not sent the email again within 30 days. If you use the unsubscribe link in that email, we keep that code for as long as we run this site, only so that we never email that address again. To limit how many requests one IP address or one address can send in a day, we also keep your IP address and a one-way code made from your address, and delete both within two days.

How we use it

To deliver the Service: run the intake conversation, by phone or in a Firm's website chat, check conflicts via Clio where the Firm has connected it, book consultations through a connected calendar or record a callback request where the Firm has not, send a caller a confirmation of an appointment booked for them in a call (a visitor whose appointment is booked in a chat is told in the chat and is not emailed by us; the Firm's calendar service may send its own confirmation), and send the Firm the call or chat summary. Billing is a flat monthly subscription, so nothing about a Firm's calls or chats is measured for it.
To text a six-digit confirmation code to the mobile number a Firm enters for text alerts, and to send a Firm that has confirmed it a text alert about an urgent call that was not transferred (see "Text alerts to Firms").
To operate, secure, and improve the Service, including error monitoring and structured logging.
To communicate with Firms about their account, billing, and the Service.
To learn which of our own Google ads lead to accounts, trials and paying firms, which pages visitors read, where they come from, and where they stop on a page or in the signup form, and which of our public pages are read (see above).
To know which marketing agency referred a Firm to us, and to pay that agency the referral fee we agreed with it (see "Who we share data with").
We do not sell personal data.

Call recording and consent

For call recording, the Service is designed to give a disclosure at the start of a call, before any intake question is asked, that the call may be recorded and transcribed and that the caller is speaking with an automated system; continued participation after that disclosure is treated as consent. Whether that disclosure is sufficient for a given caller or jurisdiction is the Firm's determination, not ours.

Website chat notice

For a Firm's website chat, the Service is designed to show a written notice before the first message, which the visitor must accept to start the chat: that the chat is with an AI assistant for the Firm and not a lawyer, that what is written is saved and shared with the Firm and with the companies that run the chat for it, including its AI provider, and that nothing in it creates an attorney-client relationship. We keep which notice was accepted and when. Whether that notice is sufficient for a given visitor or jurisdiction is the Firm's determination, not ours.

Text alerts to Firms

A Firm may choose to receive text-message alerts on a mobile number it enters in its settings. We send them only after the Firm ticks a consent box that is never ticked in advance and then enters in its settings a six-digit code we text to that number. That confirmation text contains the code and fixed words only. Each code is texted once; a new one goes only when the Firm asks for it or saves the setting again, and a code stops working after 15 minutes or five wrong entries. We keep that number; until the code is entered, replaced or cleared by a later save, a one-way hash of it (never the code itself), when it was texted and how many wrong codes were entered; and, once confirmed, when the code was entered and which consent wording was shown -- all for as long as the setting is kept.

An alert may be sent, at most once per call, when a call that meets our hot-case criteria was not transferred to the Firm. It contains the Firm's name, shortened and reduced to plain letters, digits and simple punctuation; the caller's phone number, or the words "a withheld number" when the call carried none we could show; and fixed words -- never the caller's name or anything said on the call. Alerts and confirmation texts are sent through our text-messaging provider, which receives the Firm's mobile number and each message's content and keeps its own record of each message under its own terms (it is listed in the Data Processing Addendum).

Message frequency varies, usually a few a month. Message and data rates may apply. Reply STOP to stop alerts, START to receive them again, or HELP for help; a Firm can also turn alerts off in its settings at any time. If a number replies STOP, our provider stops delivering to it; the first time a later alert or confirmation text is refused for that reason we record it, with when, and send nothing more to it until the Firm saves its alert settings again. How the program works: intakegateway.com/text-alerts.

We do not sell, rent or share mobile numbers or text-message opt-in data or consent with third parties or affiliates for their marketing or promotional purposes. Mobile numbers and opt-in data collected for text alerts are excluded from every other category of sharing described in this policy, except the messaging provider that delivers the alerts.

Who we share data with

We share data only as needed to deliver the Service, as a Firm directs, or as you ask us to, apart from two things: the reports to Google about an account, a trial or a first payment that followed one of our Google ads, described under "From visitors to our public site" above; and the monthly statement to a marketing agency that referred Firms to us, which tells the agency the total referral fee due to it and the number of Firms it referred whose payments that fee covers -- never a Firm's name, what it paid or anything else about it. An agency that referred only one Firm can tell from that count that the Firm is paying us. The service providers we use are listed in the Data Processing Addendum, which is the single place that list is maintained.

Security

We maintain technical and organizational security measures appropriate to the nature of the data and the scale of a self-serve platform. Those measures evolve as the Service does and we may change them at any time, provided we do not materially reduce overall security; no particular control, architecture, vendor, or certification is promised or guaranteed by this policy. The Data Processing Addendum states our security obligation in full and controls over this section. No system is perfectly secure, no method of transmission or storage is completely safe, and we cannot and do not guarantee that your data will not be accessed, altered, or destroyed. If we confirm a breach affecting a Firm's data we will notify that Firm without undue delay — see the Data Processing Addendum.

Caller rights

Because the Firm is the controller of caller data, requests to access, correct, or delete a specific caller's data should generally go to the Firm the caller contacted. If a caller contacts us directly, we will forward the request to the relevant Firm, which is responsible for deciding on and responding to it. We may, but are not required to, act on such a request ourselves. For our demonstration line and demonstration chat, where we are the controller, send any request to us at the contact below.

Children

The Service is not directed at, and is not knowingly used to collect information from, children. If a call involves a minor (for example, an injured minor passenger, or the children in a family-law matter, who are counted but never named, or a child who calls about any other legal matter or an immigration matter, whose parent's or another adult's name and number are taken instead), that is a substantive intake-handling question for the Firm, not something this policy resolves; the family-law bullet above says what the intake records about them.

Changes to this policy

Changes to this policy take effect when they are posted here. For a material change, we also notify Firms by email at the account's registered address when it is posted.

Contact

Questions about this policy, or to route a caller's request to their Firm: contact@intakegateway.com.