Batesly, Inc. ("Batesly", "we", "us", or "our") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our document management services (the "Services").
By accessing or using our Services, you consent to the practices described in this Privacy Policy. If you do not agree to this Privacy Policy, please do not access or use our Services.
1. INFORMATION WE COLLECT
1.1 Account Information
When you create an account, we collect:
Name and email address.
Organization name and details.
Authentication credentials (passwords are stored using industry-standard hashing).
Profile preferences and settings.
Billing and payment information (processed by our payment provider, Stripe).
1.2 Usage Information
We automatically collect certain information when you use our Services:
Log data (IP address, browser type, pages visited, timestamps).
Device information (operating system, device identifiers).
Usage patterns and feature interactions.
Session data and authentication tokens.
1.3 Document Data
You upload documents to our platform for storage and processing. We access document content only as necessary to provide the Services, including:
OCR processing for text extraction.
Search indexing for document retrieval.
AI-powered features (if enabled by your organization).
1.4 Communications
We collect information you provide when you:
Contact our support team.
Respond to surveys or feedback requests.
Communicate with us through any channel.
1.5 Marketing Signups and Newsletter Subscriptions
When you submit your email address through a contact form, demo request, or newsletter signup on our marketing websites, we collect your name (where provided), email address, and any other information you choose to submit. This information is used to respond to your inquiry and, unless you opt out, to send you occasional product updates, newsletters, and marketing communications about Batesly.
2. HOW WE USE YOUR INFORMATION
We use the information we collect to:
Provide the Services: Process and store your documents, enable collaboration, provide search and retrieval functionality.
Improve the Services: Analyze usage patterns to enhance features and performance.
Communicate with you: Send service notifications, security alerts, and support messages.
Ensure security: Detect, prevent, and respond to security incidents and unauthorized access.
Comply with legal obligations: Meet regulatory requirements and respond to legal requests.
Process payments: Manage billing and subscription services.
Send marketing emails and newsletters: If you have submitted your email through one of our marketing forms or newsletter signups, we may send you product updates, educational content, and other marketing communications. You can unsubscribe at any time by clicking the unsubscribe link in any marketing email or by emailing privacy@batesly.io. Opting out of marketing does not affect transactional or service-related messages.
3. AI-POWERED FEATURES
If your organization enables AI-powered features:
Document content may be processed by Anthropic Claude models hosted on Amazon Bedrock within our AWS environment to provide document classification, privilege detection, relevance scoring, and other AI features.
Your data is NOT used to train AI models. Our agreements with Amazon Web Services and Anthropic explicitly prohibit model training on customer data.
AI providers may retain data for up to 30 days for trust and safety monitoring, after which it is deleted.
All AI-assisted actions are logged for audit purposes.
Your organization controls whether AI features are enabled at the organization, matter, or document level.
4. GOOGLE CALENDAR INTEGRATION
If you choose to connect your Google account, Batesly accesses Google Calendar data only to provide the calendar sync you turn on:
Sending events to Google: Batesly creates a separate "Batesly" calendar in your Google account and keeps copies of your Batesly calendar events in it. Batesly can change only the calendar it created, never your other calendars.
Showing Google events in Batesly: only for the calendars you choose, Batesly reads the list of your calendars and their event details (such as title, time, location and your response) and shows them to you in Batesly. They are shown to you only; Batesly never changes them.
Storage: your Google access credentials are encrypted at rest. Copies of events from calendars you select are stored only while the calendar stays selected and within the sync window. They're deleted when you untick the calendar or disconnect.
Your control: you can disconnect at any time from Settings > Integrations, or remove Batesly's access from your Google Account permissions.
Batesly's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We do not use Google user data for advertising, do not sell it, do not use it to train AI models, and do not let people read it except with your permission, for security purposes, or where the law requires.
5. DATA SHARING AND DISCLOSURE
We do not sell your personal information. We may share your information in the following circumstances:
5.1 Service Providers
We share information with third-party service providers who assist us in providing the Services, including:
Railway: Cloud infrastructure and hosting.
Amazon Web Services (Bedrock): AI-powered document intelligence via Anthropic Claude models (optional).
Google Workspace: Business email.
Stripe: Payment processing.
Resend: Transactional email delivery.
Customer.io: Marketing email, newsletter delivery, and lead-form processing for our marketing websites.
Google Analytics: Website analytics and usage measurement.
Google (Calendar API): Optional calendar sync for users who connect their Google account.
ChartMogul: Subscription analytics.
Scytale: SOC 2 compliance automation.
All service providers are bound by contractual obligations to protect your information and use it only for the purposes we specify.
5.2 Within Your Organization
Your organization's administrators may have access to your account information and activity within the platform, subject to your organization's policies.
5.3 External Collaborators
If you or your organization shares documents with external parties through the Services, those parties will have access to the shared content as configured.
5.4 Legal Requirements
We may disclose information if required by law, regulation, legal process, or government request. Where permitted, we will notify you before making such disclosures.
5.5 Business Transfers
If Batesly is involved in a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction. We will notify you of any change in ownership or use of your information.
6. DATA SECURITY
We implement appropriate technical and organizational measures to protect your information, including:
Encryption at rest: AES-256 encryption for all stored data.
Encryption in transit: TLS 1.2 or higher for all data transmission.
Access controls: Role-based access controls and multi-factor authentication.
Audit logging: Immutable logs of all system access and changes.
Regular security assessments: Vulnerability scanning and penetration testing.
SOC 2 compliance: Our infrastructure providers, Railway and Amazon Web Services, are SOC 2 Type II certified. Batesly's own SOC 2 Type II audit is in progress.
While we strive to protect your information, no method of transmission or storage is 100% secure. We cannot guarantee absolute security.
7. DATA RETENTION
Account information: Retained for the duration of your account plus 90 days after termination for data export.
Document data: Retained according to your organization's configured retention policies.
Audit logs: Retained for the duration of your subscription plus 7 years.
Backups: Deleted within 180 days of account termination.
Upon termination of your organization's subscription, you will have 90 days to export your data before it is deleted from our production systems.
8. YOUR RIGHTS AND CHOICES
Depending on your location, you may have certain rights regarding your personal information:
Access: Request a copy of the personal information we hold about you.
Correction: Request correction of inaccurate or incomplete information.
Deletion: Request deletion of your personal information (subject to legal retention requirements).
Portability: Request a copy of your data in a portable format.
Opt-out: Opt out of certain processing activities (where applicable).
To exercise these rights, contact us at privacy@batesly.io. We will respond to your request within the timeframe required by applicable law.
9. CALIFORNIA PRIVACY RIGHTS (CCPA)
If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA):
Right to Know: Request information about the categories and specific pieces of personal information we have collected.
Right to Delete: Request deletion of your personal information.
Right to Correct: Request correction of inaccurate personal information.
Right to Non-Discrimination: We will not discriminate against you for exercising your privacy rights.
We do not sell personal information as defined by the CCPA. We do not share personal information for cross-context behavioral advertising.
10. CHILDREN'S PRIVACY
Our Services are not intended for children under 18 years of age. We do not knowingly collect personal information from children under 18. If you believe we have collected information from a child under 18, please contact us immediately.
11. INTERNATIONAL DATA TRANSFERS
Our Services are hosted in the United States. If you access the Services from outside the United States, your information will be transferred to and processed in the United States. By using the Services, you consent to this transfer.
For customers subject to GDPR or UK data protection laws, please see our Data Processing Agreement for information about international transfer mechanisms.
12. COOKIES AND TRACKING
We use cookies and similar technologies to:
Maintain your session and authentication state.
Remember your preferences and settings.
Analyze usage and improve our Services.
Detect and prevent security threats.
You can control cookies through your browser settings. Note that disabling cookies may affect the functionality of the Services.
13. THIRD-PARTY LINKS
Our Services may contain links to third-party websites or services. We are not responsible for the privacy practices of these third parties. We encourage you to review their privacy policies before providing any information.
14. CHANGES TO THIS PRIVACY POLICY
We may update this Privacy Policy from time to time. We will notify you of material changes by:
Posting the updated policy on our website.
Updating the "Last Updated" date at the top of this policy.
Sending notification through the Services or by email for significant changes.
Your continued use of the Services after changes become effective constitutes acceptance of the updated Privacy Policy.
15. GOVERNING LAW
This Privacy Policy shall be governed by and construed in accordance with the laws of the State of Washington, without regard to its conflict-of-laws principles. Any disputes arising under this Privacy Policy shall be resolved exclusively in the state or federal courts located in King County, Washington.
16. CONTACT US
If you have questions about this Privacy Policy or our privacy practices, please contact us:
Email: privacy@batesly.io
Legal inquiries: legal@batesly.io
Batesly, Inc., a Delaware Corporation