Privacy Policy

1.1 Information you provide directly: contact information; matter information; account credentials; communications; documents; signature data (stored with IP address and timestamp under ESIGN Act and UETA); and payment instructions.

1.2 Information collected automatically: usage data; device information; log data including IP addresses; and session tokens (no tracking or advertising cookies).

1.3 Information from third-party integrations:

• QuickBooks Online — invoice records, customer contact info, transaction history; only after express authorization
• Calendly — booking data
• People Data Labs — prospect research for staff only; no client data shared with PDL
• Resend — email delivery events

2.1 Provide legal services: managing matters, deadlines, and docketing; generating and delivering engagement letters and collecting e-signatures; communicating matter status updates; processing retainer payments.

2.2 Operate the practice: managing staff access; syncing financial data with QuickBooks; tracking USPTO filing requirements.

2.3 Outreach and business development (staff only): identifying and researching prospective clients through the Lead Generator. Prospective client data is not commingled with active client matter data.

2.4 AI features:

• Intake qualification analysis — briefing for attorney review only, not delivered to clients without attorney approval
• Document parsing — AI-extracted deadlines reviewed by paralegal before reliance
• Email drafting assistance — staff review required before sending
• Lead scoring

All AI features process data only within the Portal's secure environment. Data is not used to train third-party AI models. AI outputs in legal or financial contexts are always labeled as drafts, consistent with Utah's 2025 high-risk AI disclosure requirements.

SSIP is a Utah law firm subject to the Utah Rules of Professional Conduct. Information shared in connection with legal representation is protected by the attorney-client privilege under Utah Rule 1.6. Access to client information is restricted to SSIP staff with a legitimate need. The Portal enforces confidentiality through row-level security policies that prevent any user from accessing another client's information.

We do not sell, rent, or commercially exploit your information. We share information only with:

4.1 Service providers:

• Supabase (US) — all Portal data
• Intuit / QuickBooks — invoice data and customer contact info, only after authorization
• Resend — email delivery
• Calendly — booking data
• People Data Labs — search queries only, no client data
• Stripe — payment instructions only, no card data stored by Portal
• VeriTek AI — Portal development and maintenance

4.2 Legal requirements: when required by law, court order, or valid legal process.

4.3 Professional obligations: conflicts checks, fee arbitration, or mandatory reporting under the Utah Rules of Professional Conduct.

4.4 Business transfers: client information remains subject to attorney-client confidentiality obligations in any transfer.

• Matter files and client communications — seven (7) years after the matter closes
• Signed engagement letters and e-signature records — permanently
• Financial and QuickBooks data — seven (7) years from the transaction date
• Authentication and access logs — one (1) year
• Outreach and prospect data — two (2) years from last contact

After retention periods expire, we securely delete or anonymize data. Contact alexis@siliconslopesip.com to request earlier deletion of data not subject to legal retention requirements.

• TLS 1.2 or higher for all data in transit
• Encryption at rest in Supabase's US-hosted infrastructure
• Role-based access controls and row-level security
• API keys stored in a secure secrets manager and not exposed in client-facing code
• Logged and monitored staff access to production data

No security system is completely impenetrable. Report security concerns to alexis@siliconslopesip.com.

In the event of a data breach we will: investigate promptly; notify affected individuals within the time required by Utah law; report breaches affecting 500 or more Utah residents to the Utah Attorney General and the Utah Cyber Center as required by the Utah Data Breach Notification Act; and provide notice of what information was affected and what steps to take.

SSIP's current operations do not meet the UCPA revenue threshold ($25M+); however, we voluntarily extend the following rights to Utah residents: right to know, right to access, right to deletion (subject to professional retention obligations), right to correction, and right to opt out of marketing use. Contact alexis@siliconslopesip.com to exercise these rights. We will respond within 45 days and will not discriminate against you for exercising these rights.

Email: opt out of outreach emails by replying "unsubscribe" or contacting alexis@siliconslopesip.com. Transactional emails related to active matters cannot be opted out of while the matter is active.

QuickBooks: disconnect at any time from Portal Settings.

Notification preferences: customizable from Account Settings within the Portal.

The Portal is not directed to individuals under 18. We do not knowingly collect personal information from children under 18. Contact alexis@siliconslopesip.com if you believe we have collected such information.

We may update this Privacy Policy at any time. Material changes will be posted with a revised effective date. For significant changes affecting attorney-client privileged information, we will notify active clients directly.

Silicon Slopes IP, PLLC · 1771 Oakridge Dr., Lehi, Utah 84043 · alexis@siliconslopesip.com · (801) 326-9806