Data processing addendum
Your clients' data is processed on your terms.
This addendum is part of the agreement between your firm and LawMOR. It applies automatically to every firm; there is nothing extra to sign. It says what we may and may not do with the personal information in your firm's records.
1. Scope and roles
This addendum applies to personal information in firm data that RingMOR Inc. (CallMOR) processes for your firm through LawMOR ("firm personal data"). Your firm is the business (or controller) and decides why and how it is processed. We are your service provider (or processor). Words not defined here have the meaning in our terms of service.
2. Processing on your instructions
- We process firm personal data only to provide, secure and support LawMOR for your firm, as described in Annex 1, and on your documented instructions. Your use of LawMOR's settings and features, and these terms, are your instructions.
- We will tell you if we believe an instruction breaks the law, and we may decline to follow it.
- You are responsible for having a lawful basis, and any notices and consents required, for the data your firm puts into LawMOR, including consent to record calls and to text people.
3. Service-provider commitments
We will not:
- sell or share firm personal data, as California law defines those terms;
- keep, use or disclose it for any purpose other than providing LawMOR to your firm, including for our own commercial purposes or advertising;
- use it to train or improve AI models, or let our providers do so;
- combine it with personal information from other firms or sources, except as needed to provide the service;
- keep, use or disclose it outside our direct business relationship with your firm.
We will comply with the privacy laws that apply to us as a service provider, give firm personal data the same level of protection those laws require, and tell you if we can no longer meet these obligations. You may take reasonable steps to stop and fix any unauthorized use.
4. Confidentiality and privilege
We treat all firm data as confidential and recognize that it may be protected by attorney-client privilege or work product. Our staff and contractors with access are bound by confidentiality duties, and they may access firm data only to provide the service, when your firm grants support access (read-only, up to 72 hours, logged), or when the law requires it. Nothing in our handling of firm data is intended to waive any privilege.
5. Security
We maintain the technical and organizational measures in Annex 2 and on our security page. We may improve them over time but will not reduce the overall level of protection.
6. Subprocessors
- You authorize us to use the subprocessors on our subprocessors page.
- Each subprocessor is bound by written terms that protect firm personal data at least as well as this addendum, including the prohibition on training AI models. We remain responsible for their work.
7. Helping with requests, and objecting to new subprocessors
- LawMOR lets your firm find, correct, export and remove records itself. If we receive a request from one of your clients or another person about firm personal data, we will refer them to your firm and not answer it ourselves unless you ask us to.
- We will give reasonable help with your obligations on security, incident notices and privacy assessments, taking into account what information we have.
- We email firm owners at least 30 days before a new subprocessor starts receiving firm personal data. You may object on reasonable data-protection grounds within that time. If we cannot address the objection, such as by keeping the feature off for your firm, you may cancel without penalty and receive a refund of prepaid fees for the unused period.
8. Security incidents
If we confirm unauthorized access to, or loss or disclosure of, firm personal data, we will notify your firm owner without undue delay and within 72 hours of confirming it. We will describe what happened, the data affected, what we have done and what you may need to do, and keep you updated. We will help you meet your own notice duties to clients and regulators. Our notice is not an admission of fault.
9. Requests from authorities
If a government, court or other third party demands firm personal data, we will, unless the law forbids it, notify your firm promptly so it can object or seek protection, refer the requester to your firm, and disclose only the minimum the law requires. We will challenge demands we believe are unlawful or overbroad, and we will raise privilege where it may apply.
10. Information and audits
On written request, once a year, we will answer reasonable security questionnaires and provide information needed to show we meet this addendum. If a regulator requires it, or after a security incident, we will allow a reasonable audit by your firm or an independent auditor bound by confidentiality, at a mutually agreed time and at your cost.
11. Return and deletion
Your firm can export all firm data at any time. After the agreement ends, the workspace stays available read-only for export for at least 12 months. We then delete firm personal data after 30 days' notice, unless the law requires us to keep it, and encrypted backups expire within 30 days after that. On request we will confirm the deletion in writing.
12. General
This addendum lasts as long as we process firm personal data. If it conflicts with the terms of service on firm personal data, this addendum controls. The limits of liability in the terms apply to it. For questions, email hello@callmor.ai with "DPA" in the subject.
Annex 1: Details of processing
| Item | Details |
|---|---|
| Subject matter and duration | Providing LawMOR to your firm for as long as the agreement lasts, plus the export and deletion period in section 11. |
| Nature and purpose | Storing, organizing, matching, transcribing, summarizing into draft entries, invoicing, sending and receiving messages, accepting payments, producing reports and exports, securing and backing up firm data. |
| People concerned | Your firm's users, clients and prospective clients, opposing parties and counsel, witnesses, callers and other contacts in your records. |
| Types of data | Names and contact details; matter, billing and trust records; call records, recordings and transcripts; texts and emails filed to matters; documents; e-signature evidence; payment status (not card or bank numbers). |
| Sensitive data | Firm records may contain sensitive information, such as health, financial or criminal-history details, as part of legal representation. Card numbers, Social Security numbers and bank account numbers are removed from transcripts and texts before storage. |
| Location | United States. |
Annex 2: Security measures
- Separation: PostgreSQL row-level security on every firm table, enforced on a database role that cannot bypass it, with tests that try other firms' records on every API route.
- Encryption: TLS 1.2 or 1.3 with HSTS in transit; bank account numbers, mail credentials, email access tokens and recording locations encrypted with per-firm keys; encrypted backups.
- Access: role-based access in each firm; second-factor sign-in; a fresh second-factor check before trust, payment, export and import actions; 12-hour sessions; support access only by owner grant.
- Accountability: an append-only audit log that the database refuses to change, covering money, time, matters, conflicts and communications.
- Data minimization: sensitive numbers removed from transcripts and texts; drafts private to the timekeeper; AI request logs store metadata, not content.
- Resilience: daily encrypted, checksummed backups kept 30 days, with an automated weekly restore test.
- Application security: rate limits, verified webhook signatures, content-checked uploads, strict security headers and content security policy.
- Incident response: a written incident procedure with the notice commitment in section 8.