Privacy Policy

Effective date: October 14, 2026

Version: 1.0

This policy explains what information ilaw collects, how we use it, who we share it with, how long we keep it, and how to delete it. ilaw is run by Bits Workshop Ltd ("we," "us," or "our"). We wrote this policy in plain language. If anything is unclear, email us at privacy@bits-workshop.com.

The short version

• ilaw is a tool for U.S. immigration law firms. Firms use it to follow their clients' cases with USCIS and the immigration courts.
• We hold client data only to serve the law firm that brought it to us. The firm decides what goes in and when it comes out.
• We never sell any data, and we do not share or transfer it except for the limited purpose of operating the service.
• We do not show ads. We do not use tracking cookies or ad networks. We do not use client data to train AI models.
• No one outside Bits Workshop may use or disclose your data for their own purposes unless you actively agree first.
• When a firm closes its account, we destroy its data 14 days later. Other deletion requests are finished within 30 days.
• If there is a data breach, we will tell you and explain what you can do.
• If we make a material change to this policy, we will email you a plain-language summary. We will ask for active consent before the new version applies.

1. Who this policy covers

This policy covers three groups of people.

• Law firms that sign up for ilaw. We call each one a "firm."
• Firm staff who sign in to ilaw, such as attorneys and paralegals. We call them "users."
• Firm clients and other people whose information a firm keeps in ilaw. This includes applicants, petitioners, and family members named in a case. We call their information "client data."

The firm controls its client data. We process client data only on the firm's behalf and only to provide ilaw to that firm. Under California law and similar state laws, we act as the firm's "service provider" or "processor" for client data. Our Data Processing Addendum sets out those duties in detail.

If you are a firm's client, your attorney's own privacy notice also applies to you. Section 10 explains how to ask about your data.

2. Information we collect

We list each type of information below. We also list types we do not collect.

2.1 Account information about users

• Contact and profile details: your name, work email address, the firm you belong to, and your assigned user role (owner, admin, or member).
• Sign-in details: your password, stored only as a one-way hash. Your two-factor sign-in secret and recovery codes, stored encrypted.
• Session details: the IP address and browser type of each signed-in session, and when it started and ends.
• User preferences: which notifications and emails you want to receive.
• Invitations: the email address and role on any invitation a firm sends.
• Agreements: which versions of our Terms of Service and this policy you agreed to, and when.
• Support records: when our support staff view your firm's account to help you, we record who did it, when, and why (see Section 3.3).
• Billing details: for paid accounts, the firm's billing contact name, email address, and billing address, its plan, and its invoices and payments. From Stripe, we also receive the card brand, the last four digits, and the expiration date. We never see or store full card or bank account numbers.
• Messages with us: anything you send us by email or another channel.

2.2 Client data a firm brings in

Most client data comes from the firm's case information system: the software the firm uses to manage its cases and clients. Today ilaw works with DocketWise, and may work with other systems in the future. The firm connects its system to ilaw, and we copy its records about the firm's matters and contacts.

Client data can include:

• Identity details: names, dates of birth, places and countries of birth, nationality, and photos or notes stored in a contact record.
• Government ID numbers: Alien Registration Numbers (A-Numbers), Social Security numbers, passport numbers, and other ID numbers stored in a contact record.
• Contact details: addresses, phone numbers, and email addresses.
• Family and relationship details: spouses, children, employers, and other people or companies linked to a case.
• Case details: matter types and statuses, assigned staff, priority dates, USCIS receipt numbers, and form types.
• Government case information: USCIS case statuses and their history, Annual Asylum Fee status, and immigration court (EOIR) hearing dates, judges, decisions, and appeals.
• Documents and notes: documents and free-form notes attached to client matters.
• The firm's staff list in its case information system: each staff member's name and email address.

All data is stored encrypted at rest and in transit, and any client data we store that is not used for searching or sorting is additionally encrypted inside the application runtime with a key that belongs to that one firm (see Section 7).

2.3 Technical information

• Request logs: the page address (without search terms or other query details), the time, the result, and the user and firm involved. We never log A-Numbers, receipt numbers, or client names.
• Audit records: each change you make in ilaw, such as inviting a member or changing a setting, and every page viewed during a support session. Each record holds the page address (without search terms or other query details), the time, the result, the button pressed, and the user and firm involved.
• Error reports: when a page fails in your browser, it sends a report through our server. The report holds the page address, your browser type, and details of the error. It does not hold your IP address, cookies, or any client data.
• Cookies: we use only the cookies ilaw needs to work. These keep you signed in, finish two-factor sign-in, and protect the step that connects the firm's case information system. We do not use advertising, analytics, or tracking cookies.

2.4 What we do not collect

• Location: we do not collect precise geolocation from your device.
• Payment and financial account details: we do not collect full card or bank account numbers. Our payment processor, Stripe, collects them directly (see Section 4.2).
• Medical or genetic information: we do not ask for health, medical, or genetic information. A firm could store some in a note in its case information system. If so, we copy it only as part of the record and never use it for anything else.
• Device contacts, photos, or files: we do not read your address book or files on your device.
• Biometric data and advertising IDs: we do not collect these.

3. How we use information

We use information only for the purposes below.

3.1 To run ilaw

• Show each firm its matters, contacts, filings, and court cases.
• Check case status with USCIS and the immigration court when the firm asks us to (see Section 4.1).
• Tell users about changes, in the app and by email, as each user chooses.
• Sign users in, keep accounts secure, and stop misuse.

3.2 To keep the service working

• Find and fix errors and slow pages, using request logs and error reports.
• Watch for outside sites refusing our requests, so we can fix the cause.

3.3 To give support

Our support staff can view a firm's account as a user sees it, to fix a problem. Each support session lasts at most 15 minutes. It shows a banner on the screen, and we record who started it and why. All actions taken by support staff during a session are recorded in an audit log. Support staff cannot change passwords, two-factor settings, or firm members during a support session.

3.4 To meet legal duties

We may use information to comply with the law, respond to valid legal process, and protect the rights and safety of users, clients, and the public.

3.5 What we never do

• We never sell any data, for money or for any other benefit.
• We never use client data for marketing or advertising.
• We never use client data to train AI or machine learning models.
• We never build profiles of people to make decisions about them.
• We never use sensitive data, such as ID numbers or nationality, to infer anything about a person.

3.6 De-identified data

We do not create de-identified, anonymized, or pseudonymized versions of client data to share with anyone. To run the service, we count things such as "how many checks ran today." These counts are not about any person, and we do not share them outside Bits Workshop.

If we ever want to use information for a new purpose, we will ask for your active consent first (see Section 12).

4. Who we share information with

We share information only with the parties named below, and only for the reasons given. Third parties may not use or disclose your information, including de-identified, anonymized, or pseudonymized data, for any reason without your active consent. Every service provider we use is bound by contract to protect information as this policy does. They may use it only to provide their service to us.

4.1 Government agencies, when the firm asks

ilaw looks up case information from public U.S. government services. A firm turns these lookups on for each filing or court case. That choice is the firm's active consent to send the details below.

USCIS and EOIR are government agencies with their own privacy rules. They already hold this information in their own files. ilaw is not part of, or endorsed by, USCIS, the Department of Homeland Security, the Department of Justice, or EOIR.

Some lookups run from a user's own web browser instead of our servers. In those cases, the browser sends the same details straight to the agency's website.

4.2 Service providers

We will update this list before we add a new provider that receives personal information. If a new provider would receive client data, we will ask for active consent first (see Section 12).

4.3 Other cases

• Legal requests: we may disclose information if the law requires it, such as a valid subpoena or court order. Where the law allows, we will tell the firm first so it can object. We will give only what the request requires.
• Safety: we may disclose information if we believe in good faith that it is needed to prevent serious harm to a person.
• Professional advisors: our lawyers, accountants, and insurers may see information when they advise us. They must keep it confidential.
• Change of ownership: see Section 9.

5. Your choices about sharing, and what they mean

You have choices about what ilaw shares and with whom.

• Government lookups: a firm can turn lookups on or off for each filing and court case.
• Emails: each user chooses which notifications they get, in the app and by email. Users can turn off the weekly digest at any time in Preferences.

Benefits of sharing. Sharing receipt numbers and A-Numbers with USCIS and EOIR lets ilaw find status changes, hearing dates, and fees due without staff checking each case by hand. This helps a firm catch deadlines.

Risks of sharing. Any time information moves, there is some risk it could be seen by someone who should not see it. We employ all best practices to ensure that data is encrypted while at rest and in transit. Email is inherently less secure than the app, because messages pass through email systems we do not control. We take steps to ensure that emails do not include sensitive information such as USCIS receipt numbers.

Limits. If a firm turns off lookups, ilaw cannot show changes for those cases. Turning off a lookup will prevent future queries, but does not remove any information that USCIS or EOIR hold in their own files.

Impact on others. Immigration cases often involve families. A case can name a spouse, children, parents, or an employer. Information about one person's case can reveal facts about these other people, such as their relationship, nationality, or immigration status. Firms should think about everyone named in a case when deciding what to store and share.

6. How long we keep information

Dormant accounts. We do not close accounts or remove users because they have not signed in. A dormant account's data is kept, under this policy, until the firm closes the account or a user is removed. A firm owner can close the account at any time (see Section 8). Owners and admins can remove users who no longer need access.

7. How we protect information

• Every user must sign in with a password and a second factor, such as an authenticator app.
• All connections to ilaw are encrypted.
• Each firm's sensitive data is encrypted with its own key. The key is kept in a separate key service, not in our database. One firm's key cannot open another firm's data.
• Our database keeps each firm's data separate. It refuses to show one firm's data to another firm, even if our code makes a mistake.
• We keep logs free of A-Numbers, receipt numbers, client names, passwords, and sign-in links.
• Only a small number of Bits Workshop staff can access production systems, and every support session is logged.

No system is perfectly secure, but we work hard to protect your information.

8. Deleting your data and closing an account

8.1 How to ask

• To close a firm's account and delete all of its data: a firm owner can use Settings → Cancel account in ilaw, or email privacy@bits-workshop.com from the owner's email address.
• To delete your own user account: ask an owner or admin at your firm to remove you. They can do this in Settings. We then delete your account information within 30 days. If you no longer work at the firm, or no one there can help, email privacy@bits-workshop.com from the email address on your account. We will tell the firm and delete your account within 30 days.
• To delete one client's data: a firm can delete the client in its case information system. We remove it from ilaw within 30 days after the next sync. A firm can also email us to remove it sooner.
• If you are a firm's client: see Section 10.

We may ask you to confirm your request, so we know it really came from you.

8.2 How soon it happens

Closing a firm's account. We keep the firm's data for 14 days after the account closes, in case the firm changes its mind or needs a copy. Then we delete the data and destroy the firm's encryption key, as Section 8.3 explains. After that, no one can read the data, and we cannot give the firm a copy. A firm owner can ask us to skip the 14 days and delete everything at once.

Copies of firm data. While the account is open, a firm owner can ask for a copy of the firm's data in a common file format. We will provide it within 30 days. After the account closes, the owner must ask within the 14 day window, and we will provide the copy before the data is destroyed. If firm data is requested during this window, we may extend the data retention period briefly in order to service that request.

Other requests. We permanently delete a user's account, or one client's data, within 30 days of a confirmed request.

We will email you when a deletion is done.

8.3 Backups

Each firm's data is encrypted with the firm's own key. When we delete a firm's data, we also destroy its encryption key. This makes the firm's data unreadable everywhere right away, including in any backups.

8.4 What we may keep

We may keep a record that a deletion happened, and support session and billing records for the periods in Section 6. We may also keep information if a law requires it. If so, we will tell you what we kept and why.

9. If Bits Workshop is sold, merges, or closes

If Bits Workshop is sold, merges with another company, or sells ilaw, your information may move to the new owner. If this happens:

• We will notify every firm and user before the change in ownership takes effect.
• The new owner must follow this policy, or a policy that protects your information at least as well.
• If the new owner wants to change how it uses or shares information, it must get your active consent first, as described in Section 12.
• Before the change, you may download your data or have it securely deleted.

If Bits Workshop shuts down ilaw, we will give firms at least 60 days' notice. Each firm may download its data during that time. After that, we will securely delete all data as described in Section 8.

10. If you are a firm's client

Your law firm decides what information about you is stored in ilaw. Your firm is the best place to start with any question or request about your data.

You can also contact us at privacy@bits-workshop.com. We will pass your request to your firm within 5 business days and tell you that we did. If your firm asks us to delete your data, we will do so within 30 days. Your firm may need to keep some records because of its professional duties as your lawyer.

11. Data breaches

If we learn that someone got into personal information without permission, we will:

• Notify the affected firms without unreasonable delay, and no later than 72 hours after we confirm the breach.
• Notify affected users, and help the firm notify its affected clients. If the firm asks, or the law requires, we will notify affected people directly.
• Explain what happened, what information was involved, and what we are doing about it.
• Give clear steps you can take to protect yourself. For example, this might include changing your password, resetting your second factor, or watching for fraud.

We will also notify government agencies when the law requires it.

12. Changes to this policy

We may need to update this policy. Every new version gets a new effective date and version number. Older versions stay available from a link on this page.

Small changes. Some changes do not affect your information, such as fixing a typo, making wording clearer, or updating our contact details. We simply post these.

Material changes. Some changes affect what information we collect, how we use it, who we share it with, or how long we keep it. For these, we ask for active consent first:

• We email a plain-language summary of what changed to every user.
• The email to each firm owner has an "I agree" link. ilaw also shows the summary and an "I agree" button to the firm's owners until one of them agrees.
• One owner's agreement covers the firm and its client data.
• If a change affects users' own account information, each user also sees the summary and an "I agree" button in ilaw.
• Until someone agrees, the earlier version still applies. We will not use or share information in any new way the change describes.

If you do not agree, you can close your account and delete your data as described in Section 8.

13. Your privacy rights

Depending on where you live, state laws may give you these rights:

• Know and access: ask what personal information we have about you, and get a copy.
• Correct: ask us to fix information that is wrong.
• Delete: ask us to delete your information (see Section 8).
• Portability: get your information in a common file format.
• Opt out: of the sale of personal information, targeted advertising, and profiling. We do none of these, so there is nothing to opt out of.
• Limit sensitive data: we use sensitive data only to provide the service, never to infer characteristics about you.
• Appeal: if we decline your request, you can appeal by replying to our answer. We will respond within 45 days.

We give these rights to every user, wherever they live. We will not treat you differently for using them.

How to make a request. Email privacy@bits-workshop.com or write to us at the address in Section 15. We will confirm we received your request within 10 days and answer within 45 days. We will verify your identity first, usually by asking you to reply from the email address on your account. You may use an authorized agent. We may ask the agent for proof that you gave them permission.

California residents. This section is our notice at collection under the California Consumer Privacy Act (CCPA). In the last 12 months we collected:

We collect this information from users, from firms, and from the firm's case information system. We use it only for the purposes in Section 3, and keep it for the periods in Section 6. We do not sell or share personal information.

14. Children

ilaw is for law firm staff, who must be 18 or older. A firm's client data may include information about children, such as a child named in a family's case. We handle that information only on the firm's behalf, under this policy.

15. Contact us

privacy@bits-workshop.com

Bits Workshop Ltd
1500 N Grant St #12096
Denver, CO 80203