Privacy Policy

This platform is operated by Brooks Law, PC, a Massachusetts professional corporation (“Brooks Law,” “we,” “us”). brookslawfirmai.app is an internal platform for the firm’s own personnel. Access is limited to firm staff holding a firm-issued email account; there is no public sign-up and no self-service registration. This policy describes that platform only. It is not the privacy policy of the firm’s public website.

A few pages can be reached without a staff account. Clients and other authorized recipients reach them by a single-use link the firm sends by email. These are a document signing page, a payment page, and a page for managing email notifications about a matter. The token in the link authenticates the visitor in place of a login, and each page shows only the matter the link was issued for.

The platform processes client and matter information that firm staff enter in the course of legal representation. Staff supply it; it is not collected from the public. The categories depend on the matter. They include identifying and contact details, and immigration and case identifiers, including USCIS receipt numbers and EOIR A-numbers (see the section below). For personal injury and workers’ compensation matters, they also include medical records and other health information. They also include documents, correspondence, and the notes and work product staff create while handling the matter.

Client card payments are processed by Stripe; full card numbers are never received or stored by the platform. The platform keeps a record of each payment, including the amount, date, name on the card, card brand, and last four digits.

It also processes staff account information: name, firm email address, and the roles and practice areas that decide what each person may open. It keeps usage records as well. These are sign-in events, page and feature access, and the actions staff take inside the applications.

Brooks Law collects USCIS receipt numbers and EOIR alien registration numbers (A-numbers) through the platform’s Case Tracker feature. Firm personnel enter them, or the firm imports them from its own records of EOIR notices, in the course of representing the firm’s clients. We treat receipt numbers and A-numbers as personally identifiable information (PII).

How they are used. A receipt number is used to query the USCIS Case Status API, over an encrypted connection authenticated with credentials issued to Brooks Law by USCIS, so that the firm can monitor the status of an application or petition it has filed or is handling for a client. Each receipt number is queried approximately once per day on a schedule, or on demand when a staff member requests a check.

A-numbers are used to match EOIR electronic notices that the firm receives as counsel of record to the correct client file and to route those notices into the firm’s case-management system. The platform does not transmit A-numbers to USCIS, EOIR, or any other government system. The case status information returned by USCIS is stored alongside the receipt number so that firm personnel can see the current status and a history of status changes.

How they are stored. Receipt numbers, A-numbers, and the case status information associated with them are stored in the platform’s database, hosted by Supabase on infrastructure that encrypts data at rest. All connections to the database and to USCIS use TLS encryption in transit. Status-change notifications containing a receipt number or A-number are sent only to Brooks Law staff email accounts and only to staff members who have individually chosen to follow that number.

How they are safeguarded. Access to Case Tracker, and to the receipt numbers and A-numbers it holds, is limited to Brooks Law personnel who hold an active firm account, have authenticated to the platform, and have been assigned the Immigration practice area, a firm leadership role, or an administrator role. These restrictions are enforced by a server-side access check on every request, and by row-level security on staff read queries. Lookups, subscriptions, edits, and archive actions are recorded in an audit log that identifies the staff member who performed them.

Receipt numbers are never exposed in public URLs, are not shared with any third party other than the service providers listed in this policy for the purposes described, and are never sold or used for advertising. Credentials used to access the USCIS API are stored as protected environment secrets, are not accessible to application users, and are rotated when personnel or access changes warrant it.

Firm personnel may archive a receipt number or A-number from Case Tracker at any time, and may request its deletion through the firm’s administrator; deletion is honored unless retention is required by the firm’s professional-responsibility or record-keeping obligations.

Some features query government systems on behalf of clients the firm represents. The platform submits case receipt numbers to the USCIS Case Status API to get the current status of a pending application. It also receives electronic notices from the Executive Office for Immigration Review, because the firm is counsel of record.

These queries are made only for matters the firm handles. The platform does not look up receipt numbers, A-numbers, or case records for anyone the firm does not represent, and it is not available to the public for that purpose.

Information is used to carry out the firm’s legal work and to run the platform. That means preparing filings and correspondence, and tracking case status and deadlines. It means telling staff and clients about developments in a matter, processing client payments, and managing staff accounts and access. Information is not used for advertising. It is not sold, rented, or given to third parties for their own marketing.

The platform relies on the providers below. Each may process information while it delivers its service. Vercel hosts the application and Supabase hosts the database. Anthropic provides AI processing of documents and text supplied by staff. Resend sends transactional email, Stripe processes client payments, Twilio sends text messages, and HumbleFax sends faxes. Filevine provides case management, HubSpot provides client relationship management, and Google Workspace provides mail ingestion and calendar.

These providers act on the firm’s instructions for the purposes described above. Information supplied to them is limited to what the relevant feature requires.

We share information only with the service providers listed above, and only so they can provide their services to the firm. We require each of them to keep the information confidential and to protect it in a way that is consistent with this policy. They may not use it for their own purposes.

We do not sell personal information. We do not exchange it for money or anything else of value. We do not share it with advertisers, marketers, or data brokers.

We do not create or share de-identified, anonymized, or pseudonymized data sets. No third party may use or disclose information about a user or a client, including information that has been de-identified, for any reason without that person’s active consent, except where the law requires it.

Staff choose which receipt numbers and A-numbers to follow, and can stop following them at any time. Following a number means status emails about it are sent to your firm email account. Information in immigration and injury files often concerns family members and other people besides the client. Staff should enter only what the matter requires, and should keep in mind that information about one person can reveal information about others.

We keep client and matter records for as long as the firm’s professional-responsibility and record-keeping obligations require, and then delete them. Staff accounts are closed when a person leaves the firm. An account that has not been used for 90 days is reviewed by the firm administrator and closed if it is no longer needed. Client and matter records created by a closed account stay with the matter they belong to. Personal items tied only to that account, such as its notification subscriptions and settings, are deleted with it.

You can ask us to permanently delete your data by emailing albert@brookslawfirm.com. We will confirm your request and complete the deletion within 30 days. If the law or our professional obligations require us to keep some of the information, we will tell you what we kept and why. Staff can also archive a tracked number in Case Tracker at any time.

Staff accounts are personal and are managed by the firm administrator. To close your account, email albert@brookslawfirm.com. The administrator closes accounts on request and when a person leaves the firm. After an account is closed it can no longer sign in.

If we learn that personal information has been accessed or disclosed without authorization, we will notify the people affected without unreasonable delay, as Massachusetts law (M.G.L. c. 93H) requires. The notice will explain what happened, what information was involved, and what steps you can take to protect yourself. Where the law requires, we will also notify the Massachusetts Attorney General and the Office of Consumer Affairs and Business Regulation.

If Brooks Law, PC merges, is acquired, or transfers its practice, information will pass only to a successor that agrees to protect it under terms at least as protective as this policy. We will notify users before any transfer. If the firm closes, client files will be handled as the Massachusetts Rules of Professional Conduct require. Users may ask us to securely delete, transfer, or provide a copy of their information, including any health information, before a transfer or closure.

When we change this policy or the Terms of Service, we will publish a plain-language summary of what changed. Every staff account holder must review the summary and actively accept the new version before they can continue using the platform. The date at the bottom of this page shows when it was last updated.

Brooks Law, PC is a Massachusetts law firm. This platform is an internal tool for firm personnel. The California Consumer Privacy Act does not apply to it. If you believe it applies to you, contact us at albert@brookslawfirm.com and we will respond to your request.

Signing in requires a firm email address and password. Accounts configured to require it must also enter a code sent by email. What each account can reach depends on its role and practice-area permissions. These limits are enforced in the database as well as in the application, so staff see only the applications and records their role allows. Traffic to and from the platform is encrypted in transit, and significant actions are recorded in an audit log.

No system is perfectly secure. Staff who believe an account or a record has been accessed improperly should report it to the firm administrator immediately.

Records on the platform are retained for as long as the professional-responsibility and record-keeping obligations of a Massachusetts law firm require, and longer where a matter, a dispute, or a legal hold makes it necessary. Retention is therefore driven by the firm’s obligations to its clients rather than by the platform.

Staff who need an account detail or a platform record corrected should contact the firm administrator. Clients with questions about information the firm holds in connection with their matter should raise them with the attorney or staff member handling it, where the firm’s duties to its clients govern.

Questions about this policy may be directed to the platform administrator at albert@brookslawfirm.com or to Brooks Law, PC at the address below.