Privacy Policy

Version 2 · Effective Date: June 20, 2026 (pending attorney review)

Version 2 changes: Email addresses confirmed. Retention periods set (30/90 days). Anthropic API data use confirmed (no training on API data, no retention after processing). Google Cloud Vision data use confirmed (no document content retention). Legal basis for processing identified as contract performance. CCPA analysis completed (threshold not met at launch). Florida breach notification timeline added (30 days under FIPA). Items requiring attorney opinion clearly marked.

1. Introduction

This Privacy Policy describes how AcervoVista, Inc. ("AcervoVista," "we," "us," or "our") collects, uses, stores, and shares information about you when you use the AcervoVista platform.

We take the privacy of estate information seriously. The documents and data you upload to AcervoVista are sensitive — they may include personal and financial information about deceased family members, living heirs, and ongoing legal matters. We have designed the platform with privacy and data independence as foundational principles.

Our Core Privacy Commitment: Your case file is yours. It is built from what you share with us and is not visible to, shared with, or used to inform any other user's case. We do not sell your personal information to third parties. We do not use your case data to train AI models.

2. Information We Collect

2.1 Information You Provide Directly

Account information — name, email address, and payment information
Intake information — information about the decedent, the estate, the heirs, and the assets
Uploaded documents — photographs, PDFs, Word documents, and other files you upload to your case file
AI assistant conversations — questions you ask and information you provide in conversation with the assistant
Professional credentials — bar number, jurisdiction, and firm affiliation, if you apply for a professional account
Collaborator information — names and email addresses of people you invite to collaborate on your case

2.2 Information We Collect Automatically

Log data — IP address, browser type, operating system, pages visited, time and date of visits
Usage data — how you interact with the platform, which features you use and how often
Device information — device type, operating system version, and unique device identifiers
Cookies — see Section 8 (Cookies) for details

2.3 Information From Third Parties

Payment processors — Stripe provides transaction confirmation. We do not receive or store your full card number.
OCR providers — Google Cloud Vision processes document images to extract text. Google does not retain document content after processing. See Section 5.
Professional credential verification — we may verify professional credentials against publicly available bar association records

3. How We Use Your Information

3.1 To Provide the Platform

Our legal basis for processing your personal data is performance of our contract with you — we need your information to provide the services you have signed up for. We use your information to:

Build and maintain your case file
Process documents you upload via OCR text extraction and AI classification
Generate the gap map, timeline, case summary, and Lawyer Handoff Package
Power the AI assistant's responses to your questions
Process payments via Stripe
Send transactional communications, including case confirmations, deadline alerts, and quiz complexity assessment results
Refer you to attorneys in the referral network when requested

3.2 To Improve the Platform

We use aggregated and de-identified information to understand how users interact with the platform and to improve its capabilities. We do NOT use the specific contents of your case file — your documents, your family's information, or your estate details — to improve the platform's AI models.

We operate an internal feedback system in which the AI assistant flags patterns it identifies (not your personal data) for product improvement review. All such signals are de-identified before review. Corrections to the legal framework are reviewed and approved by a human before implementation.

3.3 To Comply With Legal Obligations

We may use or disclose your information as required by applicable law, court order, or legal process, including in response to lawful requests from public authorities.

4. How We Share Your Information

We Do Not Sell Your Information: AcervoVista does not sell, rent, or trade your personal information to any third party for their own commercial purposes. We do not share your data with advertising platforms.

4.1 Service Providers

We share information with service providers who help us operate the platform. They process your information on our behalf and are bound by confidentiality obligations:

Google Cloud Vision OCR text extraction from uploaded documents. Google processes document images and returns extracted text. Google does not retain document content after processing. Google's use of data is governed by its Cloud Data Processing Addendum.
Anthropic (Claude API) Powers the AI assistant and document classification. Document context is sent to the Anthropic API to generate responses. Anthropic does not train its models on API data. Anthropic's API data handling is governed by its usage policies and, for enterprise use, its Data Processing Addendum.
Stripe Payment processing. Stripe handles all payment card data in accordance with PCI-DSS standards.
Resend Transactional email delivery (case confirmations, complexity assessments, deadline alerts).
Railway Backend hosting and database. Data is stored in Railway's hosted PostgreSQL infrastructure.
Cloudflare Document storage (Cloudflare R2) and CDN/DNS services.

Review whether Data Processing Agreements (DPAs) are required with any of the above providers for GDPR compliance or under LATAM data protection laws. Anthropic and Google both offer DPAs for enterprise/API customers — confirm whether execution is required based on user base.

4.2 Lawyer Referral Network

When you request a lawyer referral, we may share your name, email address, jurisdiction, and a summary of your case complexity with the referred attorney to facilitate the introduction. We will notify you before sharing this information. If you choose to send a Lawyer Handoff Package to a referred attorney, the contents of that package are shared with that attorney. You control this action.

4.3 Collaborators

When you invite a collaborator to your case, the collaborator will have access to the portions of your case file you grant them access to. You control what each collaborator can see.

4.4 Legal Requirements

We may disclose your information if required to do so by law or if we believe in good faith that such disclosure is necessary to comply with a legal obligation or court order, or to protect the rights, property, or safety of AcervoVista, our users, or the public.

4.5 Business Transfers

If AcervoVista is acquired by or merged with another company, your information may be transferred as part of that transaction. We will notify you before your information is transferred and becomes subject to a different privacy policy.

5. Third-Party Services — Data Processing Details

5.1 Google Cloud Vision

Documents you upload are sent to Google Cloud Vision for OCR text extraction. Google processes these images and returns extracted text. Google Cloud's terms confirm that customer data submitted to Google Cloud APIs is not used to train Google's AI models, and document content is not retained after processing. Google's Cloud Data Processing Addendum governs data handling for API use.

5.2 Anthropic (AI Assistant and Document Classification)

When you use the AI assistant or when a document is classified using Layer 2 AI classification, your questions and relevant case context are sent to the Anthropic API. Anthropic's usage policies confirm that data submitted through the API is not used to train Anthropic's models. Anthropic processes data in the United States. For enterprise API customers, Anthropic offers a Data Processing Addendum.

If EU/EEA users will be served at launch, execute Anthropic's DPA and confirm the legal transfer mechanism (likely Standard Contractual Clauses) before accepting EU users. Same analysis applies to Google Cloud.

5.3 Cross-Border Data Transfers

AcervoVista serves users in the United States and internationally, including users in Latin American countries. Your information may be transferred to and processed in the United States. By using AcervoVista, you acknowledge that your data will be processed in the United States and that US data protection laws may differ from those in your home country.

If EU/EEA users are accepted, this section must be expanded to address GDPR transfer mechanisms — Standard Contractual Clauses or equivalent. If EU users are excluded at launch, add a geographic restriction to the Terms of Service and this section. For Argentina: Argentina's PDPA designates certain countries as adequate for data transfers; the US is not on the adequate countries list, requiring specific transfer safeguards. For Venezuela and Colombia: review applicable data protection requirements.

6. Data Retention

We retain your case file data and uploaded documents for as long as your account is active. If you delete your account:

Your case files and uploaded documents will be deleted within 30 days of account deletion
Backup copies will be purged within 90 days of account deletion
Transaction records are retained for 7 years as required by applicable financial record-keeping regulations
De-identified, aggregated information derived from your use of the platform may be retained indefinitely for platform improvement purposes

If we receive a legal hold notice or are involved in litigation relating to your case, we may be required to retain your data for longer than the above periods.

Confirm 30-day and 90-day retention periods are technically achievable with the Railway/Cloudflare R2 infrastructure. Confirm 7-year transaction record retention against Florida tax and financial record-keeping requirements. If EU users are accepted, confirm GDPR right to erasure compliance within these timelines.

7. Security

We implement technical and organizational measures to protect your information:

Encryption of data in transit using TLS 1.2 or higher
Encryption of data at rest in our hosted database and document storage
Access controls limiting who within AcervoVista can access case data
Case-level data siloing enforced at the database level — case data is isolated and cannot be accessed across case boundaries

If you believe your account has been compromised, contact us immediately at security@acervovista.com.

In the event of a data breach that is likely to result in a risk to your rights, we will notify you and applicable authorities as required by law. Under the Florida Information Protection Act (FIPA), we are required to notify affected individuals within 30 days of discovery of a breach. Under GDPR (if applicable), notification to the relevant supervisory authority is required within 72 hours.

8. Cookies and Tracking Technologies

AcervoVista uses cookies and similar technologies to operate the platform. We use:

Strictly necessary cookies — required for the platform to function, including session management and security. These cannot be disabled.
Analytics cookies — help us understand how users navigate the platform using de-identified analytics.

We do not use advertising cookies. We do not share user data with advertising platforms. AcervoVista does not run advertisements and is not supported by advertising revenue.

9. GDPR — European Users

IMPORTANT: This section must be completed before accepting EU/EEA users. If the platform will exclude EU users at launch (recommended to simplify compliance), this section should instead state that the platform is not available to users in the EU/EEA at this time. Choose one path: include or exclude EU users, then complete this section accordingly.

If you are located in the European Union or European Economic Area, the General Data Protection Regulation (GDPR) provides you with specific rights regarding your personal data. These include: the right of access; the right to rectification; the right to erasure (subject to legal retention obligations); the right to restriction of processing; the right to data portability; and the right to object to certain processing.

Our legal basis for processing your personal data is performance of our contract with you (Article 6(1)(b) GDPR) for the core platform services. For communications and platform improvement, we rely on our legitimate interests (Article 6(1)(f) GDPR).

To exercise any of these rights, contact us at privacy@acervovista.com. We will respond within 30 days.

10. LATAM and International Users

AcervoVista is designed to serve cross-border estate cases, including cases involving assets or heirs in Latin American countries. We recognize that users in Venezuela, Argentina, Colombia, Spain, and other countries may upload documents in Spanish or Portuguese, or documents relating to foreign legal proceedings.

By uploading documents to AcervoVista, international users acknowledge that their documents will be processed by US-based and US-contracted service providers, including Google Cloud Vision and Anthropic, and that their data may be stored in the United States.

Argentina (PDPA — Law 25,326): Argentina requires that personal data transferred outside Argentina go only to countries with adequate protection or under specific transfer mechanisms. The US is not on Argentina's adequate countries list. Before accepting Argentine users, confirm whether SCCs or consent-based transfer mechanisms are required, and whether registration with the AAIP (Agencia de Acceso a la Información Pública) is needed. Colombia (Law 1581/2012): Similar cross-border transfer requirements. Spain: Subject to GDPR as EU member.

11. Children's Privacy

AcervoVista is not directed to children under the age of 18. We do not knowingly collect personal information from children under 18. Estate matters involving minor children as heirs may be discussed through the platform, but the platform is intended for use by adults only.

If you believe we have inadvertently collected information from a child under 18, contact us at privacy@acervovista.com and we will delete that information promptly.

Confirm COPPA compliance framework. Although AcervoVista is not directed at children, estate cases may involve information about minor heirs. Confirm whether COPPA's requirements apply and whether any additional disclosures are needed.

12. Your Privacy Rights

12.1 Access and Correction

You may access and update your account information at any time through the platform. If you believe any information in your case file is inaccurate, you may correct it directly or contact us for assistance.

12.2 Deletion

You may delete your account and request deletion of your case files and documents at any time by contacting support@acervovista.com. See Section 6 (Data Retention) for applicable timelines.

12.3 California Privacy Rights (CCPA/CPRA)

AcervoVista does not currently meet the thresholds that would make it subject to the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA). The CCPA applies to for-profit businesses that: (a) have annual gross revenues exceeding $25 million; (b) buy, sell, receive, or share for commercial purposes the personal information of 100,000 or more consumers or households; or (c) derive 50% or more of annual revenue from selling consumers' personal information. AcervoVista does not currently meet any of these thresholds.

We will monitor our status against these thresholds as the business grows and will implement required CCPA/CPRA compliance measures if and when thresholds are met.

Regardless of CCPA applicability, AcervoVista does not sell personal information. California residents may contact us at privacy@acervovista.com with any privacy questions.

Confirm CCPA threshold analysis annually. If the platform grows to serve 100,000+ California consumers or generates $25M+ in annual revenue, full CCPA/CPRA compliance measures are required.

13. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by email or by posting a notice on the platform at least 14 days before the change takes effect. Your continued use of the platform after the effective date of any changes constitutes your acceptance of the revised policy.

We maintain a version history of this Privacy Policy. Previous versions are available upon request at privacy@acervovista.com.

14. Contact Us

For questions, concerns, or requests regarding this Privacy Policy or the handling of your information:

AcervoVista, Inc.
Privacy: privacy@acervovista.com
Security: security@acervovista.com (for security incidents only)
Support: support@acervovista.com
Website: acervovista.com

Add physical address and, if required, Data Protection Officer contact information before publication. DPO is required under GDPR if processing large-scale sensitive personal data — assess whether estate documents (which may contain health, financial, and family status data) trigger the DPO requirement.

15. Attorney Review Notes — Remaining Items

Version 2 has resolved all placeholders that could be filled without attorney input. The following items require attorney review before publication.

GDPR section — decide: include EU users (requires full GDPR addendum, transfer mechanisms, DPO analysis) or exclude EU users at launch (simpler, add geographic restriction)
Argentina PDPA — cross-border transfer mechanism required; AAIP registration assessment needed
Colombia Law 1581/2012 — cross-border transfer requirements
DPA execution — confirm whether DPAs with Anthropic and Google are required
DPO requirement — assess under GDPR whether estate document processing triggers mandatory DPO
COPPA — confirm compliance framework for minor heir information
Physical address — required before publication
Breach notification — FIPA 30-day and GDPR 72-hour timelines are stated; confirm both are achievable with current infrastructure and incident response plan

AcervoVista Privacy Policy v2 — Draft for Attorney Review — Not Yet in Effect — June 2026