Privacy Policy
Last updated: September 2026
1. Information We Collect
Firmfy collects information you provide directly when you create an account, configure your law firm's workspace, or communicate with our support team. This includes your name, email address, firm name, billing information, and any data you enter into the platform such as case details, client records, financial information, practice management platform data (tasks and calendar events synced from Clio, GoHighLevel, Practice Panther, and MyCase), employee performance data (scorecards, review assessments), client satisfaction survey responses, and daily check-in content.
When your firm connects a messaging channel, Firmfy receives the data needed to send and receive messages on that channel: phone numbers, sender and profile names, message content and attachments, delivery and read timestamps, and call metadata. Channels include SMS, voice, and WhatsApp through Twilio, and WhatsApp, Messenger, and Instagram through the Meta Business Platform. When a firm connects a Meta Business account, we also receive the identifiers Meta issues for that connection, such as the business portfolio ID, WhatsApp Business Account ID, phone number IDs, Page IDs, and the access tokens that authorize Firmfy to act on the firm's behalf.
We also automatically collect certain technical information when you use our services, including your IP address, browser type, device identifiers, pages visited, and usage patterns. This data helps us understand how our platform is used and allows us to improve the experience for all users.
2. How We Use Your Information
We use the information we collect to provide, maintain, and improve our services. This includes processing transactions, sending service-related communications, providing customer support, and personalizing your experience within the platform.
Messaging data is used only to deliver the conversations your firm has with its own clients and prospects: showing messages in the firm's inbox, routing them to the right team member, sending replies, and keeping the conversation history the firm relies on. We do not use message content, contact lists, or any data received from Meta or Twilio to build advertising profiles, to train general-purpose models, or for any purpose other than operating the service for the firm that connected the channel.
We may also use your account information to send you product updates, marketing communications, and other information that may be of interest to you. You can opt out of marketing communications at any time by clicking the unsubscribe link in our emails or adjusting your notification preferences in your account settings.
3. Meta Platform Data and the WhatsApp Business Platform
Firmfy integrates with the WhatsApp Business Platform, Messenger, and Instagram messaging through APIs provided by Meta Platforms, Inc. Firmfy uses these integrations as a technology provider acting on behalf of the law firms that use our platform. Each firm owns its WhatsApp Business Account, its Facebook Page, and its Instagram professional account, and authorizes Firmfy to access them by logging in with its own Meta Business account through Facebook Login for Business. Firmfy never accesses a firm's Meta assets without that authorization.
Our use of data received from Meta ("Platform Data") is governed by the Meta Platform Terms, the Meta Developer Policies, and the WhatsApp Business Terms of Service, in addition to this policy. We use Platform Data solely to provide the messaging features described above to the firm that authorized the connection. We do not sell Platform Data, we do not share it with data brokers or advertising networks, and we do not use it to make decisions about eligibility for credit, housing, insurance, or employment.
WhatsApp messages sent through Firmfy are delivered by Twilio Inc., a WhatsApp Business Solution Provider. Message content is protected in transit and at rest, and access tokens issued by Meta are stored encrypted and used only to call the Meta APIs on the firm's behalf. Firms remain responsible for obtaining any consent their clients' messaging requires and for complying with WhatsApp's messaging policies when they contact people through Firmfy.
4. Data Sharing and Disclosure
Firmfy does not sell your personal information to third parties. We share information only with service providers that help us operate the platform and that are contractually bound to use it solely for the purposes we specify. These include cloud hosting and database providers, payment processors, analytics services, Twilio (for SMS, voice, and WhatsApp delivery), and Meta (when your firm sends or receives messages on WhatsApp, Messenger, or Instagram).
Mobile phone numbers and consent information collected for text messaging are never shared with third parties or affiliates for their own marketing purposes. Messaging providers receive only what is required to deliver the messages your firm sends.
We may disclose your information if required by law, regulation, or legal process, or if we believe disclosure is necessary to protect the rights, property, or safety of Firmfy, our users, or the public. In the event of a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction.
5. Data Security
We take the security of your data seriously. Firmfy employs industry-standard security measures, including 256-bit AES encryption for data at rest, TLS 1.3 for data in transit, role-based access controls, and regular security audits. Our infrastructure is hosted on SOC 2 Type II certified data centers in the United States.
While we strive to protect your information, no method of transmission over the internet or electronic storage is 100% secure. We encourage you to use strong passwords, enable two-factor authentication, and promptly report any suspected unauthorized access to your account.
6. Your Rights and Choices
Depending on your jurisdiction, you may have the right to access, correct, delete, or export your personal data. You may also have the right to object to or restrict certain processing of your information. To exercise any of these rights, please contact us at privacy@firmfy.com.
If you are a client or prospect of a law firm that uses Firmfy, the firm decides how your information is used and Firmfy processes it on the firm's instructions. Please direct requests about your data to that firm; we will support the firm in responding to you.
If you are a resident of the European Economic Area, you have additional rights under the General Data Protection Regulation (GDPR), including the right to data portability and the right to lodge a complaint with a supervisory authority. California residents have rights under the California Consumer Privacy Act (CCPA), including the right to know what personal information is collected and the right to request deletion.
7. Data Deletion and Disconnecting Integrations
You can remove Firmfy's access to a connected platform at any time. A firm administrator can disconnect any integration from System → Integrations inside Firmfy, which immediately revokes and deletes the access tokens we hold for that platform. You can also remove Firmfy from your Meta Business account under Business Settings → Integrations → Connected apps, or from your personal Facebook account under Settings → Apps and Websites; either action stops all further data access.
To request deletion of data Firmfy has already received from Meta, Twilio, or any other connected platform, email privacy@firmfy.com from an address associated with the firm, or ask a firm administrator to delete the relevant conversations or contacts from within Firmfy. We confirm receipt within 5 business days and complete the deletion within 30 days, except for records we must keep for legal, regulatory, or billing purposes, which we isolate and delete when that obligation ends.
Deleting a firm account deletes all of the firm's data, including every message and identifier received from connected platforms, on the same 30-day schedule described in Data Retention below.
8. Cookies and Tracking
Firmfy uses cookies and similar tracking technologies to enhance your experience, analyze usage patterns, and deliver targeted content. Essential cookies are required for the platform to function properly and cannot be disabled. Analytics cookies help us understand how you interact with our services.
You can manage your cookie preferences through your browser settings or through the cookie consent banner displayed when you first visit our website. Please note that disabling certain cookies may affect the functionality of our platform.
9. Data Retention
We retain your personal information for as long as your account is active or as needed to provide you with our services. When you delete your account, we will delete or anonymize your personal data within 30 days, except where we are required to retain it for legal, regulatory, or legitimate business purposes. Backups containing your data are purged on a rolling 90-day cycle.
Access tokens and identifiers received from Meta or Twilio are deleted as soon as the integration is disconnected. Message history received through a connected channel is retained as part of the firm's records for as long as the firm keeps it, and is deleted on the schedule above when the firm deletes it or closes its account.
10. Children's Privacy
Firmfy is not intended for use by individuals under the age of 18. We do not knowingly collect personal information from children. If we become aware that a child under 18 has provided us with personal information, we will take steps to delete such information promptly. If you believe a child has provided us with their data, please contact us at privacy@firmfy.com.
11. Changes to This Policy
We may update this Privacy Policy from time to time to reflect changes in our practices, technologies, or legal requirements. We will notify you of any material changes by posting the updated policy on our website and updating the "Last updated" date. We encourage you to review this policy periodically. Continued use of our services after changes are posted constitutes acceptance of the revised policy.
12. Contact Us
If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us at privacy@firmfy.com. We will respond to your inquiry within 30 days.