Privacy Policy

The short version

• Your bills, fee agreements and reports are used for one thing: checking your bills for you.
• We never sell your information, never use your documents for advertising, and never use them to train AI models.
• Nobody at Xenco Labs, Inc. can open your documents unless you grant a named person access, for up to 72 hours, and every page they open is logged.
• You can delete everything yourself, at any time, from your dashboard.

Who we are

CheckMyLawBill is a product of Xenco Labs, Inc., Pleasanton, California (Alameda County). We are the business responsible for your information. Questions, requests and complaints go to support@checkmylawbill.com.

What we collect

Your account

• Sign-in details: your name, email address and sign-in method, handled by our authentication provider, Clerk.
• Account details: the account name you choose and whether you check your own bills or clients’ bills.
• Your acceptance of these policies: which version of the Terms of Service and this policy you accepted, and when.

What you upload and enter

• Documents: legal bills and statements, fee agreements, rate notices, receipts and anything else you choose to upload, with the file name, size, type and a SHA-256 fingerprint of the file.
• What we read from them: the entries, dates, timekeepers, rates, hours, amounts and totals printed on each statement.
• What you tell us about a matter: its name, the firm, the client (for professional accounts), the rates you agreed to, the people on your bills and their roles, and what your agreement says about certain charges.
• What we produce for you: check reports, the questions they raise, and the clarification letter.

Legal bills describe private matters and often name other people, such as the lawyers and staff who did the work, opposing parties and courts. They can also contain information your lawyer treats as confidential or privileged. Upload only what you are entitled to share; see our Terms about privilege.

Waitlist, newsletter and support

• Sign-ups: your email address and, if you provide them, your name, what kind of legal bill you have, and whether you review bills for clients as a professional.
• Consent records: whether you joined the waitlist or agreed to the newsletter, the exact wording you agreed to, when, the browser user-agent at that moment, and when you unsubscribed.
• Messages you send us, including support requests.

Collected automatically

• Campaign and referral data: the UTM parameters and referring page stored with a sign-up.
• Server and security logs kept by our hosting provider, such as IP address, request time and the page requested.
• Product activity: counts and types of actions in the dashboard (for example, that a file was uploaded, a check was run, or a letter was copied). These records never contain the content of your documents.
• Google Analytics, on the public site only. On checkmylawbill.com we use Google Analytics to see which pages are read and how people arrive. It sets first-party cookies and receives your IP address, browser and device information and the pages you visit. Google signals and ad personalization are off, and we do not use the data for advertising. The dashboard sends no analytics page views or events. You can block analytics cookies in your browser or with Google’s opt-out add-on.

The dashboard uses only the cookies needed to keep you signed in. We do not use advertising cookies.

How we use it

• To provide CheckMyLawBill: read your bills, compare them with what you agreed to, show you the results, and draft the letter.
• To keep your account secure and to prevent fraud and abuse.
• To provide support, including when you grant support access.
• To find and fix problems, for example a bill layout we could not read. We do this from error details and counts, not by opening your documents.
• To tell you when CheckMyLawBill opens if you joined the waitlist, and to send the newsletter only if you opted in.
• To understand which channels bring people to the public site.
• To meet legal obligations and enforce our Terms.

We do not use your documents or what we read from them to train artificial intelligence or machine learning models, to build profiles about you, or for any purpose other than providing the service to you.

Who can see your documents

• You.
• Our staff only with your permission. Our staff tools show counts and error details, never document content. The account owner can grant one named person access for 24, 48 or 72 hours, and can end it early. Every page that person opens is recorded in an audit log.
• Our service providers, listed below, which store or process data for us under contract and may not use it for their own purposes.

Service providers

• Vercel hosts the website and the dashboard.
• Neon hosts our database.
• Cloudflare R2 stores the files you upload, in a private bucket that is not reachable from the internet without our credentials.
• Clerk provides sign-in and account security.
• Our document service, which we operate on our own servers, reads uploaded bills and produces the PDF reports and letters you download.
• Mautic, our self-managed email system, stores waitlist and newsletter contacts and sends email.
• Google Analytics measures use of the public site, and Google Fonts serves the site’s typefaces, so your browser requests them from Google.

We may also disclose information when the law requires it, such as in response to a valid subpoena or court order, to protect someone’s safety, or to protect our rights. Where the law allows, we will tell you before we disclose your documents so you can object. If Xenco Labs, Inc. is merged or sold, this policy continues to apply to the information transferred.

We do not sell your personal information and do not share it for cross-context behavioral advertising, as those terms are defined in California law.

How long we keep it

• Documents, statements, rates, reports and letters: until you delete them or delete your account.
• When you delete your account from the dashboard, we delete your uploaded files, then every record of your matters, documents, statements, rates, reports and letters, end any support access, and erase your account name and email. Database backups that could contain deleted data expire within 24 hours.
• What remains: a dated record that an account existed and was deleted, product activity counts, and the audit log, none of which contain document content.
• Waitlist and newsletter: while you remain subscribed. Consent records are kept as long as we need to show what you agreed to.
• Sign-in records are kept by Clerk until your account is deleted, then removed under Clerk’s own retention schedule.

Security

• All connections are encrypted in transit (HTTPS/TLS), and uploaded files are encrypted at rest by our storage provider.
• Each account’s data is separated in the database by row-level security, so one account’s queries cannot return another account’s rows.
• Files are uploaded straight to private storage with a short-lived, single-file link, checked against the file’s fingerprint, and downloaded only through your signed-in session.
• Database and storage credentials have only the permissions the service needs, and staff access to content requires your grant.

No system is perfectly secure. If a breach affects your personal information, we will notify you as required by California Civil Code section 1798.82 and other applicable law.

Your rights

Wherever you live, you can:

• See and download your documents and reports in the dashboard at any time.
• Correct what you entered, and delete any document or your whole account yourself.
• Unsubscribe from email using the link in any message.
• Ask us for a copy of your information, or to correct or delete it, at support@checkmylawbill.com.

California residents

Under the California Consumer Privacy Act, as amended by the California Privacy Rights Act, you have the right to know what personal information we collect, use and disclose, and to get a copy of it; to delete it; to correct it; to opt out of its sale or sharing (we do neither); and to limit the use of sensitive personal information (we use it only to provide the service you asked for). We will not discriminate against you for exercising these rights.

You or an authorized agent can make a request at support@checkmylawbill.com. We will confirm receipt within 10 business days, verify your identity by matching the request to the email address on your account, and respond within 45 days, or tell you if we need up to 45 more. Over the past 12 months we have collected the categories of personal information described in “What we collect”: identifiers (name, email address, IP address); records you provide (legal bills and related documents, which may include financial information); and internet activity on the public site. We do not draw inferences to build a profile of you. We disclose them only to the service providers listed above, for the business purposes described in “How we use it.”

Do Not Track and Global Privacy Control. Because we do not sell or share personal information, there is nothing for these signals to opt you out of. We honor Global Privacy Control as a request to opt out of sale and sharing should that ever change.

Children

CheckMyLawBill is for adults. You must be 18 or older to create an account, and we do not knowingly collect information from anyone under 18. If you believe a child has given us information, write to support@checkmylawbill.com and we will delete it.

Where data is stored

CheckMyLawBill is operated from the United States, and your information is stored and processed in the United States.

Changes

If we change this policy, we will update the effective date above. If the change is material, we will tell you by email or in the dashboard before it takes effect. See also our Terms of Service.

Contact

Xenco Labs, Inc., Pleasanton, California. support@checkmylawbill.com