Tyto Legal (“Tyto”, “we”) is practice management software for law firms and other professional practices, provided at tytolegal.com. This policy explains what information we handle, why, and the choices you have. It applies to the firms that subscribe to Tyto (“customers”), the people at those firms who sign in (“users”), and the clients of those firms who use the client portal (“portal users”).
The firm controls its data
A customer firm decides what to put into Tyto: matters, contacts, documents, time, billing and trust records. That information belongs to the firm. The firm is the controller of it and we process it on the firm’s instructions to provide the service. If you are a client of a firm that uses Tyto and have questions about how your information is handled, contact the firm.
What we collect
- Account information. Name, work email address, job title, role and a password hash for each user.
- Practice data entered by the firm. Matters, parties, contacts, documents and their extracted text, notes, tasks, calendar events, time entries, expenses, invoices, payments and trust ledger entries.
- Portal users. Name, email address and, where the firm records it, phone, address and date of birth, together with the invoices and matters the firm associates with you. Signing in to the portal uses a link emailed to you; no password is stored.
- Usage and technical information. Server logs with IP address, browser type, pages requested and timestamps, kept for security and troubleshooting.
- Email delivery information. For messages we send on a firm’s behalf, the recipient address, subject, and delivery, bounce or complaint status reported by our email provider.
- Electronic signature records. When a document is signed through Tyto, the signer’s name, email, IP address, browser, timestamps, consent to sign electronically and a hash of the document as signed.
How we use it
- To provide the service: storing and displaying the firm’s data, sending the emails the firm asks us to send, generating documents and bills, and running deadline and reminder schedules.
- To provide AI assistance when a firm enables it. See “AI features” below.
- To keep the service secure: authentication, abuse prevention, audit trails and backups.
- To communicate with users about the service, such as notifications they have switched on, password resets and important changes.
We do not sell personal information and we do not use customer data for advertising.
AI features
Firms can enable an assistant that reads matter data and documents to answer questions, extract information, draft text and review documents. When a firm uses these features, the relevant text is sent to a third-party model provider to generate a response. Every request is logged with its model, cost and outcome so the firm can audit it. Firms control whether the assistant may write to records, and can turn the assistant off entirely. We do not use customer data to train models.
Which providers. Model requests are sent through OpenRouter to Anthropic models, and are pinned to Anthropic’s own API with no fallback to any other host. Every request also carries OpenRouter’s no-data-collection setting, which refuses any upstream that retains or trains on prompts, and our OpenRouter account has prompt logging and training disabled. Anthropic’s commercial API terms do not permit training on customer inputs. No other AI or machine learning service receives customer data.
What is never sent to a model. Information obtained from Google Calendar is never sent to any AI or machine learning service, ours or a third party’s. The only Google Calendar data the service handles is the list of a user’s calendars and free/busy intervals, which are used solely to decide which appointment slots to offer and are not stored or used for any other purpose.
Third-party services
We use a small number of providers to run the service. Each receives only what is needed for its job:
- Hosting and storage. Our servers and file storage, where all customer data is kept.
- Email delivery. A transactional email provider that sends messages on the firm’s behalf and reports delivery status.
- AI model providers. Only when a firm enables AI features, and only the text needed for the request.
- Google Calendar. If a user connects their Google account, see “Google Calendar” below.
- QuickBooks Online. If a firm connects QuickBooks, we send invoices, payments and trust journal entries to the firm’s own QuickBooks company and read its chart of accounts. We store the OAuth tokens Intuit issues, encrypted, and the identifiers of the QuickBooks records we create. We never receive QuickBooks credentials. A firm can disconnect at any time from Settings, or from within QuickBooks; disconnecting revokes the tokens and we delete them.
Google Calendar
A user at a firm can choose to connect their Google account so that Tyto can work with their Google Calendar. Connecting is optional, is done by that user for their own account through Google’s sign-in and consent screen, and can be undone at any time.
What we ask for. We request two Google Calendar permissions: to see the user’s calendars and when they are busy (calendar.readonly), and to add, change and remove events on the calendar they choose (calendar.events).
What we access and why.
- The list of the user’s calendars, so they can choose which ones to use.
- The busy times on the calendars the user selects, so that a booking page does not offer an appointment at a time they already have something. We use Google’s free/busy lookup for this. We do not read or store the titles, descriptions, attendees or other contents of the user’s existing Google events.
- The calendar the user chooses to write to, so that events created in Tyto, such as hearings, meetings and appointments booked through a booking page, also appear on their Google Calendar. When such an event is changed or deleted in Tyto, we update or remove the copy we created. We do not change events we did not create.
What we store. The email address of the connected Google account, the OAuth tokens Google issues (encrypted at rest), the identifiers of the calendars the user selected, and the identifiers of the events we created on their calendar so we can keep those in step. We do not store the contents of the user’s Google Calendar.
How it is shared. Google Calendar data is used only to provide the features above for the user who connected the account and, for busy times, to decide which appointment slots to offer on that user’s booking pages. It is not sold, not used for advertising, not used to train AI models, and not shared with anyone else, other than the hosting providers that run the service.
Disconnecting. The user can disconnect from the Calendar page in Tyto, which deletes the stored tokens and calendar identifiers from Tyto and asks Google to revoke our access. Access can also be removed from the Google account’s security settings at myaccount.google.com/permissions. Events already copied to Google Calendar stay there; they belong to the user.
Tyto’s use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
Security
- All traffic to and from Tyto is encrypted in transit with TLS.
- Passwords are stored only as salted hashes. Third-party access tokens are encrypted at rest.
- Each firm’s data is separated from every other firm’s at the database layer, and access within a firm follows the roles and matter-level permissions the firm sets.
- Sign-in links, password reset links and portal links are single-use and expire within an hour.
- Trust ledger entries are append-only; corrections are recorded as new entries so history can always be reconstructed.
No system is perfectly secure. If we learn of a breach affecting your data we will notify affected customers without undue delay and tell them what we know.
Retention and deletion
We keep a firm’s data for as long as the firm subscribes. When a subscription ends, the firm may export its data and ask us to delete it; we delete it within thirty days, except for backups, which expire on their own schedule, and records we are legally required to keep. A user or portal user who wants their personal information corrected or removed should ask the firm, which can act in Tyto directly or ask us to help.
Your choices
- Users can change their name, email address, password and which notifications they receive from Settings.
- Portal users receive only the emails the firm sends them and sign-in links they request themselves.
- Firms control AI features, integrations and email reminders for their own account. Each user controls whether their own Google Calendar is connected.
Cookies
Tyto uses only the cookies needed to keep you signed in and to protect forms against forgery. We do not use advertising or tracking cookies.
Children
Tyto is a business service and is not directed at children. Firms may record a client’s date of birth where their work requires it; that information is handled as practice data under the firm’s control.
Changes
We will post any changes to this policy here and update the date above. Material changes will be announced to customer firms by email.
Contact
Questions about this policy or a request about your information: support@tytolegal.com.