1. Two kinds of information
It helps to separate two things.
- Account information is about you as a user: your email address, name, sign-in details, and how you use the Service. We decide how this is handled, and this policy describes it.
- Matter content is what you and other members put into a matter: financial statements, tax documents, the values read from them, timeline dates, notes, and requests. The matter owner decides what goes in and who may see it. We process it only to provide the Service, on the owner’s instructions, as described in the Terms of Service.
2. What we collect
| Information | Where it comes from |
|---|---|
| Email address, name, and profile photo | You, when you create an account, or your Google account if you sign in with Google |
| Phone number | You, only if you enroll a phone as a second factor for sign-in |
| Uploaded documents | You or another member of a matter. Statements typically contain names, addresses, full account numbers, balances, and transactions |
| Values read from documents | Produced by the Service from the documents: institution, account type, last four characters of the account number, period, balances, transactions, and account holder names |
| Matter details | Entered by members: matter name, discovery period, marriage, separation, and valuation dates, jurisdiction, assets, notes, and document requests |
| Audit trail | Generated by the Service: who did what and when, including the IP address of sign-ins and downloads |
| Billing information | Stripe, our payment processor, handles card details. We store your Stripe customer reference, subscription status, and document counts |
| Messages to us | You, when you write to support or legal |
We do not collect information from advertising networks or data brokers, and we do not use analytics trackers on the Service.
3. How we use it
- To run the Service: store documents, read them, organize them by account and period, show what is missing, and build exports.
- To control access: check that each request comes from a signed-in member of the matter with permission for the action.
- To keep records: the audit trail exists so that anyone can see what happened to a record and when. That is part of what the Service is for.
- To bill: count processed documents and charge the matter owner.
- To communicate: invitations, changes to your access, security notices, processing summaries, and export-ready notices. You can turn the last two off under Account & security.
- To protect the Service and comply with law.
We do not sell personal information, do not use it for advertising, and do not use your content to train machine-learning models.
4. Automated reading and AI
When a document is uploaded, two steps happen automatically. First, a document-parsing service converts the file to text. Second, an AI model reads the first pages of that text and identifies the institution, account, statement period, balances, and account holders. A rule-based reader does the same job independently, and the two results are compared. Disagreements and low confidence are flagged for a person to review.
Both providers process your documents under contracts that limit use to providing the service to us, and neither uses your content to train its models. Every value the AI produced is marked as such, carries a confidence level, points to the page it came from, and can be corrected by a member. No decision is made about a person by the Service alone; it organizes records for people to act on.
5. Who can see information
Members of a matter. The matter owner invites members and sets each one’s role. What a member can see and do depends on that role; for example, some roles cannot see transactions or notes marked for the legal team. Audit entries show members who did what.
Service providers. We use a small number of providers to run the Service. Each is bound by contract to use information only to provide its service to us.
| Provider | What it does for us |
|---|---|
| Google Cloud and Firebase | Hosts our database, document storage, sign-in, and document processing. Data is stored in the United States |
| Vercel | Hosts the web application |
| LlamaIndex (LlamaParse) | Converts uploaded files to text |
| Anthropic | AI model that reads document text to identify accounts, periods, and amounts |
| Stripe | Payments and invoicing. Stripe holds card details; we never see them |
| Resend | Delivers our emails |
Legal requirements. We disclose information when the law requires it, such as in response to a valid subpoena or court order. Where permitted, we will tell the matter owner before we do.
Business changes. If Visit Proof LLC is acquired or merges, information may transfer to the new owner under this policy. We will tell you before that happens.
6. Cookies
We use one cookie of our own: a session cookie, set when you sign in, that keeps you signed in for up to 7 days. It is HTTP-only and cannot be read by scripts. Our sign-in provider, Firebase Authentication, may store sign-in state in your browser. Your theme preference is kept in your browser’s local storage. We do not use advertising or analytics cookies.
7. How long we keep information
| Information | Kept for |
|---|---|
| Documents and extracted values | Until a member deletes them or the matter is deleted. Deleted documents are recoverable for 30 days, then removed |
| Export archives | 7 days after they are built |
| Invitations | 14 days if not accepted |
| Audit trail | The life of the matter |
| Account information | While your account exists, then deleted within 30 days of your request, except what we must keep for billing, legal, or security reasons |
| Billing records | As required by tax and accounting law, typically 7 years |
8. How we protect it
- Documents are stored in a private bucket. Browsers never access storage or the database directly; every read goes through our servers, which check the requester's membership and permissions first.
- Data is encrypted in transit and at rest.
- Every upload, download, correction, merge, and export is recorded in the matter's audit trail.
- Export files carry SHA-256 hashes so a recipient can prove a file was not altered.
- Multi-factor authentication is available to every account, and we recommend it for everyone who handles financial records.
- Document processing runs in isolated, short-lived cloud functions with access to only the document being processed.
If a security incident affects your information we will notify you as the law requires and as quickly as we reasonably can.
9. Your choices and rights
- You can see and correct your account information in the Service.
- Members with permission can delete documents and matters, and correct any extracted value.
- You can turn off processing summaries and export notices under Account & security. Invitations, access changes, and security notices are part of the Service and cannot be turned off.
- You can ask for a copy of your account information, or ask us to delete your account, by writing to privacy@discoveryvault.io. We respond within 30 days.
If you live in California, you have the right to know what personal information we collect and how we use and share it, to request its deletion or correction, and not to be discriminated against for exercising those rights. We do not sell or share personal information for cross-context behavioral advertising. Residents of other states with similar laws have the same rights with us. To exercise them write to privacy@discoveryvault.io. We will verify your identity, and you may use an authorized agent.
Information about a person inside a matter is controlled by the matter owner. If you are such a person and want to exercise a right over that information, we will refer your request to the owner or help you reach them.
10. Where information is stored
The Service is operated from the United States and information is stored there. If you use the Service from elsewhere you understand that your information is transferred to and processed in the United States.
11. Children
The Service is for adults handling legal matters. We do not knowingly collect account information from anyone under 18. Documents inside a matter may refer to minors, for example in a custody case; that content is controlled by the matter owner under the Terms of Service.
12. Changes to this policy
When we change this policy we update the effective date at the top. For material changes we will give notice by email or in the Service at least 30 days before they take effect.
13. Contact
Visit Proof LLC
Privacy questions and requests: privacy@discoveryvault.io
Support: support@discoveryvault.io