Associate Privacy Policy

Last updated: November 7, 2026

1. Who we are and what this policy covers

This Privacy Policy explains how JSO Digital, the company behind Associate ("Associate," "we," "us" or "our") collects, uses, shares and protects information in connection with the Associate service, available at associate.law (the "Service"). Associate is marketing software for law firms.

This policy applies to:

• visitors to associate.law and our related websites;
• law firms and other organizations that subscribe to the Service ("Customers"), and their authorized team members; and
• information we receive when a Customer connects third-party accounts, such as Google, to the Service.

When we process information on a Customer's behalf, including data from accounts the Customer connects, we act as the Customer's service provider and process that information under our agreement with the Customer and this policy. If you are a client or prospective client of a law firm that uses Associate, please contact that firm about its own privacy practices.

Associate is a business service. It is not directed to individuals under 16, and we do not knowingly collect personal information from them.

2. Information we collect

Information you give us. Name, email address, phone number, firm name, job title, billing details and the content of your communications with us. Customers also give us information about their firm: offices, practice areas, competitors, marketing goals, and documents they upload to the Service.

Information from connected accounts. Customers may connect third-party accounts so the Service can analyze and improve their marketing. Connections are made by the Customer's authorized team member, are limited to the access shown on the consent screen, and can be revoked at any time. Depending on what a Customer connects, this may include:

• website content management systems, such as WordPress;
• compatible services connected through a custom connection, such as reporting and local search tools.

Custom connections vary by service. The information available depends on the access you grant and the account or location selected during setup. A connection does not automatically limit all results to anonymous statistics.

Google user data. When a Customer connects a Google account, we access only the data needed for the features the Customer uses:

Associate can read information and prepare supported changes within the property, account or location selected for the Customer. Each Google change requires an authorized team member to review and approve the specific request before it is carried out. Connecting Google or turning on Allow changes does not approve an individual change. Available actions depend on the permissions granted, the user's Google account role and Google's API availability; not every Google action is supported. Existing read-only connections may need to be reconnected before changes are available.

We ask for the narrowest Google permissions that support these features. These Google connections do not request access to Gmail, Google Drive, Calendar or Contacts.

Client and case information. Associate is a marketing service, not a repository for confidential client or case information. Customers should not upload, paste or connect privileged or confidential client information. Content you submit in chat, attach in files or make available through connected services may be processed by our AI providers to answer your requests. The Service does not automatically anonymize every record, hash phone numbers or restrict AI analysis to totals. Choose connected accounts and source permissions accordingly.

Information collected automatically. When you visit our websites or use the Service, we collect device and usage information such as IP address, browser type, pages viewed and referring URLs, using cookies and similar technologies. You can control cookies through your browser settings.

Public information. To provide competitor and market analysis, the Service reviews publicly available information, such as public websites, business listings, reviews and search results.

3. How we use information

We use information to:

• provide, operate and maintain the Service for the Customer that connected or supplied it;
• generate reports, recommendations and draft content for the Customer's review and approval;
• prepare supported changes through compatible connections, including Google, and carry them out only after an authorized team member approves the specific request; we retain records of requests, approvals and results, and reversal depends on the connected service;
• secure the Service, prevent fraud and abuse, and fix problems;
• communicate with you about the Service, billing and support;
• send marketing about our services, which you can opt out of at any time; and
• comply with law and enforce our agreements.

How we use AI. The Service currently uses Anthropic's paid API to analyze information and prepare work for the Customer. Information sent for a request may include conversation history, firm background, relevant file content and information from connected services, including Google reports, settings, proposed changes and their results. Credentials are not supplied to AI models. We use commercial API services whose terms do not use Customer inputs and outputs to train general-purpose models by default, and we do not opt Customer data into that training. Do not include confidential client or case details in information you ask the assistant to process.

No training on Customer data. We do not use Customer data, including Google user data, to train or improve general-purpose AI or machine learning models. We may use aggregated and de-identified information, which cannot reasonably be linked to a Customer, an individual or a law firm's clients, to operate, measure and improve the Service and to publish industry research. Google user data is excluded from published research and remains subject to the Limited Use commitments below. When we publish research, we never identify a Customer or present a Customer's weaknesses by name without permission.

We do not sell personal information and we do not share it for cross-context behavioral advertising.

Google API Services: Limited Use

Associate's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Specifically, we:

1. use Google user data only to provide or improve the user-facing features of the Service that the Customer has chosen to use;
2. transfer Google user data to others only as needed to provide or improve those features, to comply with law, for security purposes, or as part of a merger, acquisition or sale of assets with notice to users;
3. do not use or transfer Google user data to serve advertisements, including retargeting, personalized or interest-based ads;
4. do not sell Google user data or use it to determine creditworthiness or for lending purposes;
5. do not allow humans to read Google user data, except with the Customer's affirmative consent for specific data, where needed for security, to comply with law, or where the data is aggregated and anonymized for internal operations; and
6. do not use Google user data to develop, improve or train generalized AI or machine learning models.

4. How we share information

We share information only:

• with service providers that host, secure and support the Service (for example, cloud hosting, AI model providers, email delivery and payment processing), under contracts that limit their use of the information to providing services to us (a current list is available on request);
• with the Customer's own connected tools, when an authorized team member directs or approves it;
• within our team at JSO Digital, which provides the strategy, review and support services that are part of the Service, on a need-to-know basis;
• for legal reasons, when required by law, legal process or to protect the rights, property or safety of our Customers, us or others; and
• in a business transfer, such as a merger, acquisition or sale of assets, subject to this policy.

5. Retention and deletion

We keep Customer data for as long as the Customer's account is active. When a Customer disconnects an account, we stop new access through that connection. Disconnecting does not by itself delete previously imported reports, chat history, files or records of earlier activity. Account closure and data deletion are handled by our team on request, rather than by an automatic deletion control in the Service. When a Customer closes their account, we delete or de-identify its Customer data, including Google user data, promptly following the export period described in our Terms, except where we must keep it longer to comply with law, resolve disputes or enforce our agreements. Backup copies may remain until the applicable backup retention period expires.

You can revoke Associate's access to your Google account at any time at myaccount.google.com/permissions, or ask us to delete your data by emailing us at the address in Section 10.

6. Security

We use administrative, technical and physical safeguards designed to protect information, including encryption, access controls, least-privilege permissions, and logging of changes. Credentials saved through connection setup are encrypted and are not included in the information supplied to AI models. Do not paste passwords or access keys into chat or upload them in files. No method of transmission or storage is completely secure, so we cannot guarantee absolute security. If we confirm a security incident affecting your information, we will notify affected Customers without undue delay and as required by law.

7. Your choices and rights

• Account information: you can review and update it in the Service or by contacting us.
• Marketing email: use the unsubscribe link in any message.
• Connected accounts: disconnect them in the Service or through the third party's settings.

Depending on where you live, including California, you may have the right to know what personal information we hold about you, to access, correct or delete it, and not to be discriminated against for using these rights. We honor these requests whether or not the law where you live requires it. To make a request, email us at the address in Section 10. We will verify your request before responding. If we hold your information on behalf of a Customer, we will refer your request to that Customer.

Do Not Track and Global Privacy Control. Our websites do not respond to browser Do Not Track signals, because there is no common standard for them. We treat a Global Privacy Control signal as a request to opt out of any sale or sharing of personal information, although we do not sell or share it.

8. International use

The Service is operated in the United States. If you use it from outside the United States, your information will be processed in the United States.

9. Changes to this policy

We may update this policy from time to time. If we make material changes, we will notify Customers by email or in the Service before they take effect. The date at the top shows when it was last updated.

10. Contact us

For questions or requests about privacy, email hello@associate.law.