Privacy Policy

1. Who we are

The Service is operated by Majd Rezik, a sole proprietor in Israel (the "Operator", "we", "us"). For any privacy matter: support@orech.co.il.

2. Who is responsible: the Firm as controller, the Operator as processor

The Service holds two kinds of data, with different responsibilities:

• Firm Content – data that a law firm and its users upload to or create in the Service, such as details of the Firm’s clients, cases, documents, notes, events and tasks, and data about third parties. For this data the Firm is the database owner (controller) and decides the purposes of processing; the Operator is a "holder" (processor) that processes the data on the Firm’s behalf and only on its instructions, within the meaning of the Privacy Law.
• Account and usage data – details of the Firm’s users (such as name, email and role), the Firm’s billing details, and technical data about use of the Service. For this data the Operator is the controller.

Clients of a law firm and other data subjects whose data is held in the Service should first contact the law firm, which is responsible for the data and for answering their requests. If such a request reaches us, we will forward it to the Firm and help it respond.

3. What data we process

• Sign-up and account details: name, office name, email address, password (stored only as a one-way hash), preferred language, role in the Firm, and two-factor authentication settings (the secret is stored encrypted).
• Firm Content: everything the Firm uploads or creates – clients, cases, documents and files, text extracted from them, summaries, AI assistant conversations, calendar, tasks, notes, templates, payment demands and more. This content may include data of special sensitivity (such as information about legal proceedings, health or finances).
• Sharing and signing data: when the Firm shares a document or sends one for signature, the recipient or signer details the Firm entered are stored, as is every view, download, upload or signature through the link – including time, IP address and browser type – for record-keeping and verification.
• Security and activity logs: sign-ins, significant actions in the Firm (such as deletion, export and permission changes), IP address and browser type. The audit log is kept as a signed hash chain so that it cannot be altered without detection.
• Billing data: the Plan, number of users, invoice requests, payments and invoices issued.
• AI usage data: amount of use (tokens, cost, type of action) for credit accounting and cost control. This record does not include the content of documents or questions.
• Technical and error data: technical error reports (via Sentry), without identifying details and without document content.

4. Why we use the data

• to provide the Service to the Firm and on its instructions, including storing, searching, summarising and processing Firm Content;
• to manage the account, permissions and billing and to issue invoices;
• for information security, abuse prevention, monitoring and logging, and to detect and fix faults;
• to provide support and answer enquiries;
• to send operational messages (such as security, billing and terms-change notices);
• to comply with legal obligations.

We do not sell personal data, we do not use Firm Content for advertising, and we do not use Firm Content to train artificial-intelligence models.

5. Artificial intelligence

The Service’s AI features run on Anthropic’s API (Claude models). When a user uses such a feature, only the data it needs is sent to Anthropic:

• Document summary: the document’s text and, for a scanned document, images of its pages for text recognition (OCR).
• AI assistant: the user’s question, relevant passages from the Firm’s documents found by search, and case context (such as title, court, status, events, tasks and notes). Case context excludes billing data and the client’s ID number, phone and email.

A document can be kept in the Service without AI processing; such a document is not sent to Anthropic. Search in the Service runs in our own database and does not require sending data to an outside provider.

Under Anthropic’s commercial API terms, Anthropic does not use data sent to it to train its models and retains it only for a limited period for operational and safety purposes, in accordance with its policies.

The Firm should consider whether its clients’ consent to AI processing is required. The Service includes an "Informed consent to the use of AI tools" template for the Firm’s use. AI Output is not legal advice and must be reviewed, as set out in the Terms of Service.

6. Sub-processors

We use the following service providers to run the Service. Each receives only the data it needs for its role and is bound to us by confidentiality and data-security obligations:

We will update this list when we add or replace a sub-processor. We will notify Firm owners in advance before adding a sub-processor that processes Firm Content.

7. Transfers outside Israel

Some sub-processors process data outside Israel, mainly in the European Union and the United States. These transfers are made in accordance with the Protection of Privacy Regulations (Transfer of Data to Databases Abroad), 5761-2001: EU member states have data-protection laws recognised as adequate, and for transfers to the United States we rely on the providers’ contractual commitments to protect and secure the data and not to transfer it onward except to provide the service.

Encrypted backups are stored in Israel.

8. Information security

We take organisational and technical measures to protect data, in accordance with the Protection of Privacy Regulations (Data Security), 5777-2017, including:

• encryption of all communication (HTTPS/TLS) and encryption at rest by our storage providers;
• full logical separation between Firms – every request is limited to the user’s own Firm data;
• passwords stored as one-way hashes; the sign-in session is kept in a secure (HttpOnly) cookie and ends after inactivity;
• two-factor authentication (TOTP) for every user, which Firm owners can require for all users;
• a signed audit log and security alerts for Firm owners;
• random, time-limited and revocable sharing and signing links, stored encrypted;
• encrypted backups every few hours, with periodic restore drills;
• Operator access to Firm Content only where needed for operation, security or support the Firm requested.

No system is completely secure. If a serious security incident affects Firm Content, we will notify the Firm without undue delay, provide the information it needs to meet its own obligations (including reporting to the Privacy Protection Authority as the regulations require), and act to limit the harm.

9. Retention and deletion

• While the account is active, Firm Content is kept until the Firm deletes it.
• A deleted item moves to "Recently deleted" and is kept there for 30 days so it can be restored. It is then permanently deleted, with its files, by a daily automatic process. Items in a case marked with a legal hold are not deleted until the hold is removed.
• Encrypted backups are kept for up to 35 days and then deleted, so deleted data may remain in backups until that period ends.
• A data export is available for download for 7 days and is then deleted.
• Account closure: after the subscription ends the account becomes read-only and all data can be exported from it. At a Firm owner’s request, or if the account is not renewed within 90 days after the subscription ends, we will delete Firm Content from production systems within 30 days, and it will be removed from backups at the end of the backup cycle. We will notify Firm owners before any deletion they did not request.
• We keep data beyond this only where the law requires it – for example billing records and invoices, which are kept for the period required by tax law.
• Demo offices (the "Try it now" environment) contain fictitious data and may be deleted at any time.

10. Your rights

Under the Privacy Law, a person may inspect data about them held in a database and request correction or deletion of data that is not correct, complete, clear or up to date. You may also ask us to stop sending you marketing messages, if any are sent.

• Users of the Service can view and correct most account details on their profile screen. For other requests about account data, contact support@orech.co.il. We will respond within 30 days.
• Firm owners can at any time produce a full export of the Firm’s data from the office settings screen (on every Plan), and delete data in the Service.
• Clients of a law firm and other data subjects in Firm Content: please contact the law firm, which is the database owner (see section 2). We will help the Firm respond.

If you are not satisfied with how your request was handled, you may contact the Privacy Protection Authority at the Israeli Ministry of Justice.

11. Cookies and browser storage

The Service uses one strictly necessary cookie to keep you signed in, and the browser’s local storage to remember preferences (such as language and display). We do not use advertising cookies or third-party marketing trackers.

To improve the Service we keep first-party usage statistics, without cookies or third-party tools: a random identifier in the browser’s local storage, which screens were viewed (without ids, names or document content), a coarse device type, language, country and referring site. We do not store IP addresses, and raw events are deleted after 13 months. Browsers set to “Do Not Track” or GPC are not counted.

12. Minors

The Service is intended for lawyers and their firms and not for minors. Data about minors may be included in Firm Content as part of legal work; in that case it is the responsibility of the Firm as the database owner.

13. Changes to this policy

We may update this policy. We will notify Firm owners of a material change by email or in the Service before it takes effect. The date of the latest update appears at the top of this page.

14. Contact

Privacy questions, requests and complaints: support@orech.co.il. Majd Rezik (sole proprietor), Israel.