Long Law Client Portal — Privacy Policy

Last updated: 2026-06-08

1. Who we are

This Privacy Policy describes how Long Law, P.C. ("Long Law," "we," "us," "our") handles personal information collected through the Long Law Client Portal at portal.long.law (the "Portal"). Long Law is the data controller for personal information collected via the Portal.

This Privacy Policy is specific to the Portal. It does not describe the firm's overall handling of client matter information, which is governed by your engagement letter, the firm's professional-responsibility obligations under the rules of professional conduct in the states where we are admitted (currently New York, New Jersey, and California), and applicable state and federal law.

2. Information we collect through the Portal

Account and authentication information. When you log in, we collect:

• Your email address (used to send magic-link login links).
• The IP address and user-agent string of the device you log in from.
• The timestamp of each login attempt (successful or failed).
• The session identifier issued to you after a successful login.

Activity information. As you use the Portal, we record:

• Magic-link requests, deliveries, uses, and expirations.
• Documents you upload through the Portal.
• Documents you download or open through the Portal.
• Payment links generated for invoices in your matter.
• Chat interactions with the Portal's AI assistant features (if enabled for your matter).
• Failed-access attempts, including geographic blocks, rate-limit triggers, and any attempts to reach pages you are not authorized to view.

Matter information. The Portal displays information about your legal matters that is stored in Long Law's case-management system (Clio). The Portal acts as a window onto that information; the underlying record lives in Clio, not in the Portal.

Communications metadata. The Portal sends transactional emails to you (magic-link login links, document-ready notifications, payment receipts, and similar). We record the fact that these emails were sent and whether delivery succeeded.

Cookies. The Portal uses a single session cookie to keep you signed in during a browsing session. The cookie is configured with the Secure, HttpOnly, and SameSite=Lax attributes to limit exposure. The Portal does not use advertising or third-party tracking cookies.

We do not collect biometric data, precise GPS location data (beyond country-level inference from IP address), social-security numbers (except when you upload a document that contains them), or financial-account numbers (except through the payment flow, which is operated by Clio Payments, not by us).

3. How we use information

We use the information collected through the Portal to:

• Authenticate you and let you access your matter information securely.
• Provide the Portal's functionality (showing matters, documents, invoices, etc.).
• Send transactional communications (login links, document notifications, invoices, scheduling).
• Detect and respond to security incidents, fraud, and unauthorized access.
• Comply with our professional-responsibility obligations, including the duty to maintain reasonable safeguards for client information.
• Comply with applicable law and respond to lawful requests from courts, regulators, or law enforcement.

We do not sell your information. We do not use the Portal's data to target advertising to you, build profiles about you, or share your information with third parties for those parties' independent commercial purposes.

4. Third-party services the Portal uses

The Portal relies on the following third-party services. Each is selected for the specific function it performs; each receives only the data necessary for that function.

| Service | Purpose | What we send | |---|---|---| | Clio (clio.com) | Case-management platform; the system of record for matter, contact, document, and billing information | Contact, matter, document, and billing operations on your matter | | Microsoft Graph (microsoft.com) | Outbound email delivery (magic links, notifications) | Your email address, the subject and body of transactional emails | | Render (render.com) | Cloud hosting for the Portal application and database | All data the Portal needs to operate, including the items in Section 2 | | hCaptcha (hcaptcha.com) | Bot-protection challenge on the login page | The challenge response token your browser produces | | ip-api.com | Country-level lookup of your login IP address (used for the geographic-restriction feature and for staff alert decoration) | Your IP address | | DocuSign (docusign.com) | Electronic signature on engagement letters and statements of work via the Portal's checkout flow | Your name, email address, and the document being signed | | Calendly (calendly.com) | Scheduling consultations through the Portal | Your name, email address, the appointment time you select | | JotForm (jotform.com) | Lead-capture forms used in the public-facing parts of the Portal | The information you submit on the form (typically name, email, phone, message) | | Anthropic (anthropic.com) | AI features (chatbot, document summaries) | The portion of your matter content needed to answer your question; we do not send your full matter file unless you explicitly request it |

Each of these services has its own privacy policy that governs how it handles the data we send to it. We have selected services with privacy practices reasonably consistent with our professional-responsibility obligations. If you have specific concerns about any of them, we will discuss alternatives with you on a case-by-case basis.

We do not share Portal-collected information with any third party other than these service providers, except as required to comply with law, respond to a valid legal process, or protect against fraud, abuse, or threats to safety.

5. How long we keep information

• Login and session data (LoginLog, MagicLink records): retained for a period sufficient for security audits and incident response, currently up to 12 months, then purged or archived.
• Documents uploaded through the Portal: copied into Clio as part of your matter file and retained according to the firm's matter-retention policy (which is governed by state-specific bar rules — generally six to seven years after matter closure, longer for matters involving minors or guardianships).
• Activity logs: retained for security and audit purposes, with personally identifiable information aged out on a rolling basis.
• Matter data in Clio: governed by the firm's overall record-retention policy, not by the Portal's policy. Closing your matter does not automatically delete that data; legal-ethics rules require us to retain certain materials for a defined period.

If you have specific data-retention questions about your matter, ask your attorney.

6. Your rights

Depending on where you live, you may have specific rights with respect to the personal information the Portal holds about you. These include, depending on the applicable state or federal law:

• The right to know what categories of personal information we have collected about you and how we have used and shared it.
• The right to a copy of the specific personal information we hold about you (subject to exceptions for privileged or confidential material).
• The right to request that we delete personal information we have collected (subject to legal-ethics and other retention requirements that may prevent deletion of matter records).
• The right to correct inaccurate personal information.
• The right to not be subjected to discrimination for exercising these rights.

To exercise any of these rights, contact us at info@long.law or (315) 991-8000. We will verify your identity before responding to a request, and we will respond within the timeline required by the applicable law (generally 30 to 45 days, depending on jurisdiction).

For California residents specifically, the California Consumer Privacy Act provides additional rights including the right to opt out of certain sales of personal information. As stated above, we do not sell your information.

For New York residents, the New York Shield Act requires us to maintain reasonable security safeguards for personal information; this Privacy Policy and the Portal's security controls reflect our compliance with that obligation. The full list of safeguards is summarized in Section 8.

For New Jersey residents, similar consumer-protection and breach-notification obligations apply under state law.

These rights are subject to limitations imposed by professional-responsibility rules and other legal requirements. For example, certain attorney work product, communications protected by attorney-client privilege, and records the firm is required by ethics rules to retain may be exempt from deletion or disclosure requirements.

7. Children

The Portal is not directed to children under 16 and we do not knowingly collect personal information from anyone under 16 through the Portal. If a matter involves a minor (for example, a custody or guardianship case), portal access is given to the adult party who has authority to access the matter, not to the minor.

If you believe a minor has been given Portal access in error, contact us at info@long.law and we will revoke access promptly.

8. How we protect information

The Portal uses several security controls to protect personal information:

• Encryption in transit. All connections to the Portal use HTTPS. The Portal's session cookies require HTTPS.
• Magic-link authentication. No client passwords are stored or transmitted; access requires receipt of a one-time link emailed to the verified address.
• Session controls. Sessions time out after 30 minutes of inactivity.
• Rate limiting and bot protection. Login and verification endpoints are rate-limited per source IP and protected by a bot-detection challenge.
• Geographic restrictions. Logins from outside the United States are blocked by default; staff can whitelist specific source IPs for travelers.
• Service-account authentication for Clio. The Portal uses a dedicated service-account identity to authenticate to Clio, distinct from individual firm-member accounts. This provides clear audit attribution and supports prompt revocation in case of compromise.
• Matter-level access controls. Each client sees only matters explicitly designated as portal-accessible for their contact in Clio.
• Aggregated security alerting. Suspicious patterns (repeated failed access, contact-hijack attempts, unauthorized administrative access) trigger staff notifications.
• Kill Switch. Staff can put the Portal into a 503 maintenance state — manually, or automatically when high-confidence breach signals fire — to halt suspicious activity while assessing.
• Server-side credential storage. Production secrets live exclusively on the hosting provider's secret-management infrastructure, never on a developer device's disk.
• Quarterly credential rotation. High-sensitivity credentials are rotated on a documented schedule and in response to any suspected exposure.

No system can guarantee perfect security. If we discover a breach affecting personal information protected by an applicable state or federal breach-notification law, we will notify affected individuals in the manner and within the timeline required by that law.

9. Where information is stored

Personal information collected through the Portal is stored on hosting infrastructure operated by Render in the United States. The third-party services listed in Section 4 may store data on their own infrastructure, which in some cases may be located outside the United States. We have not implemented additional cross-border transfer mechanisms (such as standard contractual clauses) because the Portal is intended for use within the United States.

10. Changes to this Privacy Policy

We may update this Privacy Policy from time to time. When we make material changes, we will:

• Email Portal users who have logged in within the past 12 months.
• Update the "Last updated" date at the top of the published policy.
• For changes that materially expand the categories of information we collect or the third parties we share with, require re-acknowledgement on the next login.

11. Contact

Questions about this Privacy Policy, or about how we handle your information:

• Email: info@long.law
• Phone: (315) 991-8000
• Mail: Long Law, P.C. [firm mailing address]

If you believe we are not complying with this Privacy Policy or with applicable privacy law, you have the right to lodge a complaint with the relevant state attorney general's office (New York Attorney General's Bureau of Consumer Frauds and Protection, California Attorney General's Office, New Jersey Division of Consumer Affairs, etc., depending on the state in which you reside).