Privacy policy
Last updated: August 10, 2026.
This policy explains how SteerLegal ("SteerLegal," "we," "us," or "our") collects, uses, discloses, and protects personal data. It covers this website (steerlegal.com) and, once available, the SteerLegal legal practice-management application used by law firms ("firms") and the client portal used by firms' own clients ("portal clients").
Who we are and what this policy covers
SteerLegal is legal practice-management software built for solo and small law firms. Today, before the product is generally available, this site collects only the information described in the "Site visitors" section below (see "Waitlist" for what we collected before that program was discontinued on August 10, 2026). The "once the platform is live" sections describe how we will handle personal data once firms and their clients actually use the product, so this policy does not need to be rewritten from scratch at launch.
For data a firm stores in SteerLegal about its own clients (for example matter details, documents, or trust-ledger records), the firm is the data controller and SteerLegal acts as the firm's data processor or service provider. See Your data protection rights for what that means if you are that firm's client.
Information we collect
Site visitors
If you accept our cookie-consent banner, we use Google Analytics (GA4) to understand overall traffic to steerlegal.com: which pages are visited, how visitors arrive, and approximate location and device type derived from your IP address and browser. This is aggregate usage measurement, not an attempt to identify you personally. See Cookies and analytics for how that choice works.
Waitlist (discontinued August 10, 2026)
Until August 10, 2026, when you joined the waitlist we collected the email address you provided, the time you submitted it, and, optionally, where you came from (for example, which page or campaign linked here). We used this only to notify subscribers about SteerLegal's early access and launch; we did not sell it or share it with third parties for their own marketing. We stopped accepting new waitlist signups, removed the signup form from this site, and are deleting all previously collected waitlist data as part of that change. No further launch-notification emails will be sent to waitlist subscribers, because no waitlist now exists.
Firm staff accounts (once the platform is live)
When a law firm subscribes to SteerLegal, we collect its staff members' names, work email addresses, roles, and authentication data (a securely hashed password and, for firm staff, a required multi-factor authentication enrollment) to create and secure their accounts.
Client-matter data firms store in SteerLegal (once the platform is live)
A subscribing firm may enter and store, on its own clients' behalf, information such as: client/contact names and contact details; matter and case details; tasks and deadlines; documents and their contents, including documents received by connecting a firm mailbox; time and billing records; and trust (client-funds) ledger entries. This data is entered and controlled by the firm, not by SteerLegal; we process it only to provide, secure, and support the platform on the firm's behalf.
Portal clients (once the platform is live)
If a firm invites its client to SteerLegal's client portal (portal accounts are invite-only; there is no open registration), we collect that client's name, email address, and authentication data to create their portal account, and we display to them only the matter, document, invoice, and trust-ledger information their firm has authorized them to see.
Billing and payment data (once the platform is live)
We use a third-party billing provider to process a subscribing firm's payment for its own SteerLegal subscription; we do not store full payment-card numbers ourselves. A subscribing firm's client trust-fund payments, if the firm uses that feature, are handled by a separate, licensed payment processor under an agent-of-payee model; SteerLegal itself never holds or moves client funds, and this recordkeeping-only design is a structural, not just policy, control.
Support and communications
If you contact us for support or with a request under this policy, we collect what you send us (for example, your name, email address, and the content of your message) to respond.
How we use personal data
- To operate, maintain, and secure this website and, once live, the SteerLegal platform.
- Notified waitlist subscribers about early access and launch (discontinued August 10, 2026; see Waitlist).
- To create and authenticate firm-staff and portal-client accounts, and to enforce that each firm only ever sees its own data.
- To provide the features a subscribing firm uses (matters, documents, calendaring, billing, trust-ledger recordkeeping).
- To bill subscribing firms for their own use of SteerLegal.
- To detect, investigate, and prevent fraud, abuse, and security incidents.
- To measure and improve site and product usage, in aggregate.
- To comply with legal, regulatory, and recordkeeping obligations (including, where applicable, state bar recordkeeping rules for a subscribing firm's records).
Legal bases for processing (GDPR)
Where the GDPR applies (for example, because you are in the EEA, UK, or Switzerland), we rely on the following legal bases for each type of processing:
| Processing activity | Legal basis |
|---|---|
| Waitlist emails and launch notifications (discontinued August 10, 2026) | Consent (given at signup by prior subscribers; all such data has since been deleted) |
| Providing the SteerLegal platform to a subscribing firm and its authorized staff/portal users | Performance of a contract with the firm (or, for the firm's own clients, the firm's contract with them, which we support as processor) |
| Billing a subscribing firm | Performance of a contract; legal obligation (financial recordkeeping) |
| Site analytics, security monitoring, and fraud/abuse prevention | Legitimate interests (understanding and securing our site and service), balanced against your rights |
| Non-essential analytics cookies specifically | Consent, obtained from every visitor via our cookie-consent banner before Google Analytics loads (see Cookies below) |
Your data protection rights (GDPR)
If the GDPR applies to you, you have the right to:
- Access the personal data we hold about you.
- Rectify inaccurate or incomplete personal data.
- Eraseyour personal data, subject to legal and regulatory retention obligations (for example, a firm's state bar recordkeeping duties).
- Restrict or object to our processing of your personal data in certain circumstances.
- Port your personal data to another provider, where technically feasible.
- Withdraw consent at any time, where processing is based on consent (for example, the now-discontinued waitlist emails), without affecting processing already carried out.
- Lodge a complaint with your local data protection supervisory authority.
If your data is stored in SteerLegal by a law firm that uses our platform(for example, because you are that firm's client), that firm is the data controller and we act as its processor. Please direct your request to that firm first; if you contact us directly, we will forward your request to the relevant firm and support them in responding, rather than act on it unilaterally.
For any other request (for example, about a prior waitlist signup, your own firm-staff account, or this website), contact us using the details in Contact us.
California privacy rights (CCPA/CPRA)
If you are a California resident, the California Consumer Privacy Act, as amended by the California Privacy Rights Act (CCPA/CPRA), gives you the rights described below.
Categories of personal information
| Category | Examples we collect |
|---|---|
| Identifiers | Name, email address, IP address |
| Internet/network activity | Site usage and analytics data |
| Commercial information | Subscription and billing records |
| Professional information | Firm name and role, for firm-staff accounts |
| Other information a firm stores about its own clients (once the platform is live) | Matter, document, billing, and trust-ledger records; may incidentally include sensitive personal information depending on the matter (for example, health or immigration status), stored and controlled by the firm |
We do not sell or share personal information (as those terms are defined under the CCPA/CPRA, including for cross-context behavioral advertising) and have not done so in the preceding 12 months.
Your rights
- Right to know what personal information we collect, use, and disclose, and to request a copy of it.
- Right to delete personal information we hold about you, subject to legal exceptions (for example, a firm's recordkeeping obligations).
- Right to correct inaccurate personal information.
- Right to opt out of sale or sharing (not applicable today, since we do not sell or share).
- Right to limit use of sensitive personal information.
- Right to non-discrimination for exercising any of these rights.
You may exercise these rights, or designate an authorized agent to do so on your behalf, by emailing the address in Contact us. We will verify your request and respond within 45 days, extendable once by an additional 45 days where reasonably necessary, with notice to you. As with the GDPR rights above, a request about data a law firm stores about its own client is directed to, and actioned by, that firm.
International data transfers
SteerLegal is based in the United States, and the service providers listed above process data primarily in the United States. Where we transfer personal data out of the EEA, UK, or Switzerland, we rely on appropriate safeguards, such as Standard Contractual Clauses or a provider's certification under the EU-U.S. Data Privacy Framework, as applicable to that provider.
Data retention
- Waitlist emails were kept until you asked us to delete them, or until the waitlist was retired, whichever came first. We discontinued the waitlist and are deleting all previously collected waitlist emails and related data. Copies may persist in encrypted operational backups until those backups age out under their normal retention period.
- Site analyticsare retained under Google Analytics' own standard retention settings.
- Firm and client-matter data (once live)is never permanently deleted by an ordinary in-product delete action; deleting a record archives it, and archived records remain recoverable and auditable. Permanent deletion happens only through a governed process (for example, a firm's offboarding or a valid erasure request), and only after confirming no active legal, regulatory, or trust-accounting retention obligation applies. The specific retention period for client-matter and trust records (reflecting state bar and trust-accounting recordkeeping rules, which vary by jurisdiction) is configured per firm and finalized before real firms are onboarded.
Data security
We encrypt data at rest and in transit, isolate each firm's data from every other firm's at the database level, require multi-factor authentication for firm-staff accounts, and keep an append-only audit log of access to privileged data. No method of transmission or storage is perfectly secure, and we cannot guarantee absolute security.
Children's privacy
SteerLegal is a business tool for law firms and their clients and is not directed to children. We do not knowingly collect personal data from children under 16.
Changes to this policy
We may update this policy as our practices change, including as the platform moves toward general availability. We will update the "Last updated" date above when we do, and will provide more prominent notice for material changes.
Change log:
- August 10, 2026: Discontinued the waitlist. We stopped accepting new signups, removed the signup form from this site, and began deleting the email addresses and related data previously collected through it. See "Waitlist" above for what we collected while it was active.
Contact us
To exercise a privacy right, ask a question about this policy, or request deletion of your information, email us at roee.bar@iaig.com. (This will move to privacy@steerlegal.com once that mailbox is provisioned; the address above remains reachable in the meantime.) We have not appointed a statutory Data Protection Officer; the contact above is our designated privacy contact and we will appoint a formal DPO if our processing activities require one under Article 37 of the GDPR.
If you are a resident of a U.S. state other than California with a comparable privacy law, we will honor a request made under that law on the same basis as described above.