Privacy Policy

Plain-English summary.

VFL Toolkit is designed so that matter data is stored locally on your device by default. We do not provide a developer-hosted cloud database for your matter data. If you choose to connect your own Dropbox account, eligible matter documents and manifests synchronize two-way through your Dropbox, and — if you turn on firm sharing — selected matters can be shared with the teammates you invite; your files stay in your own Dropbox, not in a database operated by us, and your Dropbox sign-in token is kept only in your device's Keychain. If you export a full backup, the .vfltbackup file is created locally and shared only where you direct it. If you opt into the Hosted Intake Service, the server stores only your account email, your public key, a password-wrapped copy of your private key, and encrypted client submissions — it never holds your password or readable client data. The App's optional on-device AI features (Apple Intelligence) run entirely on your Device — no matter data is sent to us, to Apple, or to any other server for those features to function.

This Privacy Policy is written for licensed Virginia attorneys and, where permitted under the Terms of Use, their authorized staff using VFL Toolkit as professional productivity software. It governs the limited categories of information that we collect, receive, maintain, or otherwise control in connection with the App and our related websites. It also describes how the App is designed to handle matter data that remains under your control on your own device.

§ 1 Who we are

VFL Toolkit is published by Burroughs Law Office, P.C., a Virginia professional corporation. In this Privacy Policy, "we," "us," and "our" refer to Burroughs Law Office, P.C. "You" and "your" refer to the attorney subscriber using VFL Toolkit and, where applicable, that attorney's authorized employees, contractors, paralegals, or staff acting under the attorney's supervision and authority.

1.1 Professional-use tool

VFL Toolkit is a professional productivity tool intended for use in connection with Virginia family-law practice. It is not offered as a consumer legal service, pro se legal aid product, or public-facing client portal except to the limited extent you choose to use attorney-controlled intake features for your own clients. If you use the App on behalf of a law firm or other organization, you represent that you have authority to do so.

1.2 Not directed to children

VFL Toolkit is not directed to or intended for use by children. We do not knowingly collect personal information directly from children under 13 through the App or our websites.

§ 2 Definitions

For purposes of this Privacy Policy:

"App"
means the VFL Toolkit application for iPhone, iPad, and Mac. A separate Windows application, with its own billing and platform-specific terms, is in development.

"Device"
means the Apple device on which you install or use the App.

"Matter data"
means information you create, import, store, or manage in the App in connection with legal matters, including client and party information, financial information, court information, notes, documents, calculations, deadlines, and similar case-related content.

"On-device"
means data stored locally on your Device rather than in a cloud environment operated by us.

"Dropbox sync"
means optional two-way synchronization of matter documents and manifests through a Dropbox account you connect, including optional firm sharing of selected matters with teammates you invite.

"Backup export"
means a user-directed .vfltbackup file containing user-owned app data and safe restorable settings that you choose to save, share, or store outside the App.

"Integration"
means an optional connection between the App and a third-party service, such as Dropbox (matter sync and firm sharing) or LawPay (AffiniPay).

"Credentials"
means usernames, passwords, tokens, secrets, keys, or similar authentication data used to enable an Integration.

"Personal information"
means information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked with a particular person, to the extent applicable law uses that concept.

§ 3 Scope of this policy

This Privacy Policy applies to personal information that we collect, receive, maintain, use, or disclose in connection with:

• your use of the App; and
• our marketing, informational, and support websites, including vfltoolkit.com.

This Privacy Policy also describes, for transparency purposes, how the App is designed to handle matter data that remains on your Device or is transmitted by you to third-party services you authorize.

This Privacy Policy does not govern:

• third-party services or platforms that you connect or use, including Apple, the App Store, Dropbox, LawPay (AffiniPay), Apple Calendar, email providers, file-hosting services, or any other third-party tools;
• your own collection, storage, use, disclosure, or safeguarding of your clients' information;
• information or files after you export, download, transmit, print, email, upload, or otherwise move them outside the App, except to the extent we separately receive or control that information.

§ 4 What data we handle — and where

VFL Toolkit is designed so that most matter data remains on your Device unless you affirmatively use a feature that transmits data elsewhere. The categories below describe the principal types of information the App processes and, where applicable, whether that information remains local, is sent to a third party you authorize, or is received by us.

4.1 Matter data — local by default

Matter data is intended to be stored locally on your Device by default. We do not provide a developer-hosted cloud database for your matter data. Matter data generally remains on your Device unless you choose to export it, include it in a backup bundle, sync it through your own Dropbox, transmit it through an Integration, submit it through an attorney-configured endpoint, or otherwise move it outside the App. Billing, time-tracking, and trust-accounting records you create in the App are matter data for purposes of this Policy: they are stored on your Device (and synchronized through your own Dropbox only if you connect it) and are not transmitted to us.

4.2 Dropbox sync and firm sharing — optional

If you connect your own Dropbox account, the App can synchronize matter documents and manifests two-way between your devices, and — if you turn on firm sharing — share selected matters with the teammates you invite by their Dropbox email. Your files stay in your own Dropbox; we do not host a copy of your matter data, do not operate a developer server for sync or sharing, and never receive your Dropbox password. Your Dropbox sign-in token is stored only in your Device Keychain. Disabling sync or removing a teammate's access stops future synchronization, but files already in your Dropbox, and copies already downloaded to a device, are unaffected and persist until removed through Dropbox or on that device. Credentials, tokens, private keys, biometric lock settings, security choices, and other device-only values are not synced and may need to be re-entered or re-authenticated on each device.

4.3 Device permissions

The App may request access to device features or permissions only when needed to provide functionality you invoke, such as camera access for scanning or calendar access for deadline/event creation. Information captured through those permissions is intended to remain on your Device unless you direct otherwise through export, sync, or a third-party Integration. You may revoke permissions through your device settings.

4.4 Integration credentials

If you authorize an Integration, the App is designed to store relevant Credentials locally using Apple security services such as Keychain where available. Those Credentials are used to authenticate you with the third-party service and to enable the authorized data exchange. We do not use Credentials you provide for unrelated purposes.

4.5 Dropbox sync and firm sharing

If you connect Dropbox, documents and manifests you choose to sync are transmitted between your Device and your own Dropbox account as necessary to operate the integration. This includes uploading and downloading files you select and, if you turn on firm sharing, sharing selected matter folders with the teammates you invite by their Dropbox email so they can read and write the same matters from their own devices. Sign-in uses Dropbox's hosted authentication; we never receive your Dropbox password, and the sign-in token is held only in your Device Keychain. Your files remain in your own Dropbox — we do not host a copy of your matter data and do not operate a developer server for sync or sharing. We do not control Dropbox's infrastructure, retention, security, or downstream handling of data.

4.6 On-device AI features (Apple Intelligence)

The App may offer optional features that use Apple's on-device Foundation Models framework (sometimes branded as Apple Intelligence) — for example, ranking suggested reference cards, drafting merge-field clauses from a one-line description, or suggesting mappings for attorney-highlighted fields in a Word template. These features are off by default and require explicit opt-in. When enabled, the relevant inference runs entirely on your Device using Apple's on-device model. Matter data, client-content fields, template text, prompts, and model outputs are not transmitted to us, to Apple's servers, or to any third party in order to operate these features. Outputs are generated ephemerally and are not persisted by us unless you save them in the App. You may disable these features at any time in the App's settings; doing so does not affect the rest of the App.

4.7 Calendar integration

If you grant calendar access, the App may create events or reminders in calendar systems available on your Device. We do not operate those calendar services, and calendar data may be handled by Apple or any calendar provider configured on your Device.

4.8 Encrypted client intake and the Hosted Intake Service

The App may permit you to generate or use encrypted intake workflows. Where offered, those workflows are intended to allow client information to be encrypted and returned to you or transmitted to an endpoint that you configure or control. You are responsible for any hosted endpoint, URL, storage location, or public-key distribution mechanism that you configure. We do not undertake responsibility for third-party or attorney-controlled hosting environments.

The App also offers an optional first-party Hosted Intake Service that lets you send clients a secure link instead of an encrypted file attachment. If you opt in and create a hosted intake account, we (through our hosting provider) receive and store: the email address you sign up with; your public encryption key; an encrypted ("wrapped") copy of your private key that can be unlocked only with your password; and the encrypted intake submissions your clients send. The service is zero-knowledge by design: your password never leaves your Device, your private key is wrapped on-Device before upload, and the server cannot decrypt submissions. We cannot read your clients' intake responses, and we cannot recover your password or your data if the password is lost. You can delete your hosted intake account — including stored submissions and keys — at any time from Settings → Hosted Intake Service.

4.9 Generated documents, template drafts, and redaction features

The App may apply automated formatting, template-mapping, merge-field, or redaction rules to generated documents and user-uploaded template drafts. Those features are aids only and are not a substitute for attorney review. Template drafts that you export, download, edit in Word, email, upload, or otherwise move outside the App are handled by the destination applications and services you choose. You remain responsible for reviewing all output before use, filing, transmission, or disclosure.

4.10 Full backup export

If you choose Export All Data, the App creates a local .vfltbackup file that may include user-owned app data such as matters, clients, calculations, saved documents, custom templates, letter templates, intake forms, custom merge fields, trial drill records, AI suggestions you saved, recipients, pretrial templates, safe restorable settings, and letterhead/logo assets. The backup excludes Keychain credentials and secrets, hosted-intake private keys, biometric lock settings, security choices, developer/debug flags, local expansion state, and owner promo or debug entitlement values. The Developer cannot access a backup file unless you choose to send it to us.

For cloud-only saved documents, the App attempts to download the file bytes before completing the export. If it cannot include those files, the export is designed to identify the affected documents instead of silently creating an incomplete backup.

4.11 Subscription and purchase information

Subscriptions and introductory trials are offered and billed through Apple's App Store. We may receive limited subscription-status, entitlement, transaction, and trial metadata necessary to validate access to GAL Toolkit or Complete features, prevent abuse, maintain records, and provide support. We do not receive or store your full payment-card information or Apple ID password.

4.12 Technical diagnostics

The App does not include third-party analytics, crash-reporting, tracking, or advertising SDKs. We may receive limited Apple-provided subscription, entitlement, crash, or diagnostic information only when made available through Apple's platform services or when you choose to send information to us for support. We do not use diagnostics to collect matter data or client-content fields.

4.13 Websites, contact forms, and mailing lists

Our websites may receive standard server-log information such as page requests, referrers, approximate region, browser type, device type, and similar operational information through our hosting or website providers. We do not use advertising trackers. If you submit a contact form, join a mailing list, request support, or otherwise contact us, we collect the information you provide.

4.14 LawPay payment processing and Pay Later

If you connect your firm's LawPay account, authorization occurs on LawPay's website. The App stores an opaque connection token and verifier in your Device Keychain. Requests pass through a VFL Toolkit integration broker that performs the authorized LawPay API calls; the broker's partner credentials and LawPay access tokens are not placed in the App. The connection token is encrypted and bound to the verifier. We do not intentionally store the contents of payment requests in the broker.

To create and reconcile a hosted invoice, the App may transmit the requested amount, currency, selected LawPay account identifier and trust-or-operating classification, test-mode status, client name, client reference, recipient email, bill number or other reference, and provider request or transaction identifiers. LawPay returns account metadata, hosted-invoice information, and payment status needed to verify the amount and destination and update the on-device ledger. A client enters card or bank details only on LawPay's hosted page; those payment credentials are not entered into, transmitted by, or stored within the App or VFL Toolkit integration broker.

If LawPay has activated Pay Later and a client is eligible, the hosted page may offer financing powered by Affirm. The client applies on the client's own device. VFL Toolkit and its integration broker do not receive or store the application, Social Security number, income, credit report, lending decision, rates, or repayment credentials. LawPay, AffiniPay, Affirm, the applicable financial institution, and their service providers process information under their own notices and agreements. A separate LawPay account is required, and Pay Later availability is controlled by LawPay and Affirm.

4.15 Shared Firm Workspace (firm sharing) — optional

If you, as the managing attorney, turn on the optional Shared Firm Workspace, the App shares the matters you choose — together with their clients, time entries, expenses, bills, and trust-ledger records — with the teammates you invite by their Dropbox email, through your own Dropbox account. Invited teammates reach the shared matters from their own devices; each teammate sees and can change only what the permissions you assign allow, and restricted actions such as bill approval and trust transfers remain yours unless you grant them. This feature runs entirely through your own Dropbox — we do not operate a developer server for it and do not receive your shared matter data. Turning sharing off, or removing a teammate's access, stops future synchronization for that teammate, but files already in your Dropbox and copies already downloaded to a teammate's device persist until removed through Dropbox or on that device. Additional attorney and paralegal/legal-assistant seats are billed to the managing attorney through Apple's App Store; members are never billed, and revoking a seat returns the affected teammate to read-only access rather than deleting any local copy already on their device.

§ 5 How we use the data we receive

We use the limited information we collect or receive for the following business and operational purposes:

• to provide, authenticate, maintain, and improve the App and related services;
• to validate subscriptions, trials, and feature entitlements;
• to diagnose crashes, errors, performance issues, and security incidents;
• to respond to support requests, feedback, and other communications;
• to send product, service, legal, administrative, or transactional notices;
• to protect the App, our business, users, and others against fraud, abuse, misuse, security threats, or unauthorized activity;
• to enforce our Terms of Use and other applicable agreements;
• to comply with legal obligations, lawful requests, court orders, tax requirements, recordkeeping obligations, and regulatory requirements.

We do not sell personal information. We do not use matter data or client matter content to train generalized machine-learning models for public or cross-customer use. We do not disclose personal information for cross-context behavioral advertising.

§ 6 Third parties and service providers

Depending on how you use the App, personal information or matter data may be disclosed to, received by, or processed through the following categories of third parties:

• Apple and Apple-related services, including the App Store, subscription management, device security services, calendar frameworks, and Apple platform diagnostics, if enabled or applicable;
• Integration providers you choose to connect, such as Dropbox (matter sync and firm sharing) and LawPay (AffiniPay) for client payments;
• Our hosting provider for the optional Hosted Intake Service, which stores only your account email, public key, password-wrapped private key, and encrypted client submissions — never readable client data;
• Website, hosting, and communications providers, including providers that host our websites, process contact-form submissions, route email, or maintain mailing lists;
• Service providers acting on our behalf for support, infrastructure, security, diagnostics, or operational administration;
• Legal, compliance, tax, audit, and professional advisors where reasonably necessary;
• Governmental authorities, courts, counterparties, or other third parties when required to comply with law, legal process, or to protect rights, safety, property, or the integrity of the App.

We do not sell personal information to data brokers. We do not disclose personal information for cross-context behavioral advertising.

§ 7 Retention and deletion

7.1 Matter data on your Device

Matter data stored locally in the App remains under your control on your Device unless and until you delete it, export it, sync it, or transmit it elsewhere. If the App includes a local delete or wipe function, that function is intended to remove the relevant locally stored App data from that Device, but it may not remove copies previously exported, synced, backed up, cached, or stored by third-party systems.

7.2 Dropbox or third-party copies

If you connect Dropbox or use another Integration, copies of data may persist in your Dropbox account or the relevant third-party provider's systems in accordance with that provider's retention practices and your configuration of those services.

7.3 Account, subscription, and business records

We retain subscription, transaction, support, and business records for as long as reasonably necessary for the purposes described in this Privacy Policy, including to comply with legal, tax, accounting, audit, dispute-resolution, and enforcement obligations. Retention periods may vary by record type.

7.4 Support correspondence

If you contact us, we may retain your communications and related records for support, training, product-improvement, legal, and recordkeeping purposes.

7.5 Legal holds and exceptions

Notwithstanding anything else in this Privacy Policy, we may retain information for longer where necessary to comply with law, resolve disputes, investigate incidents, enforce agreements, or establish, exercise, or defend legal claims.

§ 8 Security

We use administrative, technical, and organizational measures designed to protect the limited information we control against unauthorized access, disclosure, alteration, or destruction. The App is also designed to rely on security features provided by Apple's operating systems and device-security framework where available.

Depending on your Device, operating system, settings, and the features you use, protective measures may include local device encryption, secure credential storage, encrypted network transport, optional biometric or passcode-based access controls, and encrypted intake or transmission workflows.

No security measure is perfect, and we do not guarantee that unauthorized access, disclosure, loss, or alteration will never occur. You remain responsible for the security of your Devices, passcodes, Apple account, third-party-service credentials, exported files, hosted endpoints you configure, and your firm's own privacy and information-security practices.

§ 9 Payments and subscriptions

Subscriptions to VFL Toolkit are offered and billed through Apple's App Store. Apple controls billing workflows, payment processing, and related payment credentials. We receive only the limited subscription, trial, transaction, and entitlement information reasonably necessary to administer GAL Toolkit and Complete access, maintain records, respond to support issues, and comply with legal obligations.

Deleting data from the App or deleting the App from your Device does not automatically cancel your subscription. Subscription cancellation and billing management must be handled through Apple.

§ 10 Your rights and choices

10.1 In-App controls

Because most matter data is intended to remain on your Device, the most direct means of controlling that data is through the App and your own devices, accounts, and third-party services. Depending on available functionality, you may be able to view, edit, export, delete, sync, disconnect integrations, revoke permissions, or wipe locally stored App data.

10.2 Rights relating to information we control

To the extent applicable law grants you rights with respect to personal information that we control, and subject to any applicable exemptions or verification requirements, you may request access to, correction of, deletion of, or information about that personal information by contacting us using the information in § 14. We may need to verify your identity, authority, and the scope of your request before acting on it.

10.3 Marketing communications

If you subscribe to availability or support communications from us, you may opt out using the unsubscribe mechanism in the message or by contacting us.

10.4 App Store disclosures

Any App Store privacy label or similar platform disclosure is intended as a summary. In the event of a conflict, this Privacy Policy governs except to the extent a platform requires different phrasing or categorization.

§ 11 International users

VFL Toolkit is intended for use in connection with Virginia legal practice in the United States. If you access or use the App or our websites from outside the United States, you understand that information we collect or control may be processed in the United States or other jurisdictions where our service providers operate. You are responsible for determining whether your use of the App is permitted in your jurisdiction and for complying with any local legal requirements applicable to you.

§ 12 Children's privacy

The App is not intended for direct use by children, and we do not knowingly collect personal information directly from children under 13 through the App or our websites. If you believe we have received personal information directly from a child under 13 in a manner inconsistent with this Privacy Policy, contact us using the information in § 14 and we will take appropriate steps to review and address the issue.

For the avoidance of doubt, matter data entered by an attorney user may include information about minors involved in the attorney's legal matters. That information is entered and controlled by the attorney user, not by a child user of the App.

§ 13 Changes to this policy

We may update this Privacy Policy from time to time. When we do, we will revise the "Last Updated" date and, where appropriate, the version number. If we make material changes to how we collect, use, or disclose personal information that we control, we may provide additional notice through the App, by email, on our website, or by other reasonable means.

Your continued use of the App after the effective date of an updated Privacy Policy is subject to the revised Privacy Policy.

§ 14 Contact

Questions about this Privacy Policy, support inquiries, or requests relating to personal information we control may be directed to:

Burroughs Law Office, P.C.
Attn: VFL Toolkit Privacy
4445 Corporation Ln, STE 225
Virginia Beach, VA 23462
Phone: (757) 363-0077
Email: support@vfltoolkit.com

•