Privacy Policy

1. Information Collected

Pen and Key LLC collects the following data when you use the Keypoint website or services:

• Account Information: Your email address and password. Your password is sent to our sign-in provider, Supabase, which stores only a scrambled, one-way form of it (a “hash”). Pen and Key cannot read your password.
• Google Sign-In: If you choose to sign in with Google, Google shares your email address and basic profile information, such as your name and profile picture, with Supabase. Keypoint uses your email address.
• Subscription Information: Your plan, your chosen practice area, your subscription status and renewal date, and the identifiers that link your account to your payments.
• Campaign Links: When you open one of our campaign links, Keypoint keeps the approved source, medium, campaign, and content labels in session storage for that browser tab. If you begin a subscription purchase, Keypoint saves those labels with its Checkout request binding so that retries use the same information, and passes them to Stripe as Checkout and subscription metadata so that we can identify which campaigns led to purchases. Keypoint does not take a person’s name or email address from campaign query parameters and does not use advertising pixels or advertising cookies.
• Financial Information: Payment details are collected directly by our third-party payment processor, Stripe. Pen and Key LLC does not collect, process, or store credit card numbers or bank account details on our servers.
• Terms Acceptance: Which version of our Terms of Service and this Privacy Policy you accepted, and when.
• Saved Folders: If you save cases to folders in your account, the names you give your folders, which summaries you saved in each, and when.
• Profile: Your full name and your role (attorney, paralegal, other legal staff, law student, or another student) and, if you give it, your firm or organization. We do not ask for a bar number.
• Student Membership Details: Your school name, major field of study, current year of study and student ID number are required for a Student Master Key Pass. We keep these details in your private account profile to administer the student membership. They are not displayed to other members or included in Stripe payment metadata.
• Team Memberships: If you subscribe to a Firm Key Pass or Golden Key Pass, the names, roles, and email addresses of the colleagues you add; when each was added, first signed in, or was removed; and whether a removal counted toward the yearly limit. If a subscriber adds your email address, we use it to give you access when you sign in with that address, we take your name and role from what the subscriber entered if you have not given them yourself, and we show you the subscriber’s name and email address as the person who manages the membership.
• Devices and Sign-In Activity: A cookie holding a random code that identifies your browser as one of your account’s up to three devices. For each device, a description such as “Chrome on Windows,” the identifying text your browser sends (its “user agent”), its IP address, and when it was last used. For each sign-in, each device signed out or turned away at the limit, and your viewing of summaries (recorded at most once an hour for the same device and network), the IP address, the browser’s identifying text, and, where our hosting provider supplies it, the approximate location (city, region, and country) of the network. We use these records to enforce each plan’s device and seat limits and to identify accounts that appear to be shared among people.
• Email Settings and Alerts: Whether daily updates remain on or you turned them off, whether you enabled the separate weekly team summary, which practice areas you selected, and which courts you selected for each area; the text searches you save (which keep their text rather than temporary practice-area, topic, court, date or publication-status filters); the cases you watch, including the federal court and full docket number you enter yourself and whether you identify a case as your own; the cases in which you confirm that a court list names you, or an attorney you work with, as counsel, with the name and party as the list printed them; and a record of each of these emails we send you, with the day it was for, which summaries it listed, and whether our email provider accepted it.
• Team Folders and Notes: For a Firm Key Pass or Golden Key Pass, the team’s folders, the summaries in each and who added them, and the notes members write, with each author’s name and when the note was written or changed. Everyone on the team can see them.
• Summaries You Open: When you are signed in, which summaries you open, including those you opened in the same browser before signing in, and when you first opened each, so that the website can mark them “Seen” on any device where you sign in.
• Questions and Suggestions: What you type into the help assistant, and the questions and suggestions you send us, with the email address you give for a reply, the page you sent them from, and your account if you are signed in. We save submitted questions and suggestions in the owner inbox and email them to our business mailbox so we can respond. The email includes the chat you chose to send with a question and your reply address, if provided. A submission identifier helps prevent duplicates if a failed notification is retried. We also keep a copy of each reply we email from the website; correspondence sent from our mailbox is kept there.
• Attorneys We Write To: We may email an attorney about a new decision in which the court lists that attorney as counsel. When we open a case-specific outreach draft, Keypoint may automatically search the State Bar of Michigan’s public Classic Directory and broader public professional sources for the attorney’s published professional email address, using the name and any bar number or firm listed in the court’s sources. Broader search uses Anthropic’s web-search service to locate public professional pages, such as law-firm websites, bar or organization profiles, and pages identified through business-profile results. Keypoint checks the named attorney and published address against the public source before filling a broader-search result. We keep the search identity, lookup result, matched public name and any bar number, published address, source profile URL, and check and expiry dates in a private contact cache. We may also enter an address and its source ourselves, such as from the attorney’s firm website. An ambiguous match, unavailable source or address on our do-not-email list is not automatically filled into a draft, and the lookup does not overwrite our edits. We review each recipient and draft and send the email ourselves from our own account; the lookup never sends an email or records one as sent. We keep the attorney’s name and the party represented, as the court’s documents print them, the decision, the address, where we found it, and when we wrote, followed up, or received a reply. If we decide not to send a draft, we keep the attorney, party and decision, the date we marked it Not Sent, and any reason we enter, so that the draft stays out of the unsent queue. If you ask us not to write to you again, we keep your email address on a do-not-email list, with the date of your request.
• Imported Attorney Contacts: We may upload a CSV contact list to the private owner outreach page. We store valid attorney names, their normalized forms for matching, email addresses, source filenames, and import dates in a separate private contact list so that matching drafts can reuse them. The raw CSV file is processed for the import and is not retained as a file. An imported address is supplied by us rather than independently verified by the public-web lookup. Entries marked unlisted or unverified, invalid addresses, and conflicting duplicate names are not used to fill recipients. Imported contacts do not establish that an attorney represented a party; the summary’s identified court sources establish that association. Addresses on the permanent do-not-email list are excluded from imported contact use.
• Technical Information: The website uses cookies to keep you signed in, to recognize your device for the three-device limit, and to complete email confirmation and password-reset links. It does not use advertising or analytics cookies. Cases you save outside an account folder, for example while signed out, are stored only in your own browser, on your device. When the list of summaries you have opened is not kept in your account, for example while you are signed out, your browser keeps it on your device only. The website keeps your IP address in its memory for about a day to limit how often the help assistant and the message forms are used. Our sign-in and hosting providers may record technical information, such as IP addresses and the pages requested, for security and troubleshooting. The audio briefing uses your browser’s own speech feature; Keypoint does not receive what it reads, but voices the briefing marks “online” are provided by your browser’s maker, which receives the text read aloud.
• Feedback and Correspondence: Comments and communications sent to our email address.

2. Owner-Uploaded Court Documents

The owner can upload court opinion PDFs and Michigan appellate docket-sheet PDFs through the private owner pages, including batches of docket sheets for selected cases. Keypoint retains the original files in private Supabase storage, together with their filenames, upload times, uploader, selected cases, integrity hashes, extracted text, matching evidence and processing results. It preserves earlier source records when an uploaded opinion is used for another attempt and records people-field updates separately from the original evidence. These records are retained to support the published information and its source history.

Uploaded opinions are processed by the same summary and verification services as other court opinions. A retained opinion is available through its published summary to members entitled to read that summary. Uploaded docket sheets remain available only to the owner; their supported attorney names, represented parties, bar numbers and lower-court judge names may appear with the case. The original uploaded docket source descriptions, upload dates, locations within the document and notices about docket listings are visible only to the verified Keypoint owner. Keypoint omits those details from summaries and other content provided to members while retaining the original source evidence privately. Docket-sheet extraction runs in Keypoint’s backend without sending the docket PDF to an AI provider. Original printed names and their formatted versions support matching across summaries, outreach and marketing tools without erasing prior contact records. Uploading a document does not by itself approve a summary or establish that an attorney may receive marketing emails.

3. Court Release Mailbox

Keypoint receives Michigan court release notices at a dedicated Keypoint email address through Resend. The reader checks the exact court sender, the receiving address and the receiving server’s email-authentication results before using a notice. It reads the message text and HTML only to locate official opinion PDFs. This feature does not connect to a member’s or owner’s personal Gmail mailbox. Google sign-in remains a separate account feature.

Resend receives and stores the full incoming messages according to the account’s provider retention settings. Keypoint does not retain raw release-email bodies in its application database or send them to an AI provider. Its private discovery records retain processing positions, provider message identifiers and receipt times, canonical official-PDF links, and status information needed to retry incomplete work, monitor receipt and avoid duplicate processing. The receiving address and provider API credential are kept in protected server settings. Previously discovered public opinion links and pending work are preserved when the receiving method changes.

4. Optional Marketing Automation

Our marketing tools use MailRush for source-matched attorney invitations containing a case-summary link and a personal free-month offer. An independently verified winning-side press draft may also be included. Opening an invitation link does not activate access or consent. Acceptance requires a confirmed Keypoint account with the exact invited email address and explicit acceptance of the Terms of Service and Privacy Policy, including the free-month email terms, through a single checkbox that starts unchecked. A practice area covered by the case is preselected; before accepting, the recipient may choose any one of Keypoint's 15 practice areas and optionally choose which covered courts to include in daily emails. We record an explicit court choice with acceptance and update only the selected area's email preferences, preserving earlier daily-email opt-outs and unrelated settings. The current choice includes up to five final-day reminders and up to three follow-ups 4, 7 and 14 days after expiry if no subscription has been purchased. Older five-reminder choices are not expanded automatically. Resend supplies these messages and the separately confirmed weekly roundup. We retain the attorney and address source, case/source identity, outcome review, offer dates, selected area, accepting account, consent wording/version/time, free-access start and end dates, paid-conversion status, campaign schedules and provider outcomes. Current and retained paid-subscription or activated team-membership records may suppress post-expiry follow-ups even after paid access ends; they do not extend free access. Invitation signatures are purpose-bound and cannot grant access without the recipient account and explicit acceptance. Weekly signup requests retain hashed confirmation tokens and a keyed hash of the network address for abuse limits. Open and click tracking are disabled. Imported addresses, public counsel names and a paid membership do not themselves supply campaign or roundup consent.

Marketing replies go to a dedicated receiving address at Resend, separate from the court-release receiving address. Resend receives and retains those messages under its account retention settings. Keypoint checks the exact sender and receiving address and stops attorney introductions and press emails when it finds a reply. The marketing database retains message identifiers, reply classifications and timestamps needed to stop work, not raw incoming message bodies. Verified delivery and suppression events retain only the identifiers, recipient and status needed to update the corresponding send. A reply to a trial reminder does not itself unsubscribe a separate weekly roundup. A marketing unsubscribe, provider suppression or do-not-email request blocks future marketing sends; our unsubscribe page does not require a Keypoint sign-in. Zoho Mail remains our business mailbox for separate manually sent correspondence.

OpenAI may prepare and independently check a press-release draft using the published decision, its complete court documents and sourced attorney-party information. We do not send the recipient’s email address, mailbox messages or private member information for that work. The draft identifies the supported result, includes a case-specific-results disclaimer and links to the public Keypoint case page. Unclear results are not described as victories. A firm should review a draft before using it as its own announcement.

For LinkedIn outreach, we retain profile URLs we select, the introductory note and the invitation attempt status. The protected worker may use an authenticated LinkedIn session to request a connection at those selected profiles. Session credentials are kept outside the application database. The worker stops if login, identity verification or an invitation restriction prevents normal operation; it does not solve challenges or bypass restrictions. These activities are separate from the manual email-draft tools described above.

5. Use of Information

The collected information is used for the following purposes:

• To create and secure your account and to show you the summaries your subscription, or your team’s Firm Key Pass or Golden Key Pass, covers.
• To enforce each plan’s device and seat limits, and to identify accounts that appear to be shared among people.
• To keep your saved folders and the list of summaries you have opened, and show them to you on any device where you sign in.
• To send daily updates that are on by default unless you turn them off, and the separate weekly team summary you enable, with the decisions in your saved searches and in the cases you follow, and not to send the same email twice.
• To show a team its shared folders and notes.
• To answer your questions, through the help assistant or by email, and to consider your suggestions.
• To find public professional contact details for attorneys named as counsel in new decisions, prepare drafts we review and send ourselves, avoid writing to anyone twice about the same decision, and honor requests not to hear from us again.
• To match owner-imported attorney contacts to outreach drafts, retain their import source, and prepare separate draft handoffs we review and send ourselves.
• To process subscriptions, payments, renewals, and cancellations, and to administer the student membership using the student details you provide.
• To identify which of our campaigns led to subscription purchases, using the limited campaign labels described above.
• To send account emails, such as confirmation and password-reset links.
• To communicate with you regarding subscription status, billing issues, service updates, and marketing communications. You may ask us to stop sending marketing communications at any time.
• To improve the service based on user feedback, keep it secure, and comply with the law.

6. Disclosures to Third Parties

Pen and Key LLC discloses information only to entities necessary to provide our services. We do not sell user data. Information is disclosed to:

• Payment Processor: Stripe receives the information required to process subscription payments and, when a purchase begins from a campaign link, the approved campaign labels described above.
• Service Providers: Supabase (sign-in and database), Render (website hosting), Resend (receiving and retaining court release emails and marketing replies, account emails, notifications of submitted questions and suggestions, our website replies, the default-on daily updates and optional weekly team-summary emails, and separately confirmed marketing subscriptions), MailRush (direct attorney introductions and related sending and suppression events), Zoho Mail (our business mailbox and manually sent correspondence), OpenAI (new court opinion summaries and source-checked press-release drafts), LinkedIn (selected profile connection requests), Anthropic (the help assistant’s answers, public professional contact search, and certain earlier summaries), and Google (if you choose Google sign-in or if a public Google business page is used as a contact source).
• Public Professional Contact Lookups: The State Bar of Michigan’s public Classic Directory receives the attorney’s search name and any available bar number or firm used for the lookup. Anthropic’s web-search service receives those public professional identity details and the court identifier to help find a match. Public professional websites used for verification receive requests for the source pages. We do not send these providers the case, draft message, member account information or private matter details.
• Outreach Draft Handoffs: When we choose to open an individual or selected group of outreach drafts, the recipient, subject and message are passed to our chosen email composer through the browser’s mail handler. The browser and mailbox provider control composer opening and signature insertion. Selecting or opening drafts does not send them or record them as sent. Imported contact lists are not sent as a batch to the public contact-search providers merely because we upload or select drafts.
• Legal Authorities: Data may be disclosed if required to comply with subpoenas, court orders, or state and federal law.

Keypoint prepares new summaries from public court opinions, using their complete PDFs as the source of case facts and the artificial intelligence provider OpenAI to prepare the summaries. The PDFs may be supplied by court websites, CourtListener, or GovInfo. Earlier summaries may have been prepared using Anthropic. Keypoint does not send information from your account or raw court-release emails for that work. Keypoint also keeps the case calls and call notices the Michigan courts publish and available published U.S. Supreme Court and Sixth Circuit argument calendars, to show members those cases and any judges and counsel the court documents list. For Sixth Circuit and Michigan federal district-court decisions it publishes, Keypoint may also retrieve and retain names of attorneys and their associated parties from CourtListener’s archived RECAP docket records. Separate public court records may establish an actual lower-court judge for a matching appellate case; a docket’s assigned judge is not used to supply the deciding judge. A federal court and docket number you enter to follow a case are stored in your account and matched against Keypoint’s published summaries; entering them does not send a search to a court’s case-search system. If you use the help assistant, the questions you type into it are sent to Anthropic to prepare its answers, so please do not include confidential information.

7. Method of Disclosure

Information is disclosed to third parties exclusively through electronic transmission over encrypted internet connections. Communications with our payment processor and service providers occur via Application Programming Interfaces (APIs).

8. Security Practices

Pen and Key LLC implements the following measures to safeguard collected information:

• Encryption: Data transmission between your browser and the website, and between the website and our providers, utilizes Secure Socket Layer/Transport Layer Security (SSL/TLS) encryption.
• Access Control: Our databases cannot be read directly from browsers; only the website’s server can reach them. Administrative access is restricted by password authentication and limited to authorized personnel.
• Data Authentication: Automated messages from our payment processor to the website are authenticated using cryptographic signature verification.
• Passwords: Passwords are stored only in hashed form by our sign-in provider.
• Vendor Security: We use established vendors for sign-in, database, hosting, email, and payments.

9. Data Retention and Your Choices

We keep account and subscription records while your account is open, and afterward as needed for billing, tax, legal, and security purposes. Your student membership details are kept in your profile until you update them or delete your account. Your folders and the cases saved in them are kept until you delete them, and are deleted with your account. The list of summaries you have opened is kept until you clear it on your account page, and is deleted with your account. Your email settings, saved searches, and followed cases are kept until you change or remove them, and are deleted with your account, as is our record of the emails we sent you. A team’s folders and notes are kept for as long as the team’s subscription record exists, and are deleted with the subscriber’s account; a note stays, with its author’s name, after its author leaves the team or deletes their account, until the team removes it. A Firm Key Pass’s or Golden Key Pass’s list of colleagues, and its record of removals, are kept for as long as the subscription exists, and are deleted with the subscriber’s account. A device stays on your account’s list until it is signed out; records of devices signed out, and of sign-in activity, are kept for 90 days. Questions and suggestions you send us, and our replies to them, are kept so that we can answer them and improve the service; those sent while signed in are deleted with your account, and you may ask us to delete any of them. Our record of the emails we write to attorneys is kept so that we do not write to anyone twice about the same decision. A Not Sent record is kept until we restore that attorney and decision to Drafts. Owner-imported attorney contacts are kept privately for reuse; a later import can replace a matching name’s address and import source. We keep public professional contact lookup records separately, including unsuccessful results, so that repeated requests can reuse a recent check. An expired lookup is checked again when it is next requested; expiry limits reuse rather than deleting the record. An address on our do-not-email list is kept permanently, so that we never write to it again. You may ask us to correct or delete your account information by emailing patrick@keypointlegal.com. Stripe keeps payment records under its own privacy policy.

10. Campaign Label Retention

The browser keeps campaign labels for that tab’s session. Labels saved with Keypoint’s Checkout request binding can remain after a purchase completes, until a later Checkout replaces or clears that binding or the account is deleted. Labels sent to Stripe remain with its Checkout and subscription records under Stripe’s retention practices.

11. Changes to This Policy

We may update this policy. The date at the top of this page shows the current version, and we will ask you to accept material changes before you continue using your account.

12. Contact Information

For questions regarding this policy or the handling of data, please contact: patrick@keypointlegal.com.