Privacy Policy

Last updated: August 31, 2026

This Privacy Policy explains how Northstack LLC ("we", "us", "our") collects, uses, and shares information through the getboxagent managed intake service ("the Service"), which law firms ("Customers") use to take and write up inquiries from people contacting them.

1. Who this applies to

This policy covers two groups of people:

• Customers — the law firms who subscribe to the Service and route their inquiries to it.
• Inquirers — people who contact a Customer firm by phone, web form, or email and whose inquiry the Customer has routed to us for intake. Many inquirers are prospective clients of the Customer firm, and their information is treated accordingly.

2. Information we collect

We collect what the Customer’s approved question set asks for, and nothing beyond it:

• Contact details — the Inquirer’s name, phone number, and/or email address, and how and when they prefer to be reached.
• Matter details — the type of matter, the jurisdiction or location it concerns, relevant dates and timeline, whether the Inquirer is already represented, and any other party named, so the Customer can run its own conflict check.
• The inquiry itself — what the Inquirer said when they got in touch, as it was reported to us.
• Technical information — IP address (used only for spam and abuse rate-limiting), browser type, and timestamps.
• Customer account information — the firm name and notification email address a Customer provides when they sign up.

Intake does not ask an Inquirer for a Social Security number, financial account details, or medical records. Inquirers are not required to create an account, and we do not knowingly collect more than what is volunteered during intake.

3. How we use this information

• To run intake: ask the Customer’s question set and record the answers.
• To screen an inquiry against the criteria the Customer has given us, and to log inquiries that were screened out.
• To deliver the resulting write-up to the Customer the Inquirer was trying to reach — this is the core function of the Service.
• To operate, maintain, and improve the Service, including spam and abuse prevention.
• To communicate with Customers about their subscription.

We do not sell Inquirer or Customer data, and we do not use intake content for advertising or to train or improve any model. Where an inquiry reaches us in writing, we do not send Inquirer information to a generative AI provider at all. Where we answer a routed telephone line, the call is taken by an automated voice system that does use one; the providers, what they keep and for how long, and what they are contractually barred from doing with it are set out in section 4 below and in our vendor disclosure. We act as a processor on the Customer’s behalf and only on the Customer’s instructions.

4. Third-party service providers

We use the following providers to operate the Service. Each processes data only as needed to provide their part of the Service, under their own privacy policies. A current subprocessor list is available to Customers on request, for Model Rule 5.3 purposes:

• Cloudflare — hosts the backend (Workers) and stores intake write-ups (Workers KV) so the Customer can read them in their panel.
• Resend — delivers the notification email telling the Customer that an intake has arrived. That email contains a link to the write-up, not the Inquirer’s information.
• Polar Software, Inc. — processes Customer subscription payments. Polar never receives Inquirer information.
• Retell AI, Inc. — only on plans where we answer a routed telephone line. Answers the call, transcribes it, and fills in the Customer’s fields. Retell hears everything the Inquirer says on the call. Its own speech, language-model and carrier providers sit behind it and are named to the Customer in writing before the line goes live. We opt out of Retell’s use of call data for model training and sign its Business Associate Agreement and Data Processing Addendum. None of this applies to Managed Intake, which is written intake with no telephone line and no voice provider.

Where we are, and where the data is. Northstack LLC is a New Mexico company, and intake write-ups are stored on Cloudflare infrastructure. The Service is operated day to day by one person working remotely from Turkey, which is outside the United States and outside the EEA; that person administers the systems described above and is the only individual with access to write-ups, as set out in our vendor disclosure. This means intake information is accessed from outside the United States. We state it here so a Customer knows it before subscribing, not after.

5. Data retention

Intake write-ups stored in Cloudflare KV are automatically deleted 90 days after they are created. A Customer can ask us to delete a write-up sooner, or to retain specific write-ups longer, in writing. Where an intake is taken through a web form, the in-progress session is kept in the Inquirer’s own browser (local storage) so it survives a page refresh, and is cleared when they clear their browser data.

Calls. Where an intake is taken over a routed telephone line, the call is recorded and transcribed at our voice provider, and the Inquirer is told so in the opening notice before any question is asked. The recording, the transcript and the associated logs are deleted at the provider one day after the call. Neither the audio nor the raw transcript is copied to us or into the Customer’s panel; what is retained is the write-up, under the 90-day rule above. Whether that opening notice satisfies the recording-consent law applying to a given call is the Customer’s to determine — consent requirements differ by state and can turn on where the Inquirer is located. Our vendor disclosure sets this out in full at section 5a.

6. Cookies and local storage

Where intake is taken through a web form, it uses browser local storage (not tracking cookies) solely to remember an in-progress intake across page reloads. We do not use this to track anyone across different websites. The panel where a Customer reads their write-ups likewise keeps the access details they enter in their own browser’s local storage so they do not have to re-enter them each visit — that data stays on the Customer’s device and is not transmitted to us.

7. Your rights

Inquirers and Customers can request access to, correction of, or deletion of their personal information by contacting us at [email protected]. Depending on your location, you may have additional rights under laws such as the CCPA or GDPR; we will honor applicable requests.

8. Children's privacy

The Service is intended for adults contacting a law firm and is not directed at children under 13. We do not knowingly collect information from children.

9. Changes to this policy

We may update this Privacy Policy from time to time. Material changes will be reflected by updating the "Last updated" date above.

10. Contact us

Northstack LLC, 1209 Mountain Road PL NE #12611, Albuquerque, NM 87110, United States.

Questions about this policy: [email protected].