Privacy Policy & Legal Notices

Privacy Policy

Operated by Truth Computing Incorporated, a Delaware corporation ("Truth Computing", "we", "us"), the maker of Ross.

This policy explains what information Ross collects, why, and what we do with it. Ross is a business-to-business service used by law firms (our "customers"). Most of the personal information in Ross belongs to the firm's own clients and matters; the firm decides what to put into Ross and remains responsible for it. We handle that information on the firm's behalf and under its instructions.

1.Information we handle

Depending on how your firm configures Ross, this can include:

• Firm & account data. Names, work email addresses, roles, and login credentials of the attorneys, paralegals, and administrators you invite. Passwords are stored only as salted hashes.
• Client & matter data. Client names, mobile phone numbers, case or matter identifiers, case-file events, cadence preferences, and the consent status of each client.
• Messages & communications. The template-based updates drafted for and sent to clients, inbound replies (including opt-out keywords such as STOP), and the approval decisions your team makes.
• Documents. Legal documents, matter files, and their extracted events that your firm uploads or connects for drafting, review, deadline, and retrieval features.
• Billing data. Your plan, active-case count, and billing contact. Card and bank details are entered directly with our payment processor and are never received or stored by us.
• Operational logs. A tamper-evident, hash-chained audit trail of who drafted, approved, edited, and sent what and when, plus standard security and diagnostic logs. Audit and integration logs are designed not to record message bodies, document contents, full email bodies, or secrets.

2.How we use it

We use the information above only to provide and support the service, specifically to:

• Draft client updates by selecting from your attorney-approved template library, and route anything uncertain to a human for review;
• Capture and honor client consent and opt-outs, and send messages only within permitted local time windows;
• Run the document, deadline, filing-check, review, and fact-retrieval features your firm enables;
• Maintain the audit trail, enforce access controls, secure the service, and prevent abuse;
• Provide support, and bill you for your plan.

3.Our role and legal bases

For client and matter data, your firm is the controller (or "business") and Ross acts as a processor (or "service provider"): we process that data under your instructions and the agreement between us. For your own account and billing data, and for securing the service, we act as controller. Where data-protection law applies, we rely on the performance of our contract with you, our legitimate interest in operating and securing the service, and - for communications to clients - the consent your firm is responsible for obtaining and that Ross records. Where a firm processes protected health information, a Business Associate Agreement (BAA) is required before that data is placed in Ross.

4.Sub-processors

We use a small set of vetted providers to run the service. Each receives only what it needs, and only when your firm enables the relevant feature:

The full, current list of sub-processors is always available at /subprocessors. We will provide notice of a new sub-processor at least thirty (30) days before it begins processing Firm Data.

5.Retention & deletion

We keep your data for as long as your account is active or as needed to provide the service. The audit trail is intentionally append-only and tamper-evident, so it is retained for the life of the account as a record of what was sent and approved. You can export your data, including the audit trail, at any time. On request, or after your account closes, we will delete or return customer data within a commercially reasonable period, except where we must retain it to comply with law. Your data isolation to your firm is enforced throughout.

6.Security

• Data is isolated per firm (tenant-scoped), and access is role-enforced and logged.
• Documents pass an egress gate before any storage or model call.
• Passwords are salted and hashed; sessions and cookies are secured in production.
• The hash-chained audit log makes tampering with the record detectable.
• Secrets, document contents, and full message bodies are kept out of integration and audit logs.

No service can promise perfect security, but we work to protect your data and to be honest about how it is handled. Each measure above is documented in full — mechanism, what it means for your firm, and what it does not cover — on the engineering page, alongside where we stand on formal certification.

7.Your rights & choices

Individuals whose data a firm has placed in Ross (for example, a firm's clients) should contact that firm to exercise access, correction, deletion, or opt-out rights, because the firm controls that data; we will assist our customer in responding. Firm users can update their own account details or ask us to do so. Clients can opt out of messages at any time by replying STOP (or CANCEL, END, QUIT, UNSUBSCRIBE), which revokes consent immediately. Depending on where you live, you may have additional rights under laws such as the GDPR or the CCPA/CPRA; contact us and we will honor those rights as the law requires.

Terms of Service

Last updated: August 18, 2026. These Terms govern access to and use of Ross. If a signed Business Associate Agreement, master services agreement, order form, or Data Processing Addendum exists between your Firm and Truth Computing, that agreement controls over these Terms as to its subject matter.

You are legally and financially responsible for all activity conducted through your Firm account, including the acts and omissions of every person you authorize to access it. The Service allows you to connect to and interact with platforms and products provided by other parties; your use of those third-party platforms is subject to a separate agreement between you and each such third party.

1.Acceptance; order of precedence

By accessing or using the Service, creating an account, connecting any system or data source to the Service, or paying any fee, you agree to be bound by these Terms and our Privacy Policy, incorporated herein by reference. If you do not agree with these Terms, you are prohibited from using the Service and must discontinue use immediately.

In the event of a conflict, the following order of precedence applies, in descending order: (a) any Business Associate Agreement between the parties, solely with respect to Protected Health Information; (b) any master services agreement, order form, or other agreement executed in writing by authorized representatives of both parties; (c) any Data Processing Addendum between the parties, solely with respect to its subject matter; (d) these Terms; and (e) our Privacy Policy and any other policy or documentation we publish.

We may modify these Terms. For changes that materially reduce your rights or materially increase your obligations, we will provide at least thirty (30) days' advance notice by email to your Firm Administrator or by in-Service notification, effective at the start of your next billing period. Continued use after the effective date constitutes acceptance; if you do not accept a change, your remedy is to cancel under Section 13. Each individual who accesses the Service must be at least 18 years old.

2.The Service

Overview. Ross is client-communication software for law firms. Your Firm connects Ross to matter documents already held in Google Drive, Clio, or a folder selected from an Authorized User's computer. Ross reads incoming matter documents, identifies case events, drafts plain-English client communications from your Firm's template library, and routes those communications through a configurable human-review workflow before delivery.

Service tiers. The Service is offered in two tiers. The Platform tier includes capabilities available on sign-in. The Platform and pilot tier adds integrations configured during onboarding, which may require additional authorizations, including a signed Business Associate Agreement, a provisioned WhatsApp sender number with approved templates, or registration of a Clio connection.

Capabilities in development. Features described anywhere as planned, in development, or on our roadmap are not part of the Service and are not licensed, promised, or included in any fee, unless and until we make them generally available to your tier.

Not a system of record. Ross is not a document management system, case management system, docketing or calendaring system, client file of record, or system of record of any kind. You are solely responsible for maintaining your own case files, docket, calendar, conflicts system, and records. Ross supplements those systems and does not replace them.

3.Firm accounts, Authorized Users, and administration

You must register a Firm account to use the Service, designating at least one Firm Administrator with authority to configure the Service, manage roles and permissions, connect and disconnect data sources, enable and disable automation categories, and receive notices under these Terms. You may grant access to attorneys, paralegals, and administrative personnel of your Firm (each, an "Authorized User"). There is no per-seat charge.

You agree to keep credentials confidential, maintain multi-factor authentication on every account, and promptly remove Authorized Users who leave your Firm or no longer require access. Accounts are individual and may not be shared or transferred. We are not responsible for losses resulting from credentials that are shared, stolen, or lost. You are responsible for the acts and omissions of your Authorized Users as if they were your own.

4.Firm representations

By using the Service, you represent and warrant on a continuing basis that: (a) the individual accepting these Terms has authority to bind the Firm; (b) you have the right and all authorizations necessary to connect, transmit, and make available to the Service each document, matter, and data set you make accessible to it; (c) you have obtained and will maintain all client consents required for the communications you send and the processing you direct; (d) all registration and billing information you submit is true, accurate, current, and complete; (e) you will not access the Service through automated or non-human means except as expressly permitted; (f) you will not use the Service for any unlawful or unauthorized purpose; and (g) your use will not violate any applicable law, rule of professional conduct, court order, protective order, or third-party right. If you provide untrue, inaccurate, or incomplete information, we may suspend or terminate your account.

5.Connected systems and data sources

Google Drive. You may connect your Firm's Google account through OAuth authorization and bind a client folder to a matter. Ross imports documents it has not previously processed and rechecks connected folders on a recurring polling interval. You may revoke access at any time.

Clio. A read-only pilot capability that unlocks upon a paid pilot. Ross reads matter documents in memory to prepare a draft; the Clio file itself is not stored by Ross.

Files on your computer. An Authorized User may select a folder in the browser or drag documents into the Service; local file access is initiated by your Authorized User in every instance.

Other integrations. The Service may support Slack, Gmail and Outlook drafting, Stripe billing, and other services. Slack notifications, where enabled, are limited to counts and carry no client names, case details, or document content. Gmail and Outlook capabilities prepare a draft in your own mail client for you to send; Ross does not send email and is never the sender of record for email.

Third-party terms. Each integration requires your separate authorization and is subject to that third party's own terms and privacy policy. We are not responsible for the availability, accuracy, or conduct of any third-party service.

Scope of what you connect. You are solely responsible for determining what you connect. You must not connect any source containing materials you are not permitted to disclose to a vendor, including matters of another firm, materials under seal, materials subject to a protective order restricting vendor access, or data of clients who have not authorized the use of cloud-based vendors.

6.Data handling: key commitments

Full details, including retention periods and subprocessor information, are set out in our Privacy Policy.

Ownership. As between the parties, you retain all right, title, and interest in Firm Data. We do not claim ownership of Firm Data.

Storage. Document storage is local by default, with S3-compatible object storage available on request. Documents read through the Clio integration are read in memory and are not stored by us.

Egress gate. Case data passes through an egress gate before storage or transmission to a remote model. Protected Health Information is gated unless a Business Associate Agreement is on record.

Protected Health Information. Capabilities that read the substance of case documents, including Document AI for scanned medical records, require a Business Associate Agreement and affirmative enablement by an attorney at your Firm. You must not route Protected Health Information to a model provider or other subprocessor unless a BAA covering that flow is in effect.

Model provider commitments. By default, Ross reads and processes your documents using a language model that runs locally within Ross's own environment, so document content is not transmitted to a third-party model provider for that purpose. One capability, Document AI (used to read scanned records, including medical records), instead sends the specific document to Anthropic's Claude API. That capability is off by default, cannot be enabled until an attorney at your Firm attests that a signed BAA covering that flow is in effect, and can be disabled at any time, firm-wide or for a single client. Anthropic processes documents sent under that BAA subject to a thirty (30)-day data retention period — zero data retention is not available under Anthropic's current BAA terms for this capability — and does not use Firm Data to train its models. A current list of our model subprocessors is available at /subprocessors.

No training on your data. We do not use Firm Data, including documents, extracted text, drafts, messages, or approval history, to train artificial intelligence models, whether our own or those of our model providers.

Audit log. Document events, drafts, edits, approvals, and sends are recorded on an append-only, hash-chained audit log, exportable, and not a certification of the accuracy, completeness, legal sufficiency, or admissibility of any entry.

Retention, export, and deletion. On termination or expiration, you may export Firm Data, including the audit log, for thirty (30) days, after which we will delete Firm Data in accordance with our Privacy Policy, subject to backup cycles and legal retention requirements.

Aggregated and de-identified data. We may generate and use aggregated, de-identified operational metrics containing no document content and no Protected Health Information to operate, secure, analyze, and improve the Service.

7.Professional responsibility; attorney supervision and review

No legal advice; no attorney-client relationship. Nothing generated by the Service is legal advice or a substitute for the judgment of a licensed attorney. You alone exercise legal judgment and are responsible for the legal services you provide.

Supervision. You are responsible for supervising the Service consistent with your Firm's rules of professional conduct, including establishing written policies for review of Service output and training your Authorized Users.

Confidentiality and privilege. We treat Firm Data as your Confidential Information under Section 14. We act as your vendor and agent for the purpose of assisting in the delivery of legal services, and the parties intend that our access to Firm Data does not constitute a waiver of privilege or the work product doctrine.

Review modes and enablement of automation. Selecting a review mode, and enabling any message category for automated delivery, is your Firm's decision, recorded with the identity of the individual who made it. Model-written case updates are not eligible for automated delivery under any configuration. Content identified as involving a settlement figure, a deadline, an adverse ruling, or a request that a client take action is escalated to an attorney rather than delivered automatically. These are design constraints of the Service, not a substitute for your review.

Deadlines and calendaring. Any deadline the Service computes or displays is a convenience feature only, with no effect until a person at your Firm confirms it. You are solely responsible for identifying, calculating, calendaring, and meeting every deadline in every matter, and we have no liability for any deadline that is missed, miscalculated, not detected, not displayed, or not communicated.

Advertising, solicitation, and unauthorized practice. You are responsible for ensuring every communication sent through the Service complies with applicable advertising, solicitation, and client-communication rules, and does not constitute or facilitate the unauthorized practice of law.

8.Client communications; consent and messaging compliance

You are the sender. Every message delivered to a client through the Service is your Firm's communication, sent on your Firm's behalf. You are the sender of record and responsible for the content, timing, recipient, and legal compliance of every message.

Consent. You are solely responsible for obtaining, documenting, maintaining, and honoring the consent required to communicate with each recipient, including under the TCPA, applicable state telemarketing statutes, and the CAN-SPAM Act. The Service's consent capture, quiet hours, and STOP/START handling are conveniences, not legal advice.

Message content. Your template library is your content. You are responsible for the accuracy, appropriateness, and legal sufficiency of every template, edit, and approved message.

Delivery is not guaranteed; no emergency use. We do not guarantee that any message will be delivered, delivered on time, or delivered to the intended recipient. The Service is not designed for emergency communications or time-critical instructions.

Your clients are not parties. Your clients and message recipients are not parties to these Terms and are not third-party beneficiaries of them.

9.Prohibited activities

You agree not to:

• Use the Service to process, transmit, or store data in violation of applicable law, any rule of professional conduct, any court order or protective order, or the rights of any third party;
• Connect, upload, or process documents or matter data your Firm is not authorized to disclose to a vendor, including materials of another firm or entity;
• Route Protected Health Information through any capability for which a BAA is not in effect, or attempt to circumvent the egress gate, the approval workflow, the escalation rules, or any other control that limits automated delivery;
• Alter, delete, suppress, or otherwise tamper with the audit log or any record of activity within the Service;
• Communicate with a person known to be represented by other counsel in violation of applicable professional conduct rules, or send unsolicited commercial communications in violation of law;
• Present Service output to any person as legal advice, or resell, sublicense, or make the Service available to anyone who is not an Authorized User;
• Trick, defraud, or mislead us, including attempting to obtain credentials or other sensitive account information;
• Circumvent, disable, or interfere with security-related features, or attempt to access another firm's tenant, data, or session;
• Systematically retrieve data or content to create or compile a collection, database, or directory without our prior written permission;
• Upload or transmit viruses, Trojan horses, or other material that interferes with the Service;
• Engage in automated use of the Service, including scripts, data mining tools, or robots, except as expressly permitted;
• Decipher, decompile, disassemble, or reverse engineer any part of the Service, or use it to build or benchmark a competing product;
• Engage in usage patterns that are abusive, excessive, or inconsistent with normal firm use; or
• Misrepresent your identity, your Firm's identity, or your authorization to access any account, matter, or system.

We may suspend or terminate access if we believe, in our reasonable judgment, that you are engaged in any of the above, and may take appropriate legal action, including reporting conduct to law enforcement or a licensing authority.

10.AI limitations and important disclaimers

Artificial intelligence errors. The Service may misread a document, misclassify what arrived, extract the wrong fact, omit a material fact, mischaracterize a case event, or produce a draft that is inaccurate, incomplete, misleading, or unsuitable. You are responsible for reviewing every draft, classification, extracted fact, and computed date before relying on it or allowing it to reach a client.

Bounded output and escalation. Output eligible for automated delivery is limited to your approved template library. When the Service escalates a document or declines to draft, that is a routing behavior, not a legal determination.

Classification confidence. Document recognition labels are probabilistic estimates of system behavior, not warranties of accuracy in your matters.

Public statements are descriptions of design, not warranties. Our website, product pages, engineering pages, and marketing communications describe the design of the Service at a point in time. They are not representations, warranties, or service level commitments, and are not incorporated into these Terms.

No service level commitment. We do not commit to any uptime, availability, response time, latency, or processing volume, and may change any of them.

Security representations. As of the Last Updated date, we have not obtained SOC 2 or an equivalent third-party security attestation. We do not represent that the Service is certified or compliant with any security framework.

Other regulated uses. Except for Protected Health Information processed under a BAA as described in these Terms, the Service is not designed, intended, or certified for use with nonpublic personal information subject to the Gramm-Leach-Bliley Act, payment card data, biometric data, children's data, or classified or export-controlled information.

11.Intellectual property; license; feedback

We are the owner or licensee of all intellectual property rights in the Service, including source code, models, prompts, workflows, and designs ("Content"), and our trademarks and logos ("Marks"). Subject to your compliance with these Terms and payment of applicable fees, we grant you a non-exclusive, non-transferable, non-sublicensable, revocable license to access and use the Service for your Firm's internal business purposes.

You retain ownership of Firm Data, including your template and consent library. If you send us feedback ("Submissions"), you assign to us all intellectual property rights in the Submission and waive any moral rights in it; Submissions are not treated as confidential, and you must not include Firm Data, client information, or Protected Health Information in a Submission.

12.Fees and payment

Access to the Service is subject to a monthly platform fee, a monthly per-active-case fee at the rate applicable to your tier, and a one-time onboarding fee, set forth on our pricing page or as otherwise agreed in writing.

Active cases. "Active Case" means a matter your Firm has connected to the Service under your current subscription tier. Your subscription's active-case count is set at checkout (or when you change your plan) and is billed at that count for each billing period until you change your plan or cancel.

Billing and payment method. The platform fee and any applicable minimum are billed monthly in advance, based on your current subscription's active-case count. Payment is processed through Stripe hosted checkout by card or ACH; payment card details are handled by Stripe and are not stored on our servers.

Late payment and suspension. Undisputed amounts not paid when due accrue interest at the lesser of 1.5% per month or the maximum rate permitted by law. We may suspend the Service for non-payment after at least fifteen (15) days' written notice and an opportunity to cure.

Billing disputes. Contact us at mtorre@truth-computing.com within thirty (30) days of a charge to raise a billing inquiry.

13.Term, cancellation, suspension, and termination

Following onboarding, your subscription is month to month. You may cancel at any time through your account settings or by contacting mtorre@truth-computing.com; cancellation takes effect at the end of your current paid billing period. We may suspend or terminate access for material breach, non-payment, conduct described in Section 9, or where we reasonably believe continued provision would violate law or create material risk. On termination, your right to use the Service ceases; you may export Firm Data, including the audit log, during the export period described in Section 6.

14.Confidentiality

Firm Data is your Confidential Information; the Service and our pricing and technical information are ours. Each party will protect the other's Confidential Information with at least the degree of care it uses for its own, and disclose it only to personnel and subprocessors bound by confidentiality obligations at least as protective as these. These obligations continue for five (5) years after termination, and indefinitely with respect to client confidences, attorney work product, Protected Health Information, or trade secrets.

15.Privacy, security, and data protection

Please review our Privacy Policy, incorporated into these Terms by reference. We use commercially reasonable safeguards including tenant isolation, multi-factor authentication, an egress gate, and a hash-chained audit log — but no system is completely secure. We maintain a current list of subprocessors at /subprocessors and will provide at least thirty (30) days' notice before a new subprocessor begins processing Firm Data. If we confirm a security incident involving unauthorized access to Firm Data, we will notify you within seventy-two (72) hours of confirmation.

16.Service management, modifications, and interruptions

We reserve the right to monitor the Service for violations of these Terms, restrict access where usage patterns constitute abuse, and otherwise manage the Service to protect our rights and its proper functioning. We cannot guarantee the Service will be available at all times and have no liability for loss or inconvenience caused by downtime, subject to Section 10.

17.Dispute resolution; binding arbitration

Informal resolution. Before initiating any formal proceeding, you agree to contact mtorre@truth-computing.com with a written description of the dispute; the parties will attempt to resolve it informally within thirty (30) days.

Binding arbitration. Disputes not resolved informally will be finally resolved by binding arbitration administered by the American Arbitration Association under its Commercial Arbitration Rules, before one arbitrator, in Los Angeles, California.

Class action waiver. You and Truth Computing agree that each may bring claims against the other only in an individual capacity, not as a plaintiff or class member in any class, consolidated, or representative action or proceeding.

Exceptions. Either party may bring an individual action in small claims court, seek injunctive relief to prevent irreparable harm pending arbitration, or bring an action to enforce its intellectual property rights.

Confidentiality of proceedings. The parties will maintain the confidentiality of the arbitration and cooperate to protect client confidences, Protected Health Information, and attorney work product from disclosure.

Limitations period. Any dispute must be commenced within one (1) year after the cause of action arose.

18.Governing law

These Terms are governed by the laws of the State of California, without regard to its conflict-of-law principles. To the extent a matter is not subject to arbitration under Section 17, the parties consent to exclusive jurisdiction in the state and federal courts located in Los Angeles County, California. The UN Convention on Contracts for the International Sale of Goods and the Uniform Computer Information Transactions Act are excluded.

19.Disclaimer of warranties

The Service is provided on an as-is and as-available basis, at your sole risk. To the fullest extent permitted by law, we disclaim all warranties, express or implied, including merchantability, fitness for a particular purpose, and non-infringement. We make no warranty that the Service or any output will be accurate, complete, or suitable for any matter; that any document or case event will be detected, classified, or escalated correctly; that any message will be delivered; or that your use will satisfy any rule of professional conduct or duty of confidentiality. Except as expressly provided in a signed BAA or Data Processing Addendum, the Service is not tailored to, and we do not warrant compliance with, HIPAA, HITECH, the Gramm-Leach-Bliley Act, or the Payment Card Industry Data Security Standard.

20.Limitation of liability

In no event will we be liable for any indirect, consequential, exemplary, incidental, special, or punitive damages, or for lost profits, revenue, business, or goodwill, arising out of the Service. We have no liability for any claim arising from a missed or miscalculated deadline, a legal malpractice claim or disciplinary proceeding against you, a claim by one of your clients, or a TCPA claim arising from consent you did not obtain or honor. Our total aggregate liability will not exceed the total fees you paid us in the twelve (12) months preceding the event giving rise to the claim. These limitations do not apply to your indemnification obligations, amounts you owe under Section 12, or a party's fraud, gross negligence, or willful misconduct.

21.Indemnification

By you. You agree to defend, indemnify, and hold harmless Truth Computing from any third-party claim arising out of your use of the Service in violation of these Terms; Firm Data or any message delivered on your behalf; your failure to obtain required consent; a claim by one of your clients relating to legal services, communications, deadlines, or case outcomes; a disciplinary or bar proceeding involving your Firm; or your routing of Protected Health Information without a required BAA.

By us. We will defend you against a third-party claim alleging the Service, as provided by us and used in accordance with these Terms, infringes a U.S. patent or copyright or misappropriates a trade secret, and will pay amounts finally awarded or agreed in settlement — except where the claim arises from Firm Data, your configuration, or modification of the Service by anyone other than us.

22.Electronic communications and signatures

You consent to receive electronic communications and agree that electronic signatures, contracts, and records satisfy any legal requirement that such communication be in writing, waiving any defense based on the electronic form of these Terms.

23.General provisions

Entire agreement. These Terms, our Privacy Policy, and any executed order form, BAA, or DPA constitute the entire agreement and supersede all prior agreements and marketing statements on the same subject matter.

Assignment. You may not assign these Terms without our prior written consent, except to a successor by merger, combination, or acquisition of all or substantially all of your practice. We may assign these Terms in connection with a merger, acquisition, or sale of our assets.

No agency. Nothing in these Terms creates an agency, partnership, or employment relationship, except that we act as your vendor and agent for the limited purpose described in Section 7.

No third-party beneficiaries. These Terms are for the benefit of the parties only; no client or message recipient has any right to enforce any provision.

Notices. Notices to us must be sent to mtorre@truth-computing.com and to Truth Computing Incorporated, 5571 Golf St., Jurupa Valley, CA 92509, effective upon confirmed receipt.

Force majeure. Neither party is liable for delay or failure in performance resulting from causes beyond its reasonable control; this does not excuse any payment obligation.

Severability; no waiver; controlling language. If any provision is found invalid, the remaining provisions continue in force. A failure to enforce any right is not a waiver of it. These Terms are written in English, which controls over any translated version.

24.Contact us

To resolve a complaint regarding the Service or to receive further information, please contact us at:

• Truth Computing Incorporated
• 5571 Golf St., Jurupa Valley, CA 92509
• Email: mtorre@truth-computing.com
• Website: https://mike-ross.org