Legal
Privacy Policy
Version 2.0 — Effective August 16, 2026
Law-O-Matic is operated by Technology On Call, based in Granby, Connecticut, USA (“we”, “us”). This policy explains what we collect when you use law-o-matic.com, why we collect it, who else processes it, how long we keep it, and how to exercise your rights over it.
It sits alongside our Terms of Service and Cookie Policy.
1. What we collect
Account information. Your email address, and the timestamps of your sign-ins. We do not store your password — authentication is handled by our infrastructure provider.
Scans you run. The address you submitted, the resolved hostname, the full report and its individual findings, the engine version that produced it, when it ran, and your affirmation that you were authorized to scan that address.
Business details you choose to supply. If you fill in the optional business-details form before generating fix files, we store the legal business name, privacy contact email, mailing address, governing state and phone number you enter. These are used for one purpose: filling in the legal document drafts we generate for you, so they do not come out full of blanks. They are never used for marketing.
Fix-file access requests. When you request the generated fix files, we record the request, its status, who decided it and when, and which files were released.
Agreement records. When you accept the Terms or acknowledge a warning before downloading generated files, we record that acceptance.
Email delivery events. Whether an email we sent you was accepted, delivered, bounced or reported as spam. We use this to stop mailing addresses that do not work. We do not use open or click tracking in our email — those are switched off deliberately.
Bot protection. Cloudflare Turnstile runs a check to confirm a scan request comes from a person rather than a script. It processes technical signals from your browser and network connection.
2. What we do not do
We do not sell your personal information. We do not share it for cross-context behavioural advertising. We do not run advertising trackers, retargeting pixels, or session-replay tools on Law-O-Matic. We do not publish your reports or the addresses you scan, and we do not use them to build a marketable dataset about other people's websites.
We may use aggregated, de-identified statistics from scans to improve the Service and to describe it publicly, provided no individual customer or site can be identified.
3. Why we are allowed to process it
For customers in the UK and EU, our lawful bases under the UK GDPR and GDPR are:
Performance of a contract — running the scans you ask for, storing your reports so you can return to them, generating fix files, and handling access requests.
Legitimate interests — keeping the Service secure and available, preventing abuse and unauthorized scanning, acting on bounced and complained-about email, and understanding aggregate usage. We have considered these against your interests and consider them proportionate.
Consent — analytics cookies only. Nothing analytics-related loads until you opt in, and you can withdraw at any time.
Legal obligation — where we must keep records to comply with law.
4. Cookies and analytics
Our use of cookies, the consent banner, and the analytics we run are described in full in the Cookie Policy.
5. Who else processes your data
We use the following providers. Each processes data on our instructions to run the Service; none receives it for their own marketing.
Supabase — database, authentication and file storage. Holds your account, scans, reports and requests. United States.
Render — runs the scanning engine. Receives the address being scanned at the moment of the scan. United States.
Resend — sends transactional email (sign-in links, notifications about your requests). Receives your email address. United States.
Cloudflare — DNS, content delivery, and the Turnstile bot check. Processes connection-level technical data. Global network.
Lovable — hosts the website itself. United States.
Google Analytics 4 — aggregate usage statistics. Loads only if you accept analytics cookies. United States.
CookieYes — presents the consent banner and records your cookie choices.
If we add or change a provider in a way that materially affects your data, we will update this list.
6. International transfers
We are based in the United States and the providers above process data in the United States. If you are in the UK or EEA, your information is transferred outside your home jurisdiction. Where required, those transfers rely on the providers' standard contractual clauses and equivalent safeguards.
7. How long we keep it
Reports and the addresses you scanned are kept for as long as your account is active, and for a reasonable period afterwards, as set out in the Terms. You can ask us to delete them sooner.
Email delivery events are kept as an operational record of deliverability. Agreement records — your acceptance of the Terms and of file-release warnings — are kept for as long as they may be needed as evidence that the agreement was made, because deleting them would remove the record protecting both sides.
8. Security
Access to customer data is restricted by row-level security rules in the database, so an account can only read its own records. Traffic is encrypted in transit. Administrative access is limited to the operator. No system is perfectly secure, and we do not claim otherwise — but we hold ourselves to the standards this product measures other sites against, and we scan our own site with it.
If you believe you have found a security issue, please see the reporting route in our Acceptable Use Policy.
9. Your privacy rights
Depending on where you live, you have some or all of the following rights over your personal information:
Access — a copy of what we hold about you. Correction — fix anything inaccurate. Deletion — have it erased. Portability — receive it in a portable format. Restriction and objection — limit or object to how we use it. Withdraw consent — for anything based on consent, at any time.
California residents additionally have the right to know what is collected and why, the right to delete, the right to correct, the right to opt out of sale or sharing, and the right not to be discriminated against for exercising any of them.
How to make a request. Email [email protected] with the subject line “Privacy request” and tell us what you want to do. Send it from the address on your account where you can, so we can be confident the request is really from you. If you cannot, we may ask for another way to confirm it — we will only ask for what we need to be sure.
We aim to respond within 30 days, and within 45 days for requests under California law, as those laws require. There is no charge. An authorized agent may act for you if you confirm the authority.
If you are unhappy with how we have handled a request, you can complain to your data protection authority — in the UK, the Information Commissioner's Office; in the EEA, your national supervisory authority.
10. Do not sell or share
We do not sell personal information and we do not share it for cross-context behavioural advertising, as those terms are defined under California law. There is accordingly no sale or sharing for you to opt out of. You can still control non-essential cookies at any time through Your Privacy Choices or Cookie preferences in the footer.
11. Automated analysis
Scans are automated. The Service inspects a site and produces scores and findings without a human reviewing each one. Those outputs describe what an automated tool observed at a point in time. They are not legal advice, not a compliance certification, and they are not used to make any decision that produces a legal or similarly significant effect about you.
12. Children
Law-O-Matic is a business tool and is not directed to children. We do not knowingly collect personal information from anyone under 13. If you believe a child has provided us information, contact us and we will delete it.
13. Changes to this policy
If we change this policy materially, we will update the version and effective date above and, where the change affects how we use information you have already given us, tell account holders by email.
14. Contact
Technology On Call, Granby, Connecticut, USA — [email protected]