Privacy Policy

Platfirm AI Pty Ltd (Platfirm, we, us, our), an Australian company (ACN 679 859 744 / ABN 24 679 859 744) of Level 17 & 18, International Tower 3, 300 Barangaroo Avenue, Sydney NSW 2000, Australia, operates CabRank Legal (cabrank.legal). This Privacy Policy explains how we collect, use, share, retain, and disclose personal information, and what your rights are.

CabRank is a referral marketplace, AI intake and referral handoff platform. It is not a legal practice management system, case management system, billing system, trust accounting system, document management system or system of record for legal matters. Where information is passed to a law firm’s own practice management system or document store, the firm controls that information from that point on.

The UK platform runs on its own dedicated database in London (eu-west-2), never shared with any other country. Referral, intake and client data for UK users is hosted in the United Kingdom by default. For the purposes of UK data protection law (the UK GDPR and the Data Protection Act 2018), Platfirm AI Pty Ltd is the controller of the personal data described in this policy.

1. Who this policy applies to

• Members of the public who interact with our intake channels (web bookings, partner-site web forms, voice AI hotlines) and become legal enquiry referrals on the CabRank platform.
• Solicitors and law-firm administrators who sign up to receive referrals through the CabRank platform.
• Website visitors who browse cabrank.legal without signing up.

2. Personal data we collect

From members of the public seeking legal help:

• Name, phone number, email address.
• Jurisdiction (England & Wales, Scotland, or Northern Ireland); postcode.
• Area of law of the legal enquiry; a brief description of the enquiry or requested assistance.
• For paid bookings: billing information processed by Stripe (CabRank does not see or store card details).
• For voice intake calls: an audio recording and AI-generated transcript and summary of the call.

From solicitors and law-firm administrators:

• Name, work email, mobile number, firm name, business identifiers, position.
• Licensing / practising details, areas of law, preferences for receiving referrals.
• Connection credentials for handoff destinations the firm chooses: OAuth tokens for bring-your-own storage such as Google Drive, and, for firms connecting DeedBox directly, the connection key the firm issues from its own DeedBox (revocable by the firm at any time). We never see your third-party system password. For firms whose practice-management system (Clio, LEAP, Smokeball or Actionstep) connects through our Zapier integration, your practice-management login is entered by you directly with Zapier and is never visible to CabRank.
• Billing information for subscription payments processed by Stripe.

From website visitors:

• Standard server log information (IP address, browser, page requested, timestamp).
• Cookies necessary for the site to function. We do not use third-party advertising cookies.

3. How we use your personal data, and our lawful bases

We use personal information for the purpose for which it was collected, and for purposes that are reasonably necessary or directly related, including:

• Members of the public: to route your legal enquiry to a suitable UK solicitor; to process bookings; to send confirmations and follow-ups; to operate our referral matching and AI redaction; to respond to enquiries; and to support our intake-channel partners where you came in through their channel.
• Solicitors and firms: to provide the CabRank platform; to match referrals to your practice profile; to pass confirmed intake information to your connected handoff destination or bring-your-own storage where enabled; to bill your subscription; to provide support; and to send service notifications such as digests, referral alerts, account changes and security advisories.
• All users: to operate, secure, and improve the platform; to comply with legal obligations; to investigate complaints; to detect and respond to misuse.

We do not sell your personal information. We do not use your personal information to train AI models.

Under the UK GDPR, we rely on the following lawful bases: performance of a contract (operating your CabRank account or your paid booking); legitimate interests (routing enquiries to matched solicitors, platform security, service improvement — balanced against your rights); consent (where we ask for it specifically); and legal obligation (tax, audit and regulatory record-keeping).

4. Who we share your personal data with

CabRank shares personal information with third parties only as described in this policy. The third parties fall into three categories.

Sub-processors are service providers we engage to operate the platform — hosting, payment processing, email delivery, AI summarisation, and so on. We disclose all of them, including their hosting region and what data they handle, on our Security page. Sub-processor changes are notified to firm administrators by email at least 14 days before taking effect, unless otherwise agreed.

UK solicitors receiving referrals. When a member of the public becomes a referral on the platform and a solicitor claims the referral, we share the relevant referral and intake information — including your name, contact details, jurisdiction and enquiry summary — with that solicitor so they can assess the enquiry and decide whether to act. AI-redacted summaries are shown before a referral is claimed, so the commercial framing of any intake call is stripped before anyone sees it.

Connected systems chosen by the firm. Once a referral is claimed and the firm chooses to proceed, confirmed intake information may be passed to the firm’s chosen handoff destination: the firm’s own DeedBox installation (connected directly), the firm’s practice-management system (Clio, LEAP, Smokeball or Actionstep, delivered via Zapier, our workflow sub-processor), or bring-your-own Google Drive. The firm is responsible for that information once it is in the firm’s own system. CabRank does not maintain the legal file of record.

Compliance and lawful requests. We may disclose personal information where required or permitted by law, including in response to a valid request from a court, regulator, or law-enforcement agency.

5. International transfers

UK data is hosted in London by default. Because Platfirm is an Australian company, limited personal data may be processed in Australia (platform administration and support), and several sub-processors are based in the United States (listed with their regions on our Security page). Where personal data leaves the UK we take steps to ensure an equivalent standard of protection, including contractual safeguards with each sub-processor.

6. How long we keep your personal data

We keep personal information only for as long as necessary for the purposes for which it was collected, or as required by law.

• Pre-claim referral and intake information: retained on the platform for up to 90 days from creation, after which it is deleted or anonymised unless still active.
• Claimed referral metadata: limited operational metadata such as referral ID, area of law, jurisdiction, claim event and paid status — with no client-identifying detail — is retained for audit and analytics. The legal file of record lives in the firm’s chosen system, not on CabRank’s servers.
• Professional / firm-administrator profiles: retained for the lifetime of the account, plus a reasonable archival period after account closure to comply with tax, audit, and legal obligations.
• Connection credentials (OAuth tokens and connection keys): deleted immediately when a firm disconnects the relevant integration, or within 30 days after account closure if not earlier disconnected.
• Call recordings and transcripts from voice intake: redacted summaries may be retained as part of the referral and intake record; raw recordings are retained only as long as needed for AI processing and quality assurance, typically less than 90 days.
• Server logs and analytics: retained for up to 12 months.

7. Your rights under UK GDPR

You have the right to:

• Access the personal data we hold about you.
• Rectify inaccurate or incomplete personal data.
• Erasure (“right to be forgotten”), subject to any legal obligation we have to retain data.
• Restrict or object to processing, including processing based on legitimate interests.
• Data portability for data you provided to us.
• Withdraw consent at any time, where processing is based on consent.

To exercise any of these rights, contact support@platfirm.ai. We will:

• Acknowledge your request within 5 business days.
• Verify your identity before acting on the request.
• Complete a verified deletion request within 30 days.
• If we are unable to comply with all or part of your request, explain why in writing.

Where personal information has been passed to a firm’s own system or storage as part of a claimed referral, that information is under the firm’s control, not CabRank’s. We will help you contact the firm to make a separate request to them.

8. How we protect your personal data

CabRank’s data hosting, encryption, access controls, incident-response procedure, vulnerability-disclosure path, and patching SLAs are documented on our Security page. In summary:

• Each country runs on its own dedicated database, never shared with any other country.
• HTTPS-only connections, TLS 1.2 or higher.
• Encryption at rest (AES-256), encryption in transit, bcrypt password hashing.
• Row-level security at the database layer; named, least-privilege administrative access with strong authentication on the hosting, code and deployment platforms.
• Material security incidents affecting customer data are notified to affected firms within 72 hours of CabRank becoming aware.

Cookies and analytics

cabrank.legal uses cookies necessary for the site to function (such as session cookies for signed-in users). We do not use third-party advertising cookies and we do not run cross-site tracking. Server-side analytics is limited to anonymised page-view metrics required to operate and improve the platform.

Children

CabRank’s services are not directed at children under 18. We do not knowingly collect personal information from children. If you believe a child’s personal information has been provided to us, contact support@platfirm.ai and we will delete it.

Changes to this policy

We may update this Privacy Policy from time to time. The version number and last-updated date at the top of this page indicate the current version. Material changes will be notified to firm administrators by email at least 14 days before taking effect. Continued use of the platform after a change takes effect constitutes acceptance of the updated policy.

Questions and complaints

Privacy questions and complaints go to support@platfirm.ai. You also have the right to lodge a complaint with the UK Information Commissioner’s Office (ico.org.uk).