Privacy Policy

This Privacy Policy describes how Barshay, Rizzo & Lopez, PLLC (the “Firm,” “we,” “us,” or “our”) collects, uses, and safeguards information in connection with BRL Matters, our web-based case-management and communication platform (the “Platform”). It applies to Firm attorneys and personnel, clients, co-counsel, vendors, experts, medical providers, and other authorized users who access the Platform.

Substantive case, client, and matter information handled through the Platform is treated as confidential and may be subject to the attorney-client privilege, the work-product doctrine, and the Firm’s professional and ethical obligations. Nothing in this Policy limits those obligations. This Policy addresses how the Platform handles information as a system; it does not modify the Firm’s duties to its clients.

Information We Collect

Account information. When an account is created for you, we collect your name, email address, username, a securely hashed password, your role and permissions within the Platform, and, where two-factor authentication is used, a mobile telephone number used to deliver verification codes.

Usage and technical information. When you use the Platform, we automatically record technical records that include your IP address, browser and device information (user agent), authentication activity (including sign-in attempts, successes, failures, and account lockouts), session activity, actions taken within the Platform, document activity, configuration changes, and system errors and security events.

Case and matter information. The Platform stores the documents, communications, calendar entries, and matter data that you or the Firm submit or generate in the course of a legal matter. This is substantive case information handled subject to the confidentiality and privilege obligations described above.

Cookies, Analytics, Error Reporting, and Logs

Cookies. The Platform uses only strictly necessary cookies required to operate the service — principally a signed authentication/session cookie and short-lived security cookies (for example, a two-factor or third-party sign-in state cookie). We do not use advertising cookies or cross-site tracking cookies. For convenience, your browser may locally remember the last username entered on your device; this stays on your device and is not a password.

Analytics. The Platform does not embed third-party web-analytics, advertising, or behavioral- tracking tools.

Error reporting and logs. The Platform and its hosting providers generate operational and error logs used to run, secure, and troubleshoot the service. As noted above, we log IP addresses, device/ browser information, and authentication and security events for security, auditing, and administration.

Where Information Is Hosted

The Platform is hosted on cloud infrastructure operated by established third-party providers. The application runs on Vercel, application data is stored in a Neon-managed PostgreSQL database, and backups and certain stored documents are maintained in Microsoft Azure storage. Email-related functionality operates through Microsoft 365 / Microsoft Graph. These providers may store or process information in the United States or in other locations depending on their infrastructure and configuration.

Service Providers and Subprocessors

We use reputable third-party service providers to operate the Platform. Each processes information only as needed to provide its service to us and under confidentiality obligations. They include:

• Vercel — application hosting and delivery.
• Neon — managed PostgreSQL database hosting.
• Microsoft — Microsoft 365 / Microsoft Graph (email) and Microsoft Azure (document and backup storage).
• A practice-management and document service — a third-party platform that provides document and matter-management services integrated with the Platform.
• Twilio — delivery of two-factor authentication codes by text message.
• GitHub — automated backup workflows.

We may add, replace, or discontinue service providers as reasonably necessary to operate and secure the Platform.

How We Use Information

We use the information described above to provide and operate the Platform, administer legal matters, authenticate users, maintain security and investigate suspected misuse, provide support, maintain backups, satisfy legal and professional obligations, and improve the reliability of the service.

We Do Not Sell Data or Use It for Advertising or AI Training

We do not sell personal information. We do not use client, matter, or personal information for advertising, and we do not use it to train artificial-intelligence or machine-learning models, nor do we provide it to third parties for the purpose of training their models.

Retention and Deletion

We retain information for as long as needed to administer the applicable matter, operate the Firm, and meet our legal, regulatory, and professional obligations, including applicable file-retention requirements and legal holds. Backups are maintained on a recurring schedule and are retained for a limited period before being overwritten or expired. Security and audit logs are retained as needed for security and compliance. Because client files and matter records are subject to professional-responsibility and legal-retention obligations, deletion is handled consistently with those obligations rather than on demand. To ask about retention or deletion of your information, contact us using the information below.

Security

We maintain administrative, technical, and physical safeguards reasonably designed to protect information, including encryption of communications in transit, salted one-way hashing of Platform-managed passwords, multi-factor authentication, session expiration, account-lockout controls, and access logging. Our practices are described more fully in our Security Statement. No internet-based system can be guaranteed to be completely secure, and information you download, print, forward, or remove from the Platform is no longer protected by the Platform’s controls.

How to Contact Us

For questions about this Privacy Policy or the Firm’s handling of information, or to raise a security concern, contact:

Barshay, Rizzo & Lopez, PLLC
445 Broadhollow Road, Suite CL18
Melville, New York 11747
Privacy: privacy@brlfirm.com · Security: security@brlfirm.com
Telephone: (631) 210-7272

Changes to This Policy

We may update this Privacy Policy to reflect changes in the Platform, our practices, our service providers, or legal requirements. The “Last updated” date identifies the current version.