Effective date: November 7, 2026
This Privacy Policy explains how ANAVTEK LLC dba Lumbre Legal ("Lumbre", "we", "us") collects, uses, and protects information through lumbrelegal.com and the Lumbre case-management service (the "Service"). Lumbre is a business service for law firms. When a firm uses Lumbre to manage its cases, the firm decides what information goes in, and we process that information on the firm's behalf and under its instructions.
Information we collect
Account and sign-in information. When someone at a firm uses Lumbre, we collect their name, work email address, the firm they belong to, and their role. Sign-in is passwordless: we email a one-time code, so we never collect or store a password.
Client and case information firms enter. Firms put their own case information into Lumbre: clients and contacts, matters, deadlines, insurance, medical providers and treatment, liens, expenses, notes, and similar records. This can include sensitive information about a firm's clients. It belongs to the firm.
Documents and emails. Firms upload documents and may send or forward emails to a matter's Lumbre email address. We store those emails and their attachments so they appear on the right case. Where a firm uses the fax feature, we store the faxes it sends and receives.
Text messages. If a firm turns on client texting, we process the client's mobile number, their texting consent, and the content of the case-update texts the firm sends.
Website analytics, on our marketing pages only. Our public marketing pages (such as the home page, features, blog, and pricing pages) use Google Analytics to understand visits, for example which pages are viewed. Google signals and ads personalization are turned off for our analytics, so it is not used for advertising. Analytics never runs inside the Lumbre application. Our site is built so that analytics is switched off before any page of the application (or the sign-in page) loads, and any analytics request that would carry an application address is blocked in the browser, so case and client pages are never tracked.
Forms you send us. When you fill in a form on our site, such as a request to get started or to contact us, we collect what you enter, for example your name, firm, email, and phone number, and we use it to reply to you.
Technical information. Like most online services, our hosting providers record basic technical information such as IP addresses, browser type, and request logs, which we use to run, secure, and troubleshoot the Service. The application uses cookies that are needed to keep you signed in.
How we use information
- To provide the Service to firms: storing and organizing case information, filing incoming emails and documents to the right case, sending the messages and notifications a firm sets up, and supporting its users.
- To run the Service's AI features. Lumbre uses AI to read documents and emails (and faxes, where a firm uses fax) and to suggest updates to a case, such as a new deadline or an insurance policy. These are suggestions only: a person at the firm reviews them, and nothing is added to a case automatically.
- To keep the Service secure, prevent misuse, and fix problems.
- To respond to people who contact us, and to understand use of our public marketing pages.
- To meet legal obligations.
We do not use firm or client data to train AI models. Our AI provider processes data only to provide the Service and, under its commercial terms, does not train its models on it.
How we share information
We do not sell personal information, and we do not share it for cross-context behavioral advertising. Our marketing-site analytics has advertising features (Google signals and ads personalization) turned off.
We share information only with service providers that help us run the Service, under contracts that limit their use of it to providing services to us:
- Hosting and computing
- Database hosting
- Document and file storage, and receiving email sent to case addresses
- Sign-in and account management
- Sending transactional email (such as sign-in codes and daily case updates)
- AI processing (reading documents and suggesting case updates)
- Website analytics, on marketing pages only
- Payment processing, where applicable
- Fax sending and receiving
- Text messaging, through the firm's own messaging account
We may also disclose information if required by law, to protect the rights and safety of Lumbre, our customers, or others, or as part of a merger, acquisition, or sale of assets, in which case this Policy will continue to apply to the information transferred.
Text messaging (SMS)
Mobile numbers and texting consent collected for client case-update texts are used only to send those texts. We do not share or sell mobile information or texting consent to third parties or affiliates for marketing or promotional purposes. Text messaging originator opt-in data and consent will not be shared with any third parties, except service providers that help us deliver the messages. Recipients can reply STOP at any time to opt out, or HELP for help. See the text-messaging section of our Terms of Service.
How we protect information
- Passwordless sign-in. Users sign in with a one-time code sent to their email, so there are no passwords to steal or reuse.
- Each firm's data is separate. Access is scoped to a firm, and every request is checked against the signed-in user's firm.
- Encrypted credentials and identifiers. Credentials for services a firm connects to Lumbre are stored encrypted, and especially sensitive identifiers, such as Social Security and tax ID numbers, are encrypted at the field level.
- Audit trail. Important changes are recorded in an audit log.
- Access-controlled storage. Documents are stored in access-controlled cloud storage and are only served to signed-in users of the firm they belong to.
No system is perfectly secure, but we work to protect the information we hold and to improve our safeguards over time. Read more on our Security page.
How long we keep information
We keep a firm's data for as long as the firm is a customer, so it can keep working its cases. Some content has shorter, automatic retention: for example, AI suggestions that no one reviews are deleted after 60 days, and faxes a firm marks as junk or not relevant may be deleted after 90 days. A firm can ask us to export its data or transfer a case to another firm, and, when it stops using Lumbre, to delete its data. We delete or de-identify it unless we need to keep something to meet a legal obligation or resolve a dispute. Backups kept by our database provider expire on their normal schedule.
Your choices and rights
Firm users can see and update much of their information in the application. Because we process case information on a firm's behalf, clients of a firm who want to access, correct, or delete their information should contact that firm directly. We will help the firm respond.
California residents. The California Consumer Privacy Act, as amended by the California Privacy Rights Act (CCPA/CPRA), gives California residents rights over their personal information, subject to exceptions, including the right to know what personal information we collect and how we use and share it, the right to request a copy, the right to request correction or deletion, and the right not to be discriminated against for using these rights. We do not sell or share personal information as those terms are defined in the CCPA, and we do not use sensitive personal information to infer characteristics about anyone. Where we hold information as a service provider to a law firm, we will direct the request to that firm or assist it in responding. To make a request, email privacy@lumbrelegal.com. We will verify the request before acting on it, and you may use an authorized agent.
Children
Lumbre is a service for businesses. It is not directed to children under 13, and we do not knowingly collect personal information from them through our website.
Changes to this Policy
We may update this Policy from time to time. When we do, we will update the effective date above, and if the changes are significant we will let our customers know in advance.
Contact us
ANAVTEK LLC dba Lumbre Legal
Privacy requests and questions: privacy@lumbrelegal.com
For anything else, use our contact page.