Privacy Policy

1. Who this policy is for

This policy covers three groups of people, and the answer is different for each:

• Visitors to disbursely.co. People reading our website. We collect very little from you.
• Firm users. Attorneys, paralegals, accounting staff, and administrators who log in and use the platform.
• Settlement recipients. Clients, medical providers, and lienholders who are being paid out of a settlement. You are usually not a Disbursely user and may never see the platform. Your information is in our system because the paying law firm put it there.

Disbursely is offered only to businesses in the United States. The platform, and all the information described in this policy, is hosted and processed in the United States. We do not offer the service in other countries, and this policy is written around United States privacy law.

2. Our role, and your firm's

This distinction matters, so it comes early.

For information about settlement recipients, the law firm is in charge, not us. The firm decides what to collect, why, who to pay, and how long the record needs to live. We hold and process that information on the firm's instructions, as its service provider. We do not decide independently what to do with it.

Practically, that means if you are a settlement recipient and you want to know what is held about you, correct it, or ask for it to be deleted, the law firm handling your case is where that request goes. They control the record, and they may also have professional obligations to keep it regardless of what we do.

For information about firm users and website visitors, we make those decisions ourselves, and this policy describes them.

3. What we collect

From firm users:

• Name, work email, phone number, job title, and assigned role
• Login and authentication information
• A record of what you did in the platform: what you created, edited, approved, and released, with timestamps
• Support messages you send us

About settlements and the people being paid:

• Case or matter identifiers and settlement amounts
• Recipient names and contact details
• Bank account and routing numbers, or a mailing address for a printed check
• Line-item detail: attorney fees, client proceeds, medical liens, case costs, and their accounting codes
• Documents your firm uploads, such as settlement statements
• Payment status and settlement dates

Technical information:

• IP address, browser and device type, and pages viewed
• Security and access logs

4. Where it comes from

Almost everything comes from the law firm using the platform, or from the firm's staff entering it. We do not buy personal information, and we do not collect it from settlement recipients directly.

We also receive payment status information back from banks and payment providers, such as whether a payment settled, was returned, or failed.

5. How we use it

We use information to:

• Run the platform and move payments as your firm instructs
• Maintain the audit trail, which is a core part of what the product is for
• Verify approvals and enforce role-based permissions
• Produce accounting exports and reports for your firm
• Detect and prevent fraud, error, and unauthorized access
• Provide support when your firm asks for help
• Meet our own legal, tax, and recordkeeping obligations
• Understand how the product is used, so we can improve it

6. What we never do

• We do not sell personal information, and we do not share it for cross-context behavioral advertising.
• We do not market to your firm's clients. A settlement recipient's contact details are used to pay them, not to reach them about anything else.
• We do not use your firm's client data to train artificial intelligence models, our own or anyone else's.
• We do not use settlement data for any purpose beyond running the service for the firm that entered it.

7. Who we share it with

We share information only where it is needed to do the job:

• Banks and payment infrastructure providers, to actually execute a payment. This necessarily includes the recipient's name and account or address details.
• Check printing and mailing providers, where a payment is issued as a physical check.
• Cloud hosting and infrastructure providers, which store the data on our behalf.
• Accounting systems you connect, at your firm's direction, to deliver exports.
• Professional advisors such as auditors and lawyers, under confidentiality obligations.
• An acquirer, if our business is bought or merged. We would give notice before your firm's information became subject to a different privacy policy.

Every provider we use is bound by contract to protect the information and to use it only for the service they provide to us.

8. Legal demands

We may disclose information where the law requires it, such as in response to a subpoena, court order, or lawful government request.

Because this data often includes privileged and confidential client material, we will notify the affected firm before responding, unless we are legally prohibited from doing so, so the firm has an opportunity to object or assert privilege on its client's behalf.

9. How we protect it

• Data is encrypted in transit and at rest.
• Sensitive values, including account numbers, routing numbers, and settlement amounts, carry additional field-level encryption.
• Bank and accounting credentials are held server-side and are never exposed to the browser.
• Access is invite-only with role-based permissions, so users see only what their role allows.
• Access to production data by our own staff is limited to those who need it, and is logged.

No system is perfectly secure, and we won't claim otherwise. If a breach affects your information, we will notify you and the affected firm without undue delay and as required by law.

10. How long we keep it

We keep settlement records for as long as the firm's account is active, because the audit trail is the product. Law firms typically have their own bar-imposed retention requirements for client trust records, which are often longer than the life of a case.

After an account closes, the firm can request a full export for seven (7) years. After that we delete or de-identify the data, unless we are legally required to keep it longer.

Security and access logs are kept for twenty-four (24) months.

11. Your choices and rights

If you are a firm user: you can ask us to see, correct, or delete your account information by writing to hello@disbursely.co. Note that we cannot delete audit trail entries recording actions you took, because their integrity is what makes the record trustworthy.

If you are a settlement recipient: contact the law firm that paid you. They control that record, and requests about it go to them rather than to us. See section 2.

State privacy rights. Several U.S. states, including New Jersey, give residents privacy rights. Depending on where you live, you may have the right to know what personal information is held about you, to request deletion or correction, to receive a copy, and not to be discriminated against for exercising those rights. We do not sell personal information or use it for targeted advertising, so there is nothing to opt out of on that front. If your information is with us because a law firm is paying you out of a settlement, that firm controls the record and your request goes to them. For the information we control ourselves, meaning firm user accounts and website visitors, email us at hello@disbursely.co and we will verify your identity before acting.

12. Cookies and the website

Our public website uses only what it needs to function. We do not run advertising trackers on it.

The platform uses cookies that are strictly necessary to keep you logged in and to keep your session secure. These cannot be turned off without breaking the ability to sign in.

13. Children

Disbursely is a business tool and is not directed to children. We do not knowingly collect information from anyone under 18 as a platform user.

A settlement recipient can be a minor, for example where a case involves an injured child. In that situation the information is provided by the law firm as part of the disbursement record, and it is handled the same way as any other recipient information described in this policy.

14. Changes to this policy

We may update this policy. If a change materially affects how we handle personal information, we will give notice by email or in the platform at least thirty (30) days before it takes effect. The effective date at the top of this page always reflects the current version.

15. Contact

Questions, requests, or concerns about privacy:

Disbursely LLC
971 US Highway 202N, Ste R
Branchburg, NJ 08876
hello@disbursely.co

If you are a settlement recipient asking about your own information, contact the law firm handling your case. They control that record and are the ones who can act on it.