Lorla - Privacy Policy

Effective date: 29 June 2026 Last updated: 29 June 2026

1. Who we are and scope

Lorla is operated by GrowthX Group LLC dba Cyberaktive ("we", "us", "our"), a Wyoming limited liability company. This Privacy Policy explains what data Lorla collects, how it is stored and protected, who processes it on our behalf, and how it is deleted. Contact: Liam Barnes, GrowthX Group LLC dba Cyberaktive, 36 Shadow Brook Ln, Lander, WY 82520, United States, liam@cyberaktive.com.

Lorla is built for solo and small-firm attorneys who handle privileged, confidential client information. We have designed the App around data minimization, on-device encryption of the most sensitive fields, and prompt deletion. This Policy is not legal advice and does not alter your own professional and ethical confidentiality obligations.

Lorla is distributed globally through the Apple App Store. This Policy applies to all users, and Section 8A ("Your rights by region") sets out additional rights and disclosures for users in the EU/EEA, the United Kingdom, Canada, and Australia.

2. The data Lorla handles

a. Clio account connection

When you connect Lorla to Clio, you authorize it through Clio's OAuth flow (per-user OAuth, Clio's CA hosting region). Lorla receives Clio OAuth access and refresh tokens. These tokens are stored on your device in the operating system's secure credential store (expo-secure-store) and are never stored in Lorla's on-device database. Lorla requests only the access it needs: reading your matters and time entries, writing time entries back to Clio, managing the webhooks that keep your matter list in sync, and reading your basic Clio account identity.

b. Matter data cached on your device

So you can browse and pick matters offline, Lorla caches a limited set of fields from your Clio matters on your device. The complete list of cached matter fields is:

• Clio matter ID (numeric reference);
• matter display number (e.g. "2024-001");
• matter description / title - encrypted at rest;
• matter status (Open / Pending / Closed);
• client name - encrypted at rest;
• the timestamp of the last successful cache refresh.

c. Time entries queued on your device

When you capture time, Lorla queues the entry on your device until it is approved and synced to Clio. The queued fields include the Clio matter ID, the work date, the billed duration, the billing note/narrative (encrypted at rest), a non-billable flag, sync workflow status, an idempotency key, internal correlation identifiers, a backend error template (status codes only, never client content), match-confidence data, and the match-reason explanation (encrypted at rest). A running timer, while active, also stores an in-progress note draft on your device (encrypted at rest).

Each stored field is limited to what is necessary for offline time capture and for writing the entry to Clio. We maintain an internal field-by-field justification for every cached and queued field.

d. Data we do not collect

Lorla does not request Clio access beyond reading matters and time entries, writing time entries, managing its own webhooks, and reading basic account identity, and does not pull Clio fields it does not use. Lorla does not include an analytics, crash-reporting, or device-telemetry SDK at launch, and does not collect device or usage data through any third-party analytics provider.

3. How your data is protected

• On-device encryption at rest. Five fields that can contain privileged client or narrative content are encrypted on your device using AES-256-GCM field-level encryption: the matter description, the client name, the queued billing note, the match-reason explanation, and the active-timer note draft. The 256-bit encryption key is generated on your device at first run, stored only in the device secure store, and never leaves your device or is sent to our backend.
• Encryption in transit. All traffic between the App and both the Clio API and the Lorla backend is encrypted with TLS.
• Non-privileged fields. Operational fields (Clio numeric identifiers, status enums, timestamps, durations, flags, and internal keys) are stored in plaintext on-device because they contain no client-identifying narrative.

Full technical detail is in the Security Policy.

4. How long we keep data, and deletion

• Matter cache - 30-day TTL. Cached Clio matter data is automatically evicted after a 30-day time-to-live so stale Clio data is not retained on your device indefinitely.

• Queued time entries. A queued entry is retained only until it is successfully submitted to Clio or you discard it.

• Sign-out. On sign-out, Lorla wipes its on-device store.

• De-authorization. When you revoke Lorla's authorization in Clio, Lorla deletes the Clio data it holds: the on-device matter cache and queue are wiped, and the corresponding backend records are deleted. This satisfies the requirement to delete stored Clio data when authorization ends.

• Server-side billing note. When you approve an entry for sync, its billing note is held in the backend queue only until the entry is successfully written to Clio; on success the note is cleared from the backend record.

• Other backend records. Connection and queue records persist while your Clio connection is active and are deleted on de-authorization (see above). Deleted records may persist in the database provider's encrypted managed backups until those backups age out on the provider's standard retention cycle, after which they are purged.

5. Sub-processors

Lorla uses the following third-party service providers ("sub-processors"). We disclose each, the capacity in which it is used, and its processing region.

Important: Deepgram and Anthropic apply only to the optional voice-transcription and AI-narrative features. Those features are turned off at initial launch and are gated behind signed business-associate agreements with each provider. Until those agreements are in place and the features are enabled, no audio is sent to Deepgram and no content is sent to Anthropic. Before we enable these features, we will update this Policy, confirm the processing regions above, and disclose the data flows.

Clio's own hosting of your Clio Manage data (CA region) is governed by your agreement with Clio, not by this Policy.

6. Where your data is processed

Your Clio Manage data is hosted by Clio in its CA (Canada) hosting region under your own agreement with Clio. The Lorla backend (sync queue and backend records) is hosted on Railway in the US West (California, United States) region, and the encrypted Clio OAuth tokens are stored with Supabase in the United States; the limited Clio-derived data Lorla holds server-side is therefore processed in the United States. If voice/AI features are later enabled, Deepgram and Anthropic processing regions will be confirmed and disclosed before activation.

If you are located in the EU/EEA, the UK, Canada, or Australia, your personal data is transferred to and processed in the United States. We explain the legal basis for that transfer, and the rights available to you, in Section 8A ("Your rights by region").

7. How we use data

We use the data above solely to provide the App: to let you browse and select matters offline, to capture and queue time entries, to sync approved entries to Clio, and to surface sync status and errors. We do not sell your data, we do not use the content of your matter data or time entries for advertising, and we do not collect de-identified or aggregated usage data for product analytics (Lorla ships no analytics SDK at launch).

8. Your choices and rights

• You can disconnect Lorla from Clio at any time, which triggers the deletion described in Section 4.
• You can sign out, which wipes the on-device store.
• To request access to, correction of, or deletion of the data we hold about you, email security@cyberaktive.com (or liam@cyberaktive.com) with "Data Request" in the subject line. We will acknowledge your request and respond within 30 days. Based on its current size and the fact that it does not sell or share personal information, Lorla is not presently a "business" subject to the California Consumer Privacy Act (CCPA/CPRA) or to comparable US state privacy laws, so no statute-specific consumer-rights notice applies. We nonetheless honor access, correction, and deletion requests as a matter of practice, and we will reassess this position if our revenue or data practices change.
• If you are in the EU/EEA, the United Kingdom, Canada, or Australia, see Section 8A for the rights specific to your region (including, where applicable, erasure, portability, objection, and the right to complain to your supervisory authority).

8A. Your rights by region (EU/EEA, UK, Canada, Australia)

Lorla is distributed through the Apple App Store globally. If you are located outside the United States, additional data-protection laws may apply to your use of Lorla. This section describes the rights and disclosures that apply by region. Where a regional law gives you a right that exceeds what we describe elsewhere in this Policy, the regional law controls for users in that region.

For any request under this section, email security@cyberaktive.com (or liam@cyberaktive.com) with the relevant law named in the subject line (for example, "GDPR request"). We will verify your identity, acknowledge your request, and respond within the timeframe required by your law (within one month under the EU/UK GDPR; within 30 days under Canada PIPEDA).

Controller and contact

For data-protection purposes, the controller of the limited personal data Lorla holds is GrowthX Group LLC dba Cyberaktive, 36 Shadow Brook Ln, Lander, WY 82520, United States, liam@cyberaktive.com. Lorla also acts on your behalf as a tool you direct toward your own Clio account; your firm and Clio have their own roles in respect of your clients' data.

a. EU/EEA and United Kingdom (GDPR and UK GDPR)

Lawful bases. We process your personal data on these lawful bases under Article 6 of the GDPR / UK GDPR:

• Performance of a contract (Art. 6(1)(b)) - to provide the App you have subscribed to: caching matters, queuing time entries, and syncing approved entries to Clio.
• Legitimate interests (Art. 6(1)(f)) - to operate, secure, and debug the service (for example, operational logs and abuse protection), balanced against your rights. You may object to processing based on legitimate interests (see below).
• Consent (Art. 6(1)(a)) - only if and when you turn on the optional, BAA-gated voice/AI features (off at launch); you can withdraw consent at any time.

We do not carry out solely automated decision-making producing legal or similarly significant effects about you, and we do not use your data for advertising.

Your rights. Under the GDPR and UK GDPR you have the right to: access your data (Art. 15); rectification (Art. 16); erasure / "right to be forgotten" (Art. 17); restriction of processing (Art. 18); data portability (Art. 20); and to object to processing based on legitimate interests (Art. 21). Where processing relies on consent, you may withdraw it at any time. You will not be discriminated against for exercising these rights. You also have the right to lodge a complaint with your supervisory authority - in the UK, the Information Commissioner's Office (ico.org.uk); in the EU/EEA, your national data protection authority.

International transfers. Your data is transferred to the United States, which the EU and UK do not treat as automatically "adequate." We rely on appropriate safeguards under Chapter V of the GDPR / UK GDPR - the European Commission's Standard Contractual Clauses (SCCs) for EU/EEA transfers and the UK International Data Transfer Addendum (or IDTA) for UK transfers - with our US sub-processors, together with the on-device encryption described in this Policy as a supplementary measure. Where a US sub-processor is certified under the EU-US Data Privacy Framework (and its UK extension), that certification may also support the transfer. You may request a copy of the relevant safeguard by contacting us.

EU/UK representative and DPO. Article 27 of the GDPR / UK GDPR can require a non-EU/non-UK controller that offers goods or services to people in the EU/UK to appoint a local representative, unless the processing is occasional, low-risk, and does not involve large-scale special-category data. Article 37 can require a Data Protection Officer (DPO) only where core activities involve large-scale regular and systematic monitoring, or large-scale processing of special-category data.

b. Canada (PIPEDA)

PIPEDA applies to personal information handled in the course of commercial activity. Under PIPEDA you have the right to: access the personal information we hold about you and be told how it is used and disclosed; request correction of inaccurate or incomplete information; and withdraw your consent (subject to legal or contractual limits), which for Lorla means disconnecting from Clio and signing out, triggering the deletion described in Section 4. We respond to access requests within 30 days. We rely on your consent (express or, where appropriate, implied through your continued use after this notice) to collect, use, and disclose your personal information for the purposes described here. Because Lorla transfers personal information to the United States for processing, that information may be accessible to US authorities under US law. You may complain to the Office of the Privacy Commissioner of Canada (priv.gc.ca).

c. Australia (Privacy Act 1988 / Australian Privacy Principles)

Lorla is below the AUD $3 million annual-turnover threshold and is therefore, at launch, within the small-business exemption from the Australian Privacy Act 1988. As a matter of practice, and in anticipation of those reforms, we honor the core Australian Privacy Principles: we tell you what we collect and why (this Policy), limit collection to what we need, and let you request access to and correction of your information at security@cyberaktive.com. Under APP 8, we disclose that your personal information is processed by overseas recipients in the United States (our hosting and token-storage sub-processors). You may raise a privacy concern with the Office of the Australian Information Commissioner (oaic.gov.au).

d. Other regions

If you are elsewhere and a local data-protection law gives you access, correction, deletion, or portability rights, contact us and we will honor reasonable requests consistent with that law.

8B. Cookies and the marketing website

This Policy covers the Lorla iOS app, which ships no analytics SDK and sets no cookies at launch. Our separate marketing website is expected to use cookie-based analytics (Google Analytics 4 and Plerdy). When those are added, the website will carry its own cookie policy and a consent banner governing analytics/marketing cookies (including consent where required for EU/EEA and UK visitors). That cookie policy is a separate document from this Policy.

9. Confidentiality posture for attorneys

We recognize that the data you handle may be subject to attorney-client privilege and to your duty of confidentiality under applicable rules of professional conduct (including ABA Model Rule 1.6 and your state equivalents). Lorla's design - on-device encryption of privileged fields, a device-held key that never leaves the device, minimal caching, a 30-day cache TTL, and deletion on de-authorization - is intended to support, not replace, your own confidentiality obligations. This Policy does not constitute legal advice on those obligations.

10. Children

Lorla is a professional tool not directed to anyone under 18, and we do not knowingly collect data from children.

11. Changes to this Policy

We may update this Policy. Material changes will be communicated through the App or your account contact details, and the "Last updated" date above will change.

12. Contact

Privacy questions: Liam Barnes, GrowthX Group LLC dba Cyberaktive, 36 Shadow Brook Ln, Lander, WY 82520, United States, liam@cyberaktive.com.