Privacy Policy

This Privacy Policy applies to the dashboardWISE website, dashboardWISE application and related account, onboarding, billing, integration, analytics, security, sales and support activities. It applies when we act as a controller of personal data.

It does not govern a law firm’s own privacy practices or an external service that a customer chooses to connect to dashboardWISE. Those organisations provide their own notices. Our Data Processing Addendum governs personal data that we process on a customer’s behalf.

dashboardWISE LLC is a controller when we decide why and how to process website visitor, prospect, account, billing, security, service administration and business relationship data.

When a law firm or other customer connects a practice management system or submits information for dashboardWISE to analyse on its instructions, that customer is normally the controller and dashboardWISE LLC is its processor or service provider. The customer determines the purposes and lawful basis for that processing and is responsible for its instructions, notices, permissions, professional duties and responses to individuals.

A particular activity can involve both roles. For example, we process synchronized matter data for the customer, while independently using limited account and security records to authenticate users and protect the service.

• Account and organisation data: names, work email addresses, firm name, country, business contact details, roles, permissions and account preferences.
• Authentication and security data: sessions, IP address, device and browser information, verification records, two factor authentication settings, access events and suspected misuse.
• Customer Data: information selected by a customer from a connected practice management system, which may include clients, contacts, matters, practice areas, staff, activities, time entries, expenses, invoices, payments, allocations and trust transactions.
• Integration and operational data: connected account identifiers, permissions, sync status and history, errors, request metadata, audit records and encrypted access credentials.
• Billing data: plan, subscription status, transaction references and limited billing details supplied by our billing provider. dashboardWISE does not store complete payment card numbers in its application database.
• Usage and diagnostics: page navigation, feature events, account and firm identifiers, device information, performance information and service logs.
• Communications: enquiries, sales, onboarding, support and other correspondence, including any information you choose to provide in them.

Customer Data can contain confidential information, special category data, information about criminal allegations or proceedings, financial data, or information about children because customers decide what is stored in their systems. dashboardWISE does not require those categories for ordinary account administration or product analytics.

We receive personal data:

• directly from you when you visit, register or contact us;
• from administrators and authorised users at your organisation;
• from customer-selected services such as Clio Manage and Smokeball;
• automatically from browsers, devices, integrations and systems that interact with the service;
• from billing, scheduling, communications, security and analytics providers.

If we receive your information from a customer, the categories and source depend on the records that customer chooses to connect or submit.

Where the EU GDPR or UK GDPR applies to processing for which we are a controller, we rely on the following purposes and lawful bases:

• Contract: creating and administering accounts, delivering requested services, processing subscriptions, providing support and communicating about service operation.
• Legal obligations: maintaining records required by tax, accounting and company law, responding to valid legal process and meeting applicable regulatory obligations.
• Legitimate interests: securing and improving the service, preventing fraud and misuse, diagnosing failures, maintaining reliable operations, managing business relationships, understanding service performance and establishing, exercising or defending legal claims. We consider the necessity and effect on individuals before relying on these interests.
• Consent: using non-essential browser analytics or sending marketing communications where consent is required. You can withdraw consent prospectively at any time.

If information is required to create or secure an account, complete a transaction or meet a legal requirement, failure to provide it may prevent us from supplying the relevant service. We do not use dashboardWISE reports to make solely automated decisions about individuals that produce legal or similarly significant effects.

We process Customer Data only to provide, secure and support the service, comply with the customer’s documented instructions, or meet an applicable legal requirement. The customer chooses the connected source, authorised users, reporting configuration and records made available to dashboardWISE.

Individuals whose information appears in Customer Data should usually contact the relevant law firm or customer. We will assist that customer with a valid request as required by our contract and applicable law.

We may disclose personal data to:

• authorised users and administrators of the organisation responsible for the relevant account or Customer Data;
• infrastructure, database, storage, communications, diagnostics, analytics, billing and scheduling providers used to operate the service, as described on our Subprocessors page
• customer-selected integrations at the customer’s direction;
• professional advisers, auditors, insurers or financing parties when engaged and subject to appropriate duties;
• courts, regulators, law enforcement or other authorities where disclosure is required or permitted by law; and
• a prospective or actual acquirer, investor or successor in a corporate transaction, subject to appropriate confidentiality and use restrictions.

We do not currently sell personal data or share it for cross-context behavioural advertising or targeted advertising as those terms are defined by applicable United States privacy laws. We do not use Customer Data for third-party advertising.

Customer Data is hosted in the customer’s assigned regional service cell: AWS us-west-1 (Oregon) for the United States service or AWS eu-west-2 (London) for the United Kingdom service. Authorised dashboardWISE personnel may access personal data from Pakistan for service operation, support and security. Other providers may process data in the locations identified on our Subprocessors page.

These activities can involve transferring personal data outside the United Kingdom, European Economic Area or another place with transfer restrictions. Where applicable, the transfer must be addressed through a legally recognised mechanism, which may include an adequacy decision, the European Commission’s Standard Contractual Clauses, the UK International Data Transfer Addendum or International Data Transfer Agreement, together with supplementary measures where required. The applicable mechanism depends on the parties, roles and transfer route.

Contact us to request available information about the safeguards relevant to your data. Our Data Processing Addendum addresses transfers of Customer Data.

We retain personal data only for as long as reasonably necessary for the purpose for which it was collected, including providing and securing the service, maintaining required business and financial records, resolving disputes and enforcing agreements. We consider the amount, sensitivity and nature of the data; security risk; customer instructions; technical lifecycle; and applicable legal requirements.

• Account and Customer Data are generally kept while the service or relevant account is active and during an appropriate offboarding period.
• Operational sync records covered by the product retention process are normally retained for up to 90 days.
• Billing, tax, security, support and legal records are retained for the period reasonably required by their purpose and applicable law.
• Browser analytics and preference storage follow the periods described in our Cookie Policy.

Disconnecting an integration queues removal of the related connection, credentials and synchronised records. Deleted information may remain temporarily in access-restricted backups until the relevant backup expires, or longer where preservation is required by law.

Subject to applicable law and exemptions, individuals in the European Economic Area and United Kingdom may request access to, correction or erasure of personal data; restriction of processing; data portability; or object to processing based on legitimate interests or direct marketing. You may withdraw consent at any time without affecting processing that occurred before withdrawal. You may also complain to the supervisory authority where you live or work, or where you believe an infringement occurred.

If dashboardWISE controls the information, contact us using the details below. We may need to verify identity and clarify the request. If we process the information for a customer, contact that customer first; we will support its response. Exercising a right will not result in unlawful discrimination.

Depending on your state, relationship with us and applicable exemptions, you may have rights to confirm processing; access, correct or delete personal data; obtain a portable copy; opt out of certain sales, sharing, targeted advertising or profiling; or limit certain uses of sensitive personal data. You may also have the right to appeal a refusal of your request.

Submit a request or appeal by emailing support@dashboardwise.com with enough detail for us to understand it. An authorised agent may submit a request where state law permits; we may ask for evidence of authority and may verify the request directly with you. We will treat legally recognised browser-based opt-out preference signals, including Global Privacy Control, as required by applicable law. Because we do not currently sell personal data or use it for targeted advertising, such a signal does not change those practices or grant consent for analytics.

We use cookies and local storage for authentication, security, preferences and requested functionality. The public website uses Google Analytics 4, and the authenticated application uses PostHog for product analytics. Neither browser analytics service is initialised until analytics permission has been recorded. Rejecting analytics does not prevent necessary storage or server-side operational records used to deliver and secure the service. See our Cookie Policy for the current inventory and controls.

dashboardWISE accounts and the service are intended for business users who are at least 18 years old. We do not knowingly collect personal data directly from children to create accounts or market the service to them. Customer Data may contain information about children where a law firm lawfully holds that information; in that context we process it only for the customer as described above.

We use technical and organisational measures designed to protect personal data, including access controls, encrypted transport, encrypted storage, isolated database networking, encrypted integration credentials, monitoring and protected backups. Access from Pakistan or any other location is limited to authorised personnel for legitimate operational purposes. No service can guarantee absolute security. See our Security page for more information.

We may update this Privacy Policy as our service, providers or legal obligations change. We will publish the revised policy and its updated date. Where required by law, we will provide additional notice or seek consent before a material change takes effect.

Contact dashboardWISE LLC about this policy, a privacy request or a complaint at support@dashboardwise.com, or write to dashboardWISE LLC, 8 The Green STE A, Dover, Kent County, DE 19901, United States.

dashboardWISE is established in the United States and does not claim to have an establishment in the European Economic Area or United Kingdom. If we appoint a representative under Article 27 of the EU or UK GDPR, we will publish its contact details here. Until then, direct enquiries to the contact above.

If UK data protection law applies, you may complain to the UK Information Commissioner’s Office. If EU data protection law applies, you may complain to the supervisory authority in the relevant EEA country. We would appreciate the opportunity to address your concern first. Where UK law requires it, we will provide an electronic complaint route, acknowledge a complaint within 30 days and respond without undue delay.