Privacy Policy
Effective November 4, 2026
1. Who we are and what this covers
Kolophi is a business of Esketit LLC, an Illinois limited liability company ("Kolophi", "we", "us"). Kolophi is software, hosted by us for each customer, that reviews a law firm's or legal department's records against its retention schedule.
This policy covers personal information we handle about:
- Visitors to kolophi.ai.
- People who contact us, at contact@kolophi.ai or otherwise.
- Customers: the firms that subscribe to Kolophi, and the people who sign up or manage the account on a firm's behalf.
- Users: people a customer lets sign in to its Kolophi install.
For the documents and records a customer puts into Kolophi, the customer decides what is collected and why, and we handle them only to provide the service, under our data processing agreement. Section 3 explains how. The customer's own privacy notices, not this policy, govern how it handles its clients' and employees' information.
2. Information we collect
We collect only what we need to run the website, sell the service and let people sign in.
| Who | What we collect | Where it comes from |
|---|---|---|
| Website visitors | Pages viewed, referring site, country, browser and device type. Your IP address is used to deliver the page but isn't stored by our analytics. | Cloudflare, which hosts the site and counts visits without cookies |
| People who contact us | Your name, email address and what you write to us | You, by email |
| Customers | Firm name, the name and email address of the person who signs up, billing address, plan, and subscription and payment status. Card and bank details go to Stripe; we see only the card brand or bank name, the last four digits and the expiry. | You, at checkout through Stripe or on our invoice sign-up form |
| Users | Name, work email address, the Microsoft account you sign in with (including its organization and account IDs), your role, sign-in times, and a record of what you do in Kolophi | Your firm's administrator adds you; Microsoft confirms who you are when you sign in |
| Users who connect an AI app | The app's name and the times it was connected, plus each search and read it makes for you | The AI app, when you approve it |
We don't buy personal information, and we don't collect it from data brokers.
3. A firm's records in Kolophi
We handle a customer's records only on its behalf and on its instructions, to provide Kolophi. Those records can include documents, email, client and matter details, and the names and contact details of people in them, such as legal hold custodians and clients sent destruction notices.
- Where they're kept. Each customer has its own server and storage in Google Cloud, in the United States. No other customer's install can reach them.
- Read-only connections. Kolophi reads from the systems a customer connects, such as Microsoft 365 or iManage. It never changes or deletes anything there.
- AI processing. To classify, describe and screen records, Kolophi sends their text to Claude, an AI model made by Anthropic, through Google Cloud's Vertex AI. The text is sent unredacted, because screening for sensitive information requires reading it. Neither Google nor Anthropic uses it to train their models.
- Clients that forbid AI. A customer can mark a client "no AI". That client's records are never sent to any AI model; the customer's staff review them instead.
- No other use. We don't sell a customer's records, use them to train AI models, or use them for anything except providing the service.
- Our access. Kolophi staff access a customer's records only to provide support it asks for, to keep the service secure and running, or where the law requires.
4. How we use information
We use the information in section 2 to:
- set up, run and support a customer's Kolophi install, and let its users sign in;
- take payment, send invoices and manage subscriptions;
- send service messages, such as the welcome email, trial and billing notices, and security alerts;
- answer questions people send us;
- keep the service secure and find misuse;
- count website visits, in total, to see which pages are useful;
- meet legal, tax and accounting obligations, and enforce our terms.
We may email people at law firms about Kolophi where their work makes it relevant, and every such message says how to stop. We don't sell or rent personal information, and we don't use it for targeted advertising.
Where a law such as the EU or UK GDPR asks for a legal basis, ours are: performing our contract with the customer; our legitimate interests in running a secure, reliable service, answering enquiries and telling law firms about Kolophi; meeting legal obligations; and consent, where we ask for it.
5. Who we share it with
We share personal information only with the service providers listed on our subprocessors page, and only what each needs to do its job for us. Each is bound by its terms with us to protect it.
We may also disclose information when the law requires it, such as a valid subpoena or court order, or to protect someone's safety. Where the law allows, we'll tell the affected customer first so it can object. If Esketit LLC or Kolophi is sold or merged, information may pass to the new owner, which must keep honoring this policy.
6. Cookies and analytics
kolophi.ai sets no cookies. Cloudflare Web Analytics counts visits without cookies or tracking across sites.
Kolophi itself uses only the cookies it needs to work: one that keeps you signed in, and one that protects the sign-in step while it's in progress. Neither is used for analytics or advertising. Stripe's checkout pages set their own cookies to process payment and prevent fraud, under Stripe's privacy policy.
7. How long we keep it
| Information | How long |
|---|---|
| A customer's records in Kolophi | Until the customer leaves. When its subscription ends at its request, we destroy its install and every copy we hold at once, including backups, confirm with each provider that each item is gone, and send the customer a signed certificate of destruction. |
| Daily backups of an install | 30 days each, on a rolling basis, while the subscription lasts. Destroyed with the install. |
| An install whose payment failed | Kept, with its server stopped, for 30 days so the customer can pay. Then destroyed and certified as above. |
| Kolophi's audit log | As long as the install exists. It names the people who acted, and it can't be edited, because it's the customer's evidence of what happened to its records. |
| User accounts | Until the customer removes the user, or the install is destroyed |
| Records of what we destroyed, and the certificates | Permanently, as evidence. They name resources and the customer, never anything from its records. |
| Billing and tax records | 7 years, as tax law requires |
| Emails with us | As long as needed to deal with the matter, then up to 3 years |
| Invoice sign-ups never confirmed | Deleted after 30 days |
| Website visit counts | Totals only, kept by Cloudflare under its own terms |
Kolophi exists to apply a firm's retention schedule, so what happens to records inside an install, including their destruction, is the customer's decision under its own policies.
8. Security
Our security overview describes how we protect information. No system is perfectly secure. If a breach affects a customer's information, we'll tell the customer within 72 hours of confirming it, and within any shorter time the law requires, so it can meet its own obligations.
9. Your rights
Depending on where you live, you may have the right to know what personal information we hold about you, get a copy, correct it, delete it, or object to how we use it. California residents also have the right not to be discriminated against for using these rights. We don't sell or share personal information for cross-context advertising, so there's nothing to opt out of.
To use any of these rights, email contact@kolophi.ai. We'll confirm who you are, then answer within 30 days, or sooner where the law requires.
If your information is in a customer's records in Kolophi, such as a document that names you, that customer decides what happens to it. We'll pass your request to the customer and help it respond.
Children. Kolophi is a service for businesses. We don't knowingly collect information from anyone under 16 except as part of a customer's records.
Where information is kept. We store and process information in the United States. If you're elsewhere, your information is transferred there, with the protections the law requires for such transfers.
10. Changes and contact
We'll post any change to this policy here with a new date. For a material change, we'll email customers' administrators at least 30 days before it takes effect.
This policy is governed by the laws of Illinois and of the United States.
Questions or requests: contact@kolophi.ai, or Esketit LLC, Chicago, Illinois.