Welcome to Story LLP

Story LLP is a brand collaboration between California Limited Liability Partnership and law firm Story LLP ("Story Firm") as well as Story LLP Software Inc, a Delaware corporation ("Story Software," and collectively with Story Firm, "Story"). The collaboration is operated pursuant to an exclusive license and collaboration agreement between these entities, which is designed to facilitate certain elements of the Story LLP Law Firm's practice of legal services for individual and entity clients through automated tools built by Story Software on its behalf that ensure and protect client confidentiality and privilege. The entities are under the common control of a licensed attorney as of the date of this Policy. When we use "Story," "we," "us," and/or "our" in this policy, we mean Story Software and Story Firm working in collaboration with one another.

You may send information to Story through the Services or via email, and in each case, we will process such information using certain automated means described below. When you submit information through the Services for the purposes of obtaining legal advice, all such information is handled by Story Software solely on behalf of Story Firm, in accordance with all applicable legal ethics rules. This includes, for example, that all information submitted when seeking legal advice is treated as privileged and confidential by default. However, we cannot guarantee that our treatment of information as privileged and confidential will mean a court will always consider that information privileged and confidential.

In this Policy, the capitalized terms "User," "Visitor," and "Client" have the same meaning set forth in our Terms.

Story strives to earn your trust and fervently protect your privacy. Please carefully read the full Privacy Policy below, together with our Terms of Service, to fully understand our data handling practices and your rights and obligations when using the Site and Services. We want to summarize a few key points up front:

• Confidentiality: Story's Services may be used when seeking legal advice, and any correspondence which seeks legal advice will be treated as attorney-client privileged and fully confidential to the maximum extent possible. However, we cannot guarantee that a court will consider any information submitted to the Services to be privileged and confidential. You should always remember that you, as a client, can waive this privilege if you share the underlying information or any response from Story with non-lawyers or the public.
• Information Security: Information you share with Story is kept confidential and shared only with infrastructure providers who offer a confidentiality promise and critical security protections, and only to the extent necessary for our software infrastructure to operate. To the extent Story Software manages your privileged and confidential information, it does so only on behalf of the Story Firm.
• No Sale of Personal Information: Story will NEVER sell your personal information or exchange it with a third party for anything of value.
• Service Provision: Story will use your information to provide Services to you and to improve those Services, including when you opt into an introduction to the right lawyer from our Attorney Alliance or begin a new legal matter with an Attorney Ally. In such cases, your information is shared with Story's Attorney Allies under cover of privilege to help you seek other legal services.
• Trust and Control: Story is built for trust. You can update your information on, or terminate your information from our datastores by emailing us anytime. We retain only identifiable information and legal records our Firm is required to retain by law.
• Analytics and Browser Storage: We use Amplitude to measure use of the Services. It receives usage events, device/browser identifiers, page and referral information, campaign parameters, and a pseudonymous account identifier and account-related identifiers when you sign in. We do not use screen recording. We collect only selected interaction events and do not intentionally collect any data identifiable to a particular user account other than the usages statistics described in this paragraph. We do not intentionally send names, email addresses, document contents, or payment-card information as analytics properties.
• Activity Logs: Story generates logs from usage activity on the Services for maintenance, security, and improvement purposes. These logs are automatically redacted and anonymized to protect attorney-client privilege and confidentiality before they are stored.
• Contact Us: You can reach us at help@storyllp.com with questions about your privacy or our terms, to update the personal information you've previously submitted to us, or to request the removal of your information from our systems.

This Privacy Policy covers your use of the Services. It also describes the choices available to you regarding our use of your personal information. By using the Site or Service you consent to the data handling practices described here.

We use the term "Personal Information" broadly to mean any information that can be linked to an "identifiable natural person" (or "Data Subject"), including metadata and information such as browsing history, interaction with online ads, and inferences derived from other data. Personal Information can be factual (such as a name, address, date of birth, email address, IP address, telephone number, or username), as well as an inference, a preference, or an opinion. In addition, even trivial information (e.g., hair color) may be Personal Information if it can be linked to some identifier (e.g., an individual's name). Personal Information also includes device ID, location data, and other data collected/stored via cookies from Stripe or our authentication system.

In the Policy, we specify the particular types of Personal Information we collect, use, and share as a part of our Services.

Story collects data from individual users and from the companies they represent, where applicable, as follows.

From the Site:

When you contact us through the Site to receive a free consultation and/or story analysis, you may submit your name, email, company name (if applicable), certain other details about yourself or the company you need help with on an opt-in basis, and a narrative summary of your story and legal needs ("Matter Info") without creating any account with us. If you choose to contact us through our Site contact form, we collect the inputs you make into our contact form ("Contact Form Info") and use them to reply to and engage with you. This might include information about a company you represent but doesn't have to.

The Site uses Amplitude analytics and browser storage to measure sessions, page visits, selected interactions, downloads, referral sources, and campaign attribution. We also use strictly necessary authentication and payment-related cookies. We do not use this information to contact Site users if they choose to leave the Site without voluntarily sharing Personal Information.

From the App and Services

When you subscribe to use our App, you gain access to certain additional Services through the App and through email. Email-based services are accessed through a unique inbox made available to subscribers (the "GC Inbox"). When you use these parts of the Services, we may collect:

• Authentication Info through our third-party authentication provider, such as your name, email address, and a session ID.
• Profile Info through our onboarding flow and dashboard, such as your name, a primary contact email, the name and title of the company's stakeholders, company address and share ownership, the number of employees, etc. Profile Information may include both Personal Information about an account owner as an individual and individuals related to a company.
• Legal File Info through our GC inbox, the App, via an Attorney Ally, or through another means you use to upload or send documents or other legal materials to us. This includes your legal documents, drafts, attorney work product, and any Personal Information contained in such materials.
• Client Matter Info through specific forms within the app, which allow you to either request custom legal work or automated legal processes designed and supervised by our lawyers.
• Usage Info generated automatically through your use of the Services, such as information about the timing of your sessions, about your progress through the app, about the forms you submitted, about the browser you were using, etc.

Other than Usage Information, Story does not collect information through the Site or App that you do not affirmatively submit unless you become a Client and subscribe to Aegis, in which case we may request or ascertain information about your legal history, preferences, trends, norms, and other similar descriptive data about your use of legal services overall through your use of the Services (collectively, "Inferences").

Story uses Usage Information to understand individuals’ interaction with our Services, and to improve and maintain those Services.

Activity Logs: In the course of providing the Services, Story generates logs derived from your usage activity within the App ("Activity Logs"). Activity Logs may include information such as the type of action performed, the timing of requests, and technical metadata about your session. Before Activity Logs are stored, Story automatically redacts and anonymizes any content that could contain privileged, confidential, or personally identifiable information — including document content, draft text, comments, notes, passwords, and authentication tokens. This redaction is applied programmatically and by design so that Activity Logs cannot be used to reconstruct or access your privileged or confidential information. Story uses Activity Logs solely for the purposes of maintaining, securing, troubleshooting, and improving the Services.

We use other information differently depending on what type(s) of relationship we have with you:

For Visitors:

We use your Contact Form Info to reply to your contact request and otherwise deliver Services to you as you request. If you submit details in a contact form message, we may use them to analyze your matter(s), develop questions to help further analyze your matter in conversation with you, and provide you with information about what legal service you need and how much it is likely to cost, as well as free tips on how to manage your legal needs efficiently.

If you so request, we will also use your Matter Info or Contact Form Info to explore potential engagements with our Attorney Allies (attorneys whose quality we trust that provide specialist legal services which Story LLP does not directly provide). We may share your Contact Form Info or Matter Info with Attorney Allies, with your consent, to allow them to evaluate a potential legal engagement with you, including to check for conflicts of interest with their other clients. Note that Attorney Allies have established co-counsel relationships with the Story Firm except where we specifically identify a matter as one for which we are recruiting an appropriate attorney ally. For any outreach which seeks legal assistance for you, we clear conflicts prior to exposing Matter Info, and all communications are attorney-client privileged.

We may analyze all or a large number of users’ Contact Form Info or Matter Info, in aggregate, de-identified form, to improve our Services and develop new features and services to better help you find the right lawyer at the right price.

For Users:

We use your Authentication Info to create and manage your account and to verify your identity and account status when you seek to use the Services.

We may also use your Authentication Info to troubleshoot your account or allow our support team to help you gain access.

For Users who never choose to execute an Engagement Letter Agreement and become a Client or subscriber, we may store Profile Information and onboarding or subscription-choice answers in our systems, as well as temporary browser storage, to preserve the decisions you have already made and save you from having to re-enter information as you continue onboarding. You can ask us to remove your Personal Information as described below.

For Clients:

You become a Client by signing the Engagement Letter Agreement, either through the App or separately (provided you would cease to be a Client if that Agreement were terminated).

As a Client, in addition to the above, we use Profile Info, Client Matter Info, Legal File Info, Contributions, and Inferences to operate the Services as well as to improve, maintain, and deliver the Services to you. Here are a few examples of how we do so in the context of providing the specific service of a stock option grant to a subscriber:

• Inputting the names of Directors for your company you submitted as Profile Information onto a draft board consent for a stock option issuance.
• Confirming the number of shares authorized for issuance under your Stock Plan in your Legal File Info before drafting an Option Agreement for a new issuance.
• Notifying you via Authentication Info, Legal File Info, and/or Profile Info if you don't have enough shares available to make the proposed option grant, which notification may be in your user dashboard, your email, or both.

Finally, for all the types of information we collect, we use it internally to continuously work to plan and provide better services and democratize access to legal services and information. As a part of this mission, we may generate aggregate, anonymous statistics about the legal services industry, such as the average cost of a particular type of matter. We may offer such information, which does not contain any personal information about an identifiable individual, to help our Clients, subscribers, or the public make better-informed decisions about their legal needs and strategy.

We do not sell Personal Information obtained through the use of the Services.

We do not share Personal Information other than as directly described in this Policy.

The three main ways that Story shares Personal Information and Matter Info are:

1. With Attorney Allies and our own lawyers, following your request and consent, to help us explore and identify the right legal service provider to help you with Custom human legal services.
2. With infrastructure providers, such as Google mail clients and Workspace API or datastores, such as AWS, which offer us a promise to keep your information confidential and secure. We use Cloudflare Turnstile to help verify that requests are made by people rather than automated systems; real-time websocket infrastructure, including Laravel Reverb or Pusher, to deliver real-time Service updates; and Slack only when you choose to connect your Slack workspace to the Services. Additionally, when you sign up for our Services, we may obtain a logo for your organization from logo.dev by sending the domain name of your email address to logo.dev to retrieve a logo associated with that domain.
3. With employees and contractors for the purpose of developing, improving, maintaining, and securing our systems, products, and Services. We ensure that any such individuals are bound by contractual commitments to keep information confidential and secure, and also limit their access to our systems to that access which is necessary to perform their particular job or consulting objective.

In specific cases, we may also share Personal Information:

1. In response to a subpoena, court order, or other governmental action or requirement of applicable law to the extent we are unable to rely on attorney-client privilege to keep it confidential.
2. In connection with a potential investment or business acquisition, in which case any sharing would also be subject to written confidentiality restrictions.
3. Upon your request or with your express consent, for Personal Information which relates to you or a company you own.

Finally, for all the types of information we collect, we use it internally to continuously work to plan and provide better services and democratize access to legal services and information. As a part of this mission, we may generate aggregate, anonymous statistics about the legal services industry, such as the average cost of a particular type of matter. We may offer such information, which does not contain any personal information about an identifiable individual, to help our Clients, subscribers, or the public make better-informed decisions about their legal needs and strategy.

Our first step to securing your data is storing only what's relevant and useful to provide Services to you. For example, when you use our free public software, we only share data you specifically input and choose to send to us.

Information we send to our server from the Site is secured with basic AES-256 encryption.

Information in the App is encrypted with industry-standard or better protocols such that it's available only to you when authenticated with an appropriately-permissioned account.

All of our servers are subject to encryption at rest and all data transmissions to and from our servers are encrypted in transit as well. Our vendors are uniformly subject to confidentiality restrictions that prohibit their exposure of your data or any behavior which uses Personal Information for a purpose other than providing the specific service they have contracted to provide for us.

While we strive to have excellent data security, no transmission over the internet can be guaranteed to be secure. Please refer to our Terms of Service to understand the limitations on what security we or any other internet-based provider can offer.

We use Amplitude to measure use of the Services. It receives usage events, device/browser identifiers, page and referral information, campaign parameters, and a pseudonymous account identifier and account-related identifiers when you sign in. We do not use screen recording. We collect only selected interaction events and do not intentionally collect any data identifiable to a particular user account other than the usages statistics described in this paragraph. We do not intentionally send names, email addresses, document contents, or payment-card information as analytics properties.

Story uses browser storage and cookies for analytics, session management, active organization selection, maintenance-mode access, and payment processing. Authentication cookies recognize you when you are logged in and maintain your authenticated session. Stripe, our payment processor, uses cookies for fraud prevention when making a payment and to assess the risk associated with an attempted transaction.

You can avoid the Laravel authentication cookies by never creating an account, and clear browser storage and cookies through your browser settings. Some storage or cookies will reappear if you log in again to Story or use Stripe in connection with any web application.

The App may send diagnostic and error information, including technical metadata and error stacks, to Story's servers to help us maintain, secure, and troubleshoot the Services. We do not intentionally include document contents, payment-card information, or other sensitive information in this telemetry.

You can also reach us at help@storyllp.com anytime to:

• Request the removal of your Personal Information from our records. Please note that certain legal files may be required to be maintained by our law firm for a period of time and we will comply with all such requirements. In addition, past emails cannot be deleted from email services if they contain your Personal Information.
• Update and/or modify your Personal Information, Matter Info or Legal File Info.
• Ask questions about how we protect your privacy and secure your information, and/or about this policy and our Terms.
• Let us know if you suspect someone else has been impersonating you in communications with Story.
• Raise any other concerns whatsoever about your privacy and security.

Story LLP believes that you should have clear, comprehensible notice of any changes to our privacy practices following your submission of any personal information to us. For this reason, if we plan to make material changes to this Policy, we will email all of our users and offer them the opportunity to opt-out of the updated privacy practices and remove all of their information from our systems before the update takes effect and/or present an in-Service opportunity to review the new Policy.