1. Scope and Roles

This Privacy Policy explains how Intaker Inc., a Delaware corporation with a mailing address at 8549 Wilshire Blvd #5018, Beverly Hills, CA 90211 ("Intaker," "we," "us," or "our"), collects, uses, discloses, and protects personal information in connection with our websites, dashboards, mobile applications, browser extensions, including the Intaker for case management Chrome Extension (the "Chrome Extension"), embedded chatbots and widgets, portals, integrations, support channels, Customer-configured workflows, and related services (the "Services").

This policy applies to information we collect directly from or about Customers, Customer Personnel, Intaker Users, prospects, business contacts, and visitors to Intaker-controlled properties. It also applies to Customer Data and End User data that we process through the Services on behalf of a Customer.

For Intaker-controlled data, we generally act as the controller or business. For Customer Data and End User data processed through a Customer account, website, widget, portal, communication channel, payment flow, mobile app workflow, advertising or attribution workflow, conversion-posting workflow, or integration, the relevant Customer generally controls the purposes and means of processing, and Intaker generally acts as the Customer's processor, service provider, or solution provider.

The Intaker mobile app is intended for authorized Customer Personnel. The app does not allow users to create an Intaker account in the app and does not direct users to an external app-account creation flow. Customer administrators or Intaker create and manage Intaker User access for an Organization.

The Chrome Extension is intended for authorized Intaker Users and Customer Personnel. Section 22 applies specifically to Chrome Extension Data and controls if it conflicts with more general statements in this Privacy Policy.

If you are an End User, please contact the law firm, accounting firm, or other business that directed us to process your personal information. You may also contact Intaker at support@intaker.me, and we will intake the request and, where appropriate, coordinate with the relevant Customer. Customer privacy policies, intake disclosures, cookie banners, consent mechanisms, contracts, data processing agreements, professional obligations, and other notices may also apply.

2. Key Definitions

• Customer: A law firm, accounting firm, legal organization, or other business that purchases, subscribes to, or uses the Services.
• Organization: A Customer subscription or workspace purchased or managed by a business and used by one or more Intaker Users.
• Customer Personnel: A Customer's administrators, staff, contractors, agents, representatives, and other authorized users acting for the Customer.
• Intaker User: An authorized user added to an Organization by the Customer, a Customer administrator, or Intaker.
• Intaker App Account: The mobile app access associated with an Intaker User. The mobile app does not allow users to create Intaker App Accounts in the app or through an app-directed signup flow.
• Chrome Extension: Intaker for case management, the browser extension that lets authorized Intaker Users access Intaker in a side panel beside supported case management systems.
• Chrome Extension Data: information collected, accessed, transmitted, stored, used, or displayed by the Chrome Extension.
• End User: A person who interacts with the Services through a Customer, such as a website visitor, lead, prospective client, current client, caller, texter, email recipient, portal user, appointment requester, file uploader, payor, or other person using a Customer's Intaker-powered workflow.
• Customer Data: Lead, client, matter, communication, scheduling, payment, document, workflow, portal, campaign attribution, conversion event, and related information submitted to, synced with, collected through, or generated in the Services by or for a Customer, including personal information about End Users and Customer Personnel. Customer Data does not include publicly available or publicly visible information showing that a business uses Intaker, such as a public "Powered by Intaker" attribution or publicly visible Intaker-powered functionality, as long as that information does not include lead or client records, matter details, communications content, files, pricing, security information, non-public account data, or other confidential information.
• Personal Information: Information that identifies, relates to, describes, can reasonably be associated with, or could reasonably be linked to an individual or household, as defined by applicable law.

3. Customer Data Commitments

For Customer Data and End User data processed on behalf of Customers:

• We do not sell Customer Data or End User data.
• We do not use Customer Data or End User data for Intaker-owned cross-context advertising, retargeting, audience building, or advertising attribution.
• Customer-directed campaign measurement, attribution, optimization, and conversion posting are processed on behalf of the Customer and according to the Customer's configuration and instructions.
• We do not use Customer Data or End User data to train, develop, or improve foundation models or general AI models, and we do not permit foundation model providers to do so.
• We may use anonymized, de-identified, or aggregated information to analyze service performance, improve reliability, develop product improvements, and improve the Services.

4. Personal Information We Collect

We collect personal information from Customers, Customer Personnel, Intaker Users, End Users, Customer administrators, integrations selected by Customers, service providers, business partners, and automatically through the Services.

4.1 Customer, Account, and Business Contact Data

We collect account and profile details, authentication information, roles, employer information, account settings, billing contacts, invoices, subscription and transaction metadata, support messages, feedback, survey responses, demo requests, event and referral information, business development communications, Customer account configuration, connected channels, integration settings, permissions, and user activity associated with a Customer account. Full payment card data is processed by a payment processor and is not stored by Intaker in full.

4.2 Customer Data and End User Data

Depending on the Customer's configuration, features, workflows, integrations, advertising and attribution settings, and intake practices, Customer Data may include contact and identity details; portal or login information; intake, matter, case, claim, incident, family, immigration, insurance, financial, or other workflow information; communications content; audio, call, voicemail, recording, transcript, and summary data; notes, CRM entries, tags, statuses, tasks, reminders, and routing details; documents, photos, PDFs, forms, correspondence, and other files; scheduling and calendar information; payment and billing-related metadata; sensitive or regulated information submitted by Customers or End Users; campaign, attribution, analytics, and conversion measurement data; and AI-generated or system-generated outputs such as summaries, classifications, routing decisions, suggested notes, or recommended responses.

Customers are responsible for deciding whether their use of the Services for sensitive or regulated data is appropriate and lawful and for providing required notices, obtaining required consents, and complying with professional, advertising, call-recording, privacy, data protection, and other applicable obligations.

4.3 Mobile App Data, SDKs, and WebViews

The Intaker mobile app may collect, access, display, or process Intaker User, Customer, Organization, and Customer Data needed to provide the app experience. This may include user and Organization identifiers, name, email address, phone number, role, authentication events, permissions, account settings, app activity, screens or features used, timestamps, device and operating system information, app version, IP address, app instance identifiers, crash reports, diagnostics, performance data, error logs, push notification tokens, and Customer Data submitted, viewed, uploaded, attached, or otherwise processed through the app.

The mobile app currently uses Firebase SDKs, including Firebase Analytics, Firebase Crashlytics, Firebase Cloud Messaging, and Firebase Core. These SDKs may collect data directly from the app, including crash reports, device and app diagnostics, app instance identifiers, analytics events, screen or activity data, and push notification registration tokens. To support analytics, crash reporting, troubleshooting, notifications, account support, and service operations, we may set Firebase user identifiers or properties such as Customer or Organization identifiers and account contact details.

The mobile app may also use Tally through feedback WebViews and Smarty through address autocomplete features. Tally may receive feedback responses and prefilled account information when a feedback form is opened or submitted. Smarty may receive address autocomplete search queries. These providers process information on our behalf or as otherwise described in their applicable terms and privacy practices.

4.4 Automatic Collection, Cookies, and Tracking Technologies

We and our service providers may collect device, browser, app, cookie, local storage, log, analytics, attribution, referral, page, session, chat widget, click, interaction, IP address, and similar technical information. We use cookies and similar technologies to operate and secure the Services, remember settings, maintain sessions, support embedded widgets, analyze usage, improve performance, measure advertising and attribution, and support Customer-configured workflows.

You can manage cookies through browser settings and, where available, our cookie controls. Some settings may affect functionality. We honor Global Privacy Control and similar legally recognized opt-out signals where required by law. Because Do Not Track signals are not uniformly recognized, we generally do not respond to them unless required by law.

5. Mobile App Permissions and Settings

Our iOS and Android applications may request permissions needed to provide the app experience, depending on features used, device settings, and Customer configuration. These may include notifications, files or photos, storage, camera, microphone, contacts, calendar, location, SMS or call-related features, or biometric authentication. We do not request health-data permissions.

We use mobile permissions to let authorized users receive alerts, upload or attach files, capture or access content, manage communications, schedule or sync appointments, authenticate, and use enabled app features. You can manage device permissions through your device settings, manage available settings in the Intaker dashboard, or contact support@intaker.me. Some mobile features may not work if required permissions, integrations, or settings are disabled. Some app data collection, such as authentication, security, crash reporting, diagnostics, service logs, and core functionality data, is required to operate, secure, diagnose, and maintain the app and Services.

6. Integrations and API Data

Customers may connect or configure third-party services, such as communication channels, calendars, email, advertising, analytics, CRM, payment, document, business profile, messaging, transcription, AI, and workflow services. When a Customer enables an integration, Intaker may access, receive, store, transmit, or disclose information needed to provide that integration and related Services. Customers are responsible for the integrations they choose and for any required notices, consents, and authorizations.

If a Customer connects Google, Microsoft, or similar APIs, we use API data only to provide and support enabled features, security, troubleshooting, and compliance. We do not sell that data, use it for Intaker-owned advertising, or use it to train foundation models or general AI models. Our use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including Limited Use requirements, where applicable.

7. How We Use Personal Information

We use personal information to:

• Provide, operate, maintain, configure, secure, and support the Services, accounts, mobile app, widgets, portals, integrations, communications, payments, AI-assisted features, workflows, and Customer-configured automations.
• Authenticate users, manage Organizations, administer permissions, send notifications, troubleshoot issues, prevent fraud and abuse, monitor reliability, and enforce terms and security requirements.
• Process Customer Data and End User data according to Customer instructions, Customer configurations, contracts, applicable law, and our role as processor, service provider, or solution provider.
• Communicate with Customers, Customer Personnel, prospects, business contacts, and users; provide support; respond to requests; send service, transactional, product, and administrative messages; and manage billing.
• Analyze usage, measure performance, improve products, develop new features, conduct quality assurance, and create aggregated, de-identified, or anonymized insights.
• Conduct marketing, sales, advertising attribution, customer relationship management, and business development for Intaker-controlled data, subject to applicable law and choices. We may identify a business as an Intaker Customer to prospects or business contacts when that relationship is already publicly available or publicly visible, such as through a public "Powered by Intaker" attribution, but we do not disclose Customer Data or non-public Customer information for that purpose.
• Comply with law, legal process, regulatory obligations, professional obligations, accounting and tax obligations, dispute resolution, and corporate transactions.

8. AI-Assisted Features

Intaker offers AI-assisted features that may include AI Agents, summarization, translation, transcription, classification, extraction of intake fields, suggested notes, prioritization, assignment, routing, and related automation. These features may process personal information, Customer Data, and End User data to provide, evaluate, troubleshoot, monitor, secure, and support enabled Services and workflows. AI-assisted backend features may be accessible through the mobile app.

Data submitted, accessed, displayed, or processed through the mobile app or other Services may be processed by AI language processing, transcription, classification, routing, or related service providers acting on our behalf. We do not use Customer Data or End User data to train, develop, or improve foundation models or general AI models, and we do not permit foundation model providers to do so. Where internal product improvement goes beyond providing, operating, securing, troubleshooting, or supporting a Customer account or enabled feature, we use anonymized, de-identified, or aggregated information.

Authorized Intaker personnel may access or review user content for limited operational purposes, such as support, troubleshooting, security, abuse review, quality assurance on reported issues, legal compliance, payment processing, or at the Customer's direction. Customers are responsible for configuring and supervising AI-assisted workflows and complying with laws and professional obligations that apply to their use of AI-assisted features. Intaker does not provide legal advice and does not decide whether a law firm or other Customer accepts or rejects a matter, client, or inquiry.

9. How We Disclose Personal Information

We disclose personal information to the following categories of recipients as needed for the purposes described in this policy:

• Customers, Customer Personnel, administrators, and authorized account users, according to account permissions and Customer configuration.
• Service providers, contractors, SDK providers, and subprocessors that provide hosting, storage, security, authentication, communications, messaging, email, phone, SMS, push notifications, analytics, crash reporting, monitoring, payment processing, support, transcription, AI processing, integrations, advertising, attribution, and other services for us.
• Third-party integrations, platforms, APIs, payment processors, communication providers, advertising or analytics providers, and other services enabled, configured, or directed by Customers or users.
• Professional advisors, auditors, insurers, legal, compliance, tax, accounting, and regulatory recipients.
• Law enforcement, courts, regulators, government authorities, or other parties when required or permitted by law, legal process, security needs, fraud prevention, rights protection, or enforcement of terms.
• Parties involved in a merger, acquisition, financing, reorganization, bankruptcy, sale of assets, or similar corporate transaction.
• Prospects or business contacts, only to identify a business as an Intaker Customer when that relationship is already publicly available or publicly visible, and only without disclosing Customer Data, End User data, lead or client records, matter details, communications, files, pricing, security information, or other confidential information.

We require service providers, contractors, SDK providers, and other third parties that process user data for us to protect that data in a manner consistent with this Privacy Policy, applicable law, and applicable platform requirements, and to use it only for authorized purposes.

10. Sale, Sharing, Targeted Advertising, and Marketing Choices

We do not sell Customer Data or End User data, and we do not use Customer Data or End User data for Intaker-owned cross-context advertising, retargeting, audience building, or advertising attribution. Customer-directed attribution, optimization, and conversion-posting disclosures may occur on behalf of Customers according to Customer instructions.

For Intaker-controlled properties, including websites and the mobile app, we may use or disclose website, app, marketing, device, cookie, analytics, attribution, and interaction data for Intaker's own marketing, advertising attribution, sales engagement, analytics, and service improvement, subject to applicable law and privacy choices. Some privacy laws may define certain advertising, analytics, or cross-context behavioral advertising disclosures as a "sale," "sharing," or "targeted advertising."

You may opt out of marketing emails by using unsubscribe links or contacting us. Where applicable, you may opt out of sale, sharing, targeted advertising, or certain profiling through available privacy choices, recognized opt-out signals such as Global Privacy Control, or support@intaker.me. You may opt out of SMS marketing by replying STOP where available. Service, transactional, legal, support, and security messages may still be sent. The iOS app does not currently track users across third-party apps or websites for Apple App Tracking Transparency purposes. If we engage in such tracking, we will provide any required notices and permissions.

11. Payments

If payments are enabled, payment information may be collected by third-party payment processors. Intaker may receive and store limited billing and payment metadata, such as payment status, invoice identifiers, transaction identifiers, billing contacts, and last-four or similar payment method references, but we do not store full payment card numbers.

12. Retention, Deletion, and Account Requests

We retain personal information for as long as reasonably necessary to provide the Services, maintain accounts, comply with legal, tax, accounting, audit, security, contractual, dispute-resolution, and professional obligations, enforce agreements, prevent fraud and abuse, maintain backups, and improve the Services. Retention periods depend on the type of data, our role, Customer instructions, account settings, contracts, legal requirements, security needs, and operational requirements.

Customer Data is retained according to the Customer's account configuration, contract, instructions, legal requirements, and use of available deletion tools. When a Customer cancels the Services, the Customer may request deletion of Customer Data by contacting support@intaker.me. We delete or de-identify End User/client data as required by Customer instructions, applicable contracts, applicable law, and our deletion procedures. We may retain limited information where required or permitted for billing, tax, accounting, security, fraud prevention, audit, legal compliance, dispute resolution, support, communications with Intaker, backup integrity, or similar legitimate business purposes.

The mobile app is intended for authorized Intaker Users whose accounts are provisioned or managed by a Customer or Organization. Users cannot create an Intaker App Account through the mobile app. Customer administrators may manage, disable, or remove user access within the Organization. Intaker Users, Customers, and Customer administrators may request deletion or deactivation of app-related personal information by contacting support@intaker.me. If the request relates to Customer-controlled data, we may coordinate with the relevant Customer before taking action.

13. Security and Secure Data Handling

We use reasonable administrative, technical, and organizational safeguards designed to protect personal information, including access controls, authentication, monitoring, logging, encryption, backups, incident response processes, and vendor review appropriate to the nature of the Services. User data transmitted to Intaker backend APIs, authentication endpoints, Firebase, Tally, and Smarty is sent over HTTPS/TLS based on the current app configuration. Push messaging is handled through platform push services and Firebase Cloud Messaging. No security program is perfect, and we cannot guarantee absolute security.

14. Data Storage and International Transfers

Intaker is based in the United States, and personal information may be processed in the United States and other countries where we, Customers, service providers, or integration partners operate. Those countries may have privacy laws different from where you live. Where required, we use appropriate safeguards for cross-border transfers, such as contractual protections or other lawful transfer mechanisms.

15. Your Privacy Rights and Choices

Depending on where you live and the data at issue, you may have rights to access, know, confirm, correct, delete, restrict, object to processing, request portability, withdraw consent, opt out of sale, sharing, targeted advertising, or certain profiling, limit certain uses of sensitive personal information, appeal certain decisions, or complain to a privacy regulator.

To exercise rights for Intaker-controlled data, contact support@intaker.me, use the Intaker chatbot where available, or use applicable privacy choices on Intaker-controlled websites. To revoke consent or limit app data collection, you can change device permission settings, manage available dashboard settings, disconnect integrations where available, use unsubscribe or STOP options where applicable, or contact support@intaker.me. Some Services or app features may not work properly if required permissions, integrations, or settings are disabled.

If a request concerns Customer Data or End User data controlled by a Customer, Intaker may work with that Customer, require the Customer's authorization, or direct the requester to the relevant Customer, depending on our legal role and contractual obligations. We may verify requests before responding and may decline or limit requests where permitted by law.

16. Supplemental U.S. State Privacy Notice

This section applies where U.S. state privacy laws require additional disclosures. In the past 12 months, we may have collected the following categories of personal information, depending on how the Services are used: identifiers and contact information; customer records; commercial, billing, and transaction information; internet, device, app, and network activity; geolocation information if enabled; audio, electronic, visual, and communications content; professional or employment-related information; inferences; sensitive personal information submitted through accounts, workflows, integrations, or support; and other information described in this policy.

Sources include individuals, Customers, Customer Personnel, End Users, administrators, integrations, service providers, business partners, devices, browsers, apps, cookies, SDKs, WebViews, and Customer-configured workflows. Purposes include providing, securing, supporting, improving, marketing, and analyzing the Services; processing Customer instructions; enabling communications, payments, integrations, AI-assisted features, attribution, and conversion posting; preventing fraud; complying with law; managing business relationships; and the other purposes described in this policy. Recipients include the categories listed in Section 9.

We do not sell or share sensitive personal information for cross-context behavioral advertising, and we do not use or disclose sensitive personal information to infer characteristics except as permitted by law and needed to provide the Services. We do not knowingly sell or share personal information of individuals under 16. California residents and residents of other states may exercise applicable rights by contacting support@intaker.me or using available privacy choices. We will honor Global Privacy Control and similar legally recognized opt-out signals where required by law.

17. Supplemental International Privacy Notice

This section applies where European Economic Area, United Kingdom, Swiss, Canadian, or similar privacy laws apply. For Intaker-controlled data, Intaker is generally the controller or business. For Customer Data and End User data processed on behalf of a Customer, the Customer is generally the controller, business, or organization responsible for determining the purposes and means of processing, and Intaker generally acts as processor or service provider.

Where a legal basis is required, we rely on contract to provide the Services and related support; legitimate interests to operate, secure, analyze, improve, and market the Services, communicate with Customers and prospects, conduct limited customer reference communications, prevent fraud and abuse, support corporate transactions, and maintain business records; consent for certain cookies, marketing, integrations, mobile permissions, or other processing where required; legal obligations for tax, accounting, regulatory, court, law enforcement, and compliance requirements; and Customer instructions for Customer Data and End User data. Sensitive or special-category Customer Data may be processed when submitted by Customers in connection with enabled Services and according to Customer instructions, applicable law, contracts, and available legal bases or exceptions.

International users may have rights to access, rectify, erase, restrict, object to processing, request portability, withdraw consent, opt out of certain marketing or targeted advertising, and lodge a complaint with a local data protection authority or privacy regulator. Canadian users may also request access or correction and withdraw consent subject to legal or contractual limits. To exercise rights for Intaker-controlled data, contact support@intaker.me. For Customer Data or End User data, contact the relevant Customer first or contact Intaker and we will coordinate as appropriate.

18. Children and Minors

The Services are not intended for individuals under 16 as Customers, Customer Personnel, or Intaker Users, and we do not knowingly collect personal information directly from children under 16 in our own relationship with users. If we learn that a child under 16 provided personal information directly to Intaker without appropriate authorization, we will take steps to delete it. Customers may submit information about minors as Customer Data or End User data in connection with legal matters or intake workflows, and Customers are responsible for required authority, notices, consents, and compliance.

19. Third-Party Links and Services

The Services may link to, integrate with, or direct you to third-party websites, resources, or services. We do not control and are not responsible for third-party content, security, privacy practices, or terms. If you use third-party links or integrations, your use is subject to those third parties' terms and privacy policies.

20. Changes to This Policy

This Privacy Policy is effective as of the date above. We may update it from time to time. If we make material changes, we will provide notice as required by law, such as by posting the updated policy, updating the date, providing in-app notice, or sending other appropriate notice.

21. Contact Us

For privacy questions, requests, or complaints, contact Intaker at support@intaker.me, through the Intaker chatbot where available, or by mail at Intaker Inc., 8549 Wilshire Blvd #5018, Beverly Hills, CA 90211.

‍

22. Chrome Extension: Intaker for case management

This section applies to the Intaker for case management Chrome Extension made available through the Chrome Web Store. The Chrome Extension is intended for authorized Intaker Users and Customer Personnel. Its single purpose is to let authorized users use Intaker in a side panel beside case management systems to find, create, view, and update contacts and related activities, tasks, files, and communications.

22.1 Chrome Extension Data we collect or access. To provide the Chrome Extension, Intaker may collect or access:

• Account, workspace, authentication, permission, and user identifiers needed to sign in and connect the Chrome Extension to the user's Intaker workspace.
• Visible webpage content when a scan runs, including visible page text and visible form-field values, to extract contact information. Scans may run automatically on allowlisted domains or when the user selects Scan Page. The Chrome Extension does not collect browsing history, screenshots, clipboard contents, host-page cookies, host-page local or session storage, downloads, system contacts, or host-page network traffic.
• Contact and CRM data, including names, email addresses, phone numbers, contact fields, matched-lead preview results, user-entered search terms, contact records, communications, notes, tasks, custom fields, activities, and user-uploaded files processed in the side panel.
• Current tab URL, used locally for allowlist matching and scan display, and sent to Intaker only when the user creates a new contact and the URL is saved as the contact's website URL.
• Extension-local storage, such as authentication state and temporary scan state.

22.2 How we use Chrome Extension Data. Intaker uses Chrome Extension Data to authenticate users; scan pages and extract contact information; search the user's Intaker workspace; display matched contacts; create, upload, edit, or manage contacts, activities, tasks, files, custom fields, communications, and related records; provide address autocomplete; operate, secure, troubleshoot, and support the Chrome Extension and Services; and comply with applicable law.

22.3 How we share Chrome Extension Data. Intaker may share Chrome Extension Data with:

• Intaker systems and authorized Customer account users, according to account permissions and Customer configuration.
• Service providers and subprocessors that host, store, secure, monitor, troubleshoot, support, or maintain Intaker systems and the Chrome Extension.
• Smarty, LLC, which receives address fragments typed into contact forms to provide address autocomplete.
• OpenAI, which may receive scanned visible webpage content described in Section 22.1 through Intaker's backend to extract contact information.
• Legal, security, compliance, and corporate-transaction recipients as described in Section 9, subject to the Chrome Web Store User Data Policy and applicable law.

22.4 Chrome Web Store Limited Use. The use of information received from the Chrome Extension will adhere to the Chrome Web Store User Data Policy, including the Limited Use requirements. Intaker uses Chrome Extension Data only to provide or improve the Chrome Extension's single purpose and user-facing features, comply with applicable law, protect the Services and users from fraud, abuse, or security threats, and perform permitted internal operations. Intaker does not sell Chrome Extension Data or use or transfer Chrome Extension Data for personalized advertising, retargeting, interest-based advertising, data broker or information-reseller purposes, creditworthiness or lending, or unrelated marketing or analytics. Intaker transfers Chrome Extension Data only as allowed by the Chrome Web Store User Data Policy. Intaker does not allow humans to read Chrome Extension Data except with user consent for specific data, for security or abuse prevention, to comply with law, or for aggregated and anonymized internal operations.

22.5 Security, storage, retention, and controls. Chrome Extension communications with Intaker, Intaker authentication systems, and third-party providers are sent over HTTPS/TLS. The Chrome Extension may store authentication state in Chrome-managed local storage and temporary scan state in Chrome-managed session storage. Data created, uploaded, saved, or changed through the Chrome Extension is retained as Customer Data under Section 12. Intaker protects Chrome Extension Data on Intaker-managed systems under Section 13. Users can stop Chrome Extension collection by signing out, disabling, or uninstalling the Chrome Extension; Customer administrators may manage user access within an Organization.

‍