Privacy Policy

MatterChat is a secure messaging and collaboration platform for law firms, operated by OmnisAI ("we", "us"). This policy describes what we collect, how we use it, and the choices you have. It applies to matterchat.com, the MatterChat apps, the cross-firm network (the Omnis Legal Network), and Omnis Boards.

Information we collect

Account and firm information you provide (name, work email, phone, firm name and size, bar number, practice areas, states of licensure); the content of messages, files, and board items you create or upload in the course of using the platform; cross-firm activity (verified connections, rooms you join, invitations you send or accept); and standard technical data (log, device, and usage information).

Camera and microphone

The MatterChat apps use your camera and microphone only when you use a feature that needs them, and only after your device or browser asks for your permission. The camera lets you appear on video in a meeting, photograph a document to attach to a message, take your profile photo, or scan a code that signs your phone in or opens a lawyer's card. The microphone lets you record a voice message, be heard in a meeting, or record an in-person meeting into CaseNotes. You can withdraw either permission at any time in your device's settings.

Codes are read on your device. On Android, the code scanner uses Google's ML Kit, which sends Google diagnostic and performance information about the scanner; it does not send the camera image.

Recordings

Meetings. A meeting is recorded only when a participant starts a recording, and a recording cannot start until consent for it has been recorded. An invited guest is asked for their own answer, and while a guest's refusal stands, no new recording of that meeting's room can start. People in the meeting in MatterChat see a notice while a recording runs. People who join by phone are not notified automatically, so whoever hosts the meeting should tell them. A recording captures the meeting's audio and video. Recordings, and the meeting notes and summaries made from them, are kept for three years and then deleted, unless a legal hold covers them.

In-person meetings. With CaseNotes, you can record an in-person meeting on your phone. The app records the consent of the people present before the microphone opens. The recording is sent to CaseNotes, an OmnisAI product, which transcribes and summarizes it for the matter.

Voice messages. A voice message is recorded only while you are recording it, and is sent to the conversation like any other file.

Protected health information

Messages, files, and matter records handled on the platform may contain protected health information (PHI) or other confidential client information. We handle this content under HIPAA-appropriate safeguards, store it encrypted, restrict access to personnel who need it to operate and support the service, and never use it for marketing.

How we use information

To deliver, secure, and support the messaging and collaboration services you use; to operate the cross-firm network (including verifying identities and connecting counterparties you choose to message); to communicate service updates; to send product and marketing email you can opt out of at any time; and to meet legal obligations.

Message content & confidentiality

Your messages, files, and board content belong to your firm. We process them to provide the service (delivery, search, backup, and the features you enable) and do not sell them, use them to train models without your instruction, or disclose them except as directed by your firm's administrators or as required by law. Cross-firm conversations are visible only to the verified participants of each room.

Notifications

If you allow notifications, your device gives the app a push token, which we store so that we can reach that device. We remove it when you sign out. Notifications are delivered through Apple Push Notification service on iPhone and iPad, and through Google's Firebase Cloud Messaging on Android; Apple and Google carry them to your device for us.

By default, a notification names the room and says "New message", and nothing more. You can choose, for each device, to show who wrote the message or the message itself. Your firm can limit what any device shows, and a confidential message never shows its contents.

Chi and AI processing

Chi, the assistant in MatterChat, works on what you ask it and the material it needs to answer: the messages, files, and records in the conversation or matter you ask about, and any document or recording you give it. Saved items in Content Vault are summarized the same way. By default, we send this to a model hosted on Amazon Bedrock, in Amazon Web Services' US West (Oregon) region, which processes it for us as our service provider.

A firm administrator can instead connect Chi to an AI provider the firm chooses, using the firm's own account with that provider (for example Anthropic, OpenAI, Google, xAI, DeepSeek, Groq, Cerebras, or OpenRouter). When a firm does this, what Chi sends goes to that provider under the firm's own agreement with it. That is a transfer to a third party chosen by your firm, and we treat it as sharing.

Transcription

Speech is turned into text in three places. Audio or video you give Chi to transcribe is sent to Google's Gemini API or to OpenAI, which transcribe it for us. Chi's dictation and Content Vault use the speech-to-text provider your firm's administrator configures (for example OpenAI or Groq); like a firm-chosen AI provider, that is sharing with a third party your firm chose. In-person recordings are transcribed by CaseNotes, an OmnisAI product, using its speech-to-text service providers.

Sharing

We do not sell personal information. We share information in these ways:

• Service providers who process it for us: hosting and storage (Amazon Web Services); email delivery (Brevo, which sends MatterChat's invitations, notifications, and other email, and so receives the recipient's name, address, and the message); notification delivery (Apple and Google); meeting audio and video, which travel through LiveKit media servers during a call; AI and transcription (Amazon Bedrock, Google, and OpenAI, as described above); and payments.
• AI and speech-to-text providers your firm chooses, as described above.
• GIFs. When you search for a GIF, your search words are sent to KLIPY, our GIF provider, together with a coded identifier we derive from your account, from which KLIPY cannot tell who you are. KLIPY uses it to avoid repeats and to personalize results. GIF images load from KLIPY's servers, which see your device's internet address. Because KLIPY uses this information to personalize its results, we treat it as sharing.
• Counterparties you choose to connect or message with on the cross-firm network.
• Where required by law.

Fingerprint, face, and your device

If you turn on the app lock, or sign in with Face ID, Touch ID, or your Android fingerprint or face unlock, your device does the check. We never receive your fingerprint, face, or other biometric data.

If you choose to sign in that way, your password is kept in your device's secure storage (the iOS Keychain, or storage protected by the Android Keystore) and can be read only after your device confirms it is you. It stays there until you turn this off or someone else signs in on that device.

The apps keep an encrypted copy of your recent conversations on your device so you can read them without a connection. Signing out removes it, together with your unsent drafts.

Content Vault sign-ins (iPhone)

On iPhone, Brain Dump's Content Vault can save posts you choose from Instagram, TikTok, YouTube, X, Facebook, and LinkedIn. To reach posts that need a login, you sign in on the platform's own page inside the app. That sign-in stays in the app's web storage on your iPhone; we never receive your social media passwords, cookies, or tokens. We receive the address of each post you save, and any video or audio your phone saves from it, which only you can see. Disconnecting an account, or signing out of MatterChat, removes these sign-ins from the phone.

Retention & security

We retain information for as long as your account is active or as needed to provide services and meet legal requirements, including any legal-hold or retention settings your firm configures. Data is encrypted in transit and at rest; access is role-restricted and audited.

Your choices

You can access and update account information in the app, unsubscribe from marketing email via the link in any message, manage your cross-firm connections, turn off notifications or change what they show, withdraw camera and microphone permission, or ask us to delete your account or some of your data (see Delete your account). Firm administrators control workspace-level data and retention.

Contact

Questions or requests: privacy@omnisai.io · OmnisAI.