This document summarizes the current Ladra policy baseline.
Data We Process
- Account data: names, usernames, role and permission metadata.
- Operational data: matters, contacts, notes, assignments, and event metadata.
- Document data: uploaded files and related metadata.
- Telemetry data: performance and reliability events when enabled by permissions.
- Connected mailbox data when email integrations are enabled, including email metadata, thread identifiers, and message content needed to save emails to matters, classify workflow context, and detect replies or follow-up status.
How We Use Data
- Provide and secure the service.
- Operate workflow features requested by the customer.
- Support troubleshooting, auditability, and platform reliability.
- Comply with legal obligations.
Browser Extension and Gmail Workflows
The Ladra browser extension is designed to help authorized users work directly from Gmail. When a user or firm enables these workflows, Ladra may read the currently open Gmail message or thread context in order to create draft actions, save an email into a matter, send the email into an approved workflow, or track whether a reply has been received.
Ladra uses Gmail-connected data only to support the workflow requested by the customer, such as matter-linked email saving, follow-up tracking, reply detection, and related productivity features. Ladra does not sell Gmail-connected data and does not use it for unrelated advertising purposes.
Connected Mailbox Permissions
Mailbox access is initiated only after an authorized user or firm administrator completes a connection flow through Ladra. Connected account identity data is used to confirm which mailbox is linked and to display mailbox connection status inside the product.
Depending on the enabled workflow, Ladra may process message content, sender and recipient metadata, subject lines, thread identifiers, timestamps, and attachment metadata to help organize legal work. Customers remain responsible for enabling only the integrations appropriate for their practice and compliance requirements.
Customer Control
Customer administrators control user access and permissions, including AI and telemetry permissions.
Customers can export records and manage retention/archive behavior using provided administrative tools.
Customers can disconnect supported integrations and control whether browser-extension and mailbox-based workflows are enabled for their users.
Data Sharing
We do not sell customer data.
Data is shared only with approved subprocessors required to operate the service and with authorized legal requests where required by law.
Security and Retention
We use technical and organizational controls designed to protect confidentiality, integrity, and availability.
Retention and deletion handling is described in the Data Retention and Deletion Process.