How Filebird collects, uses and protects personal information. Every clause starts with a plain-English summary, and nothing important hides in the fine print.
This policy explains how Filebird Pty Ltd and its subsidiaries (“Filebird”, “we”, “us”) handle personal information when you visit filebird.com, use the Filebird app, or talk to us. It is written for the law firms that use Filebird, and for the people whose information passes through it.
Every clause opens with a plain-English summary. The summary helps you read the clause, but the full text is what applies.
01
Who we are
In short
Filebird makes practice management software for law firms. For your firm’s client files, your firm is in charge and we act on its instructions.
Filebird Pty Ltd (ABN 00 000 000 000) is an Australian company that provides practice management software to law firms in Australia, the United States and elsewhere. Filebird, Inc. provides the service to customers in the United States.
We play two roles. For account, billing and website information, we decide how it is used, so we are its controller (an “APP entity” under Australia’s Privacy Act 1988). For the client files your firm keeps in Filebird, your firm decides what is stored and why, and we act only on its instructions as its processor or service provider.
If you are a client of a firm that uses Filebird, your lawyer’s own privacy notice explains how they use your information, so questions about your matter should go to your firm first.
02
What this policy covers
In short
Our website, our app, the client portal and our support channels. Not the third-party apps you connect to Filebird.
This policy applies to:
filebird.com and our other websites;
the Filebird web, desktop and mobile apps, including the client portal your firm may invite you to; and
our sales, support, training and events.
It does not cover services run by others, such as the email, accounting or e-signature tools you choose to connect. Their own privacy policies apply.
Filebird is built for businesses. We do not knowingly collect information from anyone under 16.
03
Information we collect
In short
The details we need to run your account, how you use Filebird, and whatever your firm chooses to store in it.
Information you give us. Your name, firm, role, email, phone number and password when you sign up or are invited; billing contacts and payment details (card numbers are held by our payment processor, never by us); and anything you tell us in support requests, demos or surveys.
Information we collect automatically. Log and device information such as IP address, browser, operating system, pages viewed and features used, plus the cookies described in clause 12.
Information your firm stores. Matters, contacts, documents, emails filed from Outlook or Gmail, time entries, invoices, trust records and portal messages (“Client Files”). Client Files often contain sensitive information, such as health, financial or criminal records. We handle it only as clause 4 describes.
Information from others. A colleague may invite you, a partner may refer your firm, or an event organiser may share your business contact details. When we first contact you, we tell you where we got your details.
04
Client files and privilege
In short
Your firm’s files belong to your firm. We don’t read them, sell them or mine them, and privilege is never ours to waive.
We process Client Files only to provide Filebird to your firm, to keep it secure and to comply with the law. We never sell them, use them for advertising, or combine them with other customers’ data.
Our staff cannot open Client Files by default. If your firm asks for help with a specific matter, a named support engineer can be given time-limited access, and every access is recorded in an audit log your firm’s administrators can see.
We respect legal professional privilege and attorney–client privilege. Storing privileged material in Filebird does not waive it, and we will never claim or waive privilege on your behalf. If anyone demands Client Files from us, we follow clause 7.
05
How we use information
In short
To run Filebird, keep it secure, bill for it, support you and, if you agree, tell you what’s new.
We use personal information to:
create and manage accounts, and sign users in securely;
provide features such as time capture, billing, trust accounting and the client portal;
process payments and send invoices and receipts;
answer support requests and train your team;
detect, prevent and investigate fraud, abuse and security incidents;
understand how features are used, from aggregated or de-identified data, so we can improve them;
send service notices, and marketing if you have opted in; and
meet our legal, tax and regulatory obligations.
Where the law asks us to name a legal basis, such as under the GDPR, we rely on performing our contract with your firm, our legitimate interest in running and securing a business service, your consent for marketing, and our legal obligations.
06
Filebird Assist (AI)
In short
Our AI features work on your files to help you. Nothing you put in them trains anyone’s model, including ours.
Filebird Assist drafts, summarises and searches within your firm’s matters. To answer a request, it sends only the relevant text to our AI providers, under contracts that forbid them from keeping it or training on it.
Client Files are never used to train or fine-tune any AI model, whether ours or a provider’s. Your administrators can switch Assist off for the whole firm or for individual matters.
Assist can make mistakes. Its output is a draft for a qualified person to check, as our Terms of Service explain.
07
Who we share it with
In short
Only the providers who help us run Filebird, under contract, and authorities when the law requires it. Never data brokers or advertisers.
We share personal information with:
Service providers who host, secure, support and bill for Filebird. They are bound by written agreements to use it only for us. We list them on our sub-processor page and give 30 days’ notice before adding one.
Integrations you turn on, such as Microsoft 365, Google Workspace or your accounting software, so they can exchange data at your direction.
Professional advisers, such as our auditors, insurers and lawyers, under duties of confidentiality.
A buyer or successor if Filebird is merged or sold, who must honour this policy.
Authorities, when a valid law requires it.
If a government or anyone else asks us for Client Files, we refer them to your firm. Unless the law forbids it, we tell your firm before we disclose anything, and we challenge requests that are overbroad.
We do not sell personal information, and we do not share it for cross-context behavioural advertising, as those terms are used in US state privacy laws.
08
Where it’s stored
In short
In Australia or the United States, depending on where your firm signs up, and it stays there.
Client Files for firms that sign up in Australia are stored in Sydney, and for firms in the United States in Virginia. Backups stay in the same country. Firms elsewhere choose a region during setup.
Some account and support information is handled by our staff and providers in other countries, including the United States, the United Kingdom and the Philippines. When it is, we take reasonable steps under Australian Privacy Principle 8 to make sure it is protected to the standard of this policy. For transfers from Europe or the UK, we use approved safeguards such as standard contractual clauses.
09
How we protect it
In short
Encryption everywhere, the least access possible, and independent audits to prove it.
Every file is encrypted in transit with TLS 1.2 or higher, and at rest with AES-256. Access to production systems requires single sign-on, multi-factor authentication and a recorded reason, and we review it every quarter.
An independent auditor reviews our controls every year against SOC 2 Type II and ISO/IEC 27001, and outside specialists test our defences. Reports are available to customers on request.
No system is perfectly secure. If a breach is likely to cause serious harm, we tell affected firms without undue delay, and we notify individuals and regulators as the law requires, including under Australia’s Notifiable Data Breaches scheme.
10
How long we keep it
In short
For as long as your firm is a customer, then 90 days to export, then it’s gone. Billing records stay for seven years because tax law requires it.
We keep account information while your firm’s subscription is active. When it ends, you have 90 days to export your Client Files in standard formats. After that, we delete them from our live systems, and they age out of encrypted backups within a further 35 days.
We keep invoices and payment records for seven years to meet tax law, and security logs for up to two years.
Your firm’s own record-keeping duties, such as keeping trust records and closed files, stay with your firm, so export what you need before you leave.
11
Your rights and choices
In short
You can see, fix, export or delete your information, and opt out of marketing in one click.
Depending on where you live, you may have the right to:
access the personal information we hold about you;
correct it if it is wrong or out of date;
delete it, or ask us to restrict how we use it;
receive a copy in a portable format;
object to how we use it, or withdraw your consent; and
opt out of marketing emails, using the link in every one.
To make a request, email privacy@filebird.com. We confirm who you are, then respond within 30 days. If your request is about Client Files, we pass it to the firm that controls them and help it respond. We never treat you differently for exercising your rights.
Residents of California and other US states with privacy laws have these rights too, and may use an authorised agent. We do not sell or share personal information, so there is nothing to opt out of.
12
Cookies
In short
Essential cookies keep you signed in. Anything else is optional, and you choose.
We use three kinds of cookies:
Essential cookies sign you in, remember your settings and protect against attacks. Filebird can’t work without them.
Analytics cookies count visits and show us which pages help, using aggregated data.
Marketing cookies measure our advertising. We use them on our website only, never inside the app, and only with your consent where the law requires it.
You can change your choice at any time from Cookie settings in our website footer. We treat a Global Privacy Control signal as an opt-out.
13
Changes to this policy
In short
If something important changes, we email account owners 30 days before it takes effect.
We review this policy at least once a year. For material changes, we email account owners and show a notice in the app at least 30 days before the change takes effect.
The revision history at the top of this page lists every change, and earlier versions are available on request.
14
Contact and complaints
In short
Talk to our privacy team first. If we don’t put it right, you can go to a regulator.
Our Privacy Officer handles questions and complaints. Email privacy@filebird.com, or write to Privacy Officer, Filebird Pty Ltd, PO Box 0000, Sydney NSW 2001, Australia. We acknowledge complaints within two business days and aim to resolve them within 30 days.
If you are not satisfied with our response, you can complain to the Office of the Australian Information Commissioner, to your state attorney general in the United States, or to the data protection authority where you live in the UK or EU.
Filebird Pty Ltd · ABN 00 000 000 000
Version 3.1 · In force from 1 October 2026
Back to top
Next in the file
Terms of Service
The agreement between your firm and Filebird, with a plain-English summary on every clause.