PRIVACY POLICY

George Legal Technologies, PBC ("George," "we," "our," or "us") operates a court-adjacent technology platform designed to provide procedural guidance to self-represented litigants in Virginia civil matters. This Privacy Policy describes how George collects, uses, processes, retains, protects, and discloses personal data. This Policy and our processes are designed to comply with the Virginia Consumer Data Protection Act (Va. Code § 59.1-575 et seq.) ("VCDPA").

George is intentionally designed to minimize data collection and to avoid the unnecessary persistence of personal information. Data minimization is a foundational operating principle of the platform: we collect only what is necessary to provide the requested service, retain it only as long as necessary, and process it only for the purposes described in this Policy.

George does not provide legal advice, does not represent users, and does not create an attorney-client relationship.

This Privacy Policy applies to the current operational version of the George platform, including all features and services available at the time of the effective date. The platform currently supports Virginia tenant-law procedural matters and operates without persistent user accounts, using system-generated case codes for limited session continuity.

As the platform evolves to incorporate additional features, jurisdictions, or user account functionality, this Policy will be updated accordingly. Material updates will be reflected with a revised effective date and version number.

Consistent with its data minimization principle, George collects only the following categories of personal data:

a)User-provided information, including responses to structured questions and case details necessary to generate procedural guidance.

b)Uploaded documents, such as notices, summonses, or leases, and data fields extracted from those documents.

c)Optional contact information (email address or phone number) provided voluntarily by users for plan delivery and session continuity.

d)Technical and session data, including IP address, browser type, device metadata, and system log data.

e)Communications initiated by users, including support inquiries.

George does not intentionally collect government-issued identification numbers, financial account numbers, login credentials, or other sensitive personal data beyond what users voluntarily include in uploaded documents as described in Section 4.

Under the VCDPA, certain categories of information constitute sensitive personal data requiring heightened protection. George asks a limited, enumerated set of optional questions that collect sensitive personal data (for example, income, health, or immigration status) solely to assess whether a user may qualify for free Legal Aid and to route the user accordingly. Each such question is presented only after the user’s affirmative consent on a dedicated consent screen, each may be declined, and declining does not affect access to the platform’s procedural guidance. Outside this enumerated set, George does not solicit sensitive personal data and affirmatively instructs users not to submit Social Security numbers, financial account numbers, or other sensitive personal data not necessary for procedural guidance.

Users may nonetheless voluntarily upload documents, such as leases or court notices, that incidentally contain sensitive personal data. By uploading such documents, users affirmatively consent to the transient processing of any sensitive personal data contained therein solely for the purpose of generating procedural guidance. George processes such incidental upload content only to the minimum extent necessary, does not store sensitive personal data contained in uploaded documents beyond the active session, and does not use it for any secondary purpose. Sensitive personal data collected through the consented Legal Aid routing questions described above is retained with structured session data as described in Section 9. George implements technical controls designed to detect and promptly delete any sensitive information.

If you inadvertently submit sensitive personal data, please contact us at governance@georgeva.com to request deletion.

George processes personal data for the following specific purposes:

a)Providing procedural guidance: User-provided information and uploaded documents are processed to generate informational procedural plans. This is the core function of the platform.

b)Session continuity: Case codes and, where provided, optional contact information are processed to allow users to resume a session or receive a copy of their procedural plan.

c)Platform security and integrity: Technical and log data are processed under George’s legitimate interest in protecting the platform from unauthorized access, abuse, and system failures.

d)Legal compliance: Personal data may be processed to the extent necessary to comply with applicable law, regulatory requirements, or valid legal process.

e)Platform improvement: Aggregated, de-identified analytics are used to evaluate platform performance and improve the user experience. Aggregated, de-identified data may also be used in program evaluation reporting, in research or academic study, and in public communications concerning the platform, subject to the de-identification standards of Va. Code § 59.1-581(A). Individual personal data is not used for these purposes.

Optional contact information is processed based on the user’s affirmative consent at the time of submission. Users may withdraw consent by contacting governance@georgeva.com.

George uses automated systems and artificial intelligence to analyze user inputs and generate informational procedural outputs. The following disclosures apply:

a)All outputs generated by the platform are informational only. They do not constitute legal advice, legal determinations, or binding decisions of any kind.

b)Automated processing on this platform does not produce legal effects or similarly significant effects on users. All determinations with legal consequence remain within the exclusive authority of courts and judicial officers. The platform’s outputs fall outside the scope of VCDPA profiling provisions applicable to processing that produces legal or similarly significant effects.

c)Users retain full agency over how they use the procedural information provided. The platform does not act on behalf of users in any legal proceeding.

d)George does not use user-submitted content to train general-purpose artificial intelligence models.

George uses limited cookies and session-logging technologies strictly necessary for session integrity, security, and aggregate performance analytics. George does not use cookies or tracking technologies for targeted advertising, cross-site behavioral tracking, or user profiling. George maintains a Cookie and Tracking Technology Notice in its Governance Framework (GG-2.06).

George does not sell personal data. George does not share personal data with landlords, opposing parties, courts, advertisers, or data brokers.

George may disclose personal data in the following limited circumstances:

a)Service providers: George engages third-party service providers (such as hosting and infrastructure providers) who process personal data solely on George’s behalf and under contractual data processing agreements that prohibit use for independent purposes. George maintains a current list of material third-party processors in its Third-Party Risk Management Policy (GG-3.07), which is updated when third-party service providers are changed or added. A summary of current 3rd party service providers is available upon written request to governance@georgeva.com. George does not use third-party advertising networks, social media pixels, or behavioral advertising tools on the Platform.

b)Partners and funders: Aggregated, anonymized platform metrics may be shared with partners or funders for program evaluation, research or academic study, and public communications purposes. Such sharing is governed by written data sharing agreements that prohibit re-identification and require appropriate data security measures. No individually identifiable personal data is disclosed under these arrangements.

c)Legal obligations: George may disclose personal data if required to do so by law, subpoena, court order, or other valid legal process, or to protect the rights, safety, or property of George, its users, or the public.

George retains personal data only as long as necessary for the purposes for which it was collected, consistent with its data minimization principle:

a)Session data and user-provided information: Structured session data — your answers, evidence statuses, and the generated procedural plan — is retained for up to 180 days from your last interaction, so that you can return and resume your session using your case code, and is deleted when your case code expires. Raw conversation transcripts are retained for up to 180 days for quality assurance and service evaluation, with access restricted and logged, and are then deleted.

b)Case codes: System-generated case codes expire after 180 days of inactivity and are deleted thereafter.

c)Uploaded documents: Processed to extract the information needed for your session and deleted at the conclusion of the session in which they were uploaded, with automated verification confirming that no uploaded file persists beyond 30 days following session completion, unless required for an open support request or to comply with a legal obligation. If you resume a session later, you may need to re-upload a document.

d)Optional contact information: Retained for the period necessary to deliver the requested plan and confirm delivery, after which it is deleted unless the user has consented to ongoing communications.

e)Security logs: Retained for up to 12 months to support incident investigation and system integrity, then deleted.

f)Support communications: Retained for the duration necessary to resolve the inquiry and for a reasonable period thereafter for quality assurance, not to exceed 24 months.

g)De-identified and aggregated data: Information that has been de-identified in accordance with Va. Code § 59.1-581, meaning it can no longer reasonably be linked to you or your household, is not personal data. George may retain such data indefinitely and use it to evaluate and improve the platform, conduct research and analytics, and prepare program evaluation and public benefit reporting. George publicly commits to maintain such data only in de-identified form, not to attempt to re-identify it, and to contractually require any recipient of de-identified data to commit to the same. George may satisfy a deletion obligation under this Policy by irreversibly de-identifying the data and retaining only the de-identified form.

Virginia residents have the following rights with respect to their personal data under the VCDPA (Va. Code § 59.1-577):

a)Right to confirm and access: The right to confirm whether George processes your personal data and to access that data.

b)Right to correction: The right to correct inaccuracies in your personal data.

c)Right to deletion: The right to request deletion of personal data you have provided or that we have collected about you. Where deletion is granted, George may fulfill it by irreversibly de-identifying the data and retaining only the de-identified form, as described in Section 9.

d)Right to data portability: The right to obtain a copy of your personal data in a portable, readily usable format that allows you to transmit it to another controller.

e)Right to opt out: The right to opt out of the sale of personal data, targeted advertising, and profiling that produces legal or similarly significant effects. George does not engage in any of these activities.

How to submit a request: To exercise any of the above rights, please contact our Compliance Officer at governance@georgeva.com or in writing at the address in Section 14. Please include sufficient information to allow us to identify the data subject and the nature of the request. George will respond within 45 days of receipt, as required by Va. Code § 59.1-577. If additional time is needed, we will notify you within the initial 45-day period and may extend our response by an additional 45 days.

Appeals: If George declines to take action on your request, we will inform you of our reasons and your right to appeal. You may appeal our decision by submitting a written appeal to governance@georgeva.com with the subject line “VCDPA Appeal.” George will respond to your appeal within 60 days. If your appeal is denied, you may contact the Office of the Attorney General of Virginia to submit a complaint: https://www.oag.state.va.us.

George employs reasonable and appropriate administrative, technical, and organizational safeguards to protect personal data against unauthorized access, disclosure, alteration, or destruction. These measures include, without limitation, encryption of data in transit and at rest, access controls based on least-privilege principles, ongoing security monitoring, and vendor risk management requirements imposed on third-party service providers.

No method of electronic transmission or storage is completely secure. In the event of a data breach affecting your personal data, George will notify affected individuals as required by applicable law.

Service providers engaged by George may process personal data in jurisdictions other than Virginia or the United States. George requires all service providers to apply privacy and security safeguards consistent with this Policy and applicable law, regardless of where processing occurs.

The platform is not directed to individuals under the age of 18 and is not designed or intended for use by minors. George does not knowingly collect personal data from individuals under 18. If George becomes aware that personal data has been submitted by or on behalf of a minor, it will be deleted promptly. If you believe a minor has submitted personal data through the platform, please contact us immediately at governance@georgeva.com.

George has designated a Compliance Officer responsible for overseeing compliance with this Policy and applicable privacy law. For privacy-related inquiries, requests, or concerns, please contact:

Compliance Officer
George Legal Technologies, PBC
c/o Capitol Services, Inc.
108 Lakeland Avenue
Dover, DE 19901

Email: governance@georgeva.com

George may update this Privacy Policy periodically to reflect changes to our practices, platform functionality, or applicable law. Material changes will be reflected with an updated effective date and version number posted at the top of the Policy. We encourage users to review this Policy periodically. Continued use of the platform following the posting of a revised Policy constitutes acceptance of the updated terms.