Privacy Policy
Last updated: October 10, 2026
The short version
The Burt product collects intake conversations on behalf of the law firm you contacted — that firm is who you’re talking to, and Burt processes the data for them. On this marketing website we use cookies for analytics and advertising, but only with your choice: the cookie banner lets you accept, reject, or pick per category, we honor the Global Privacy Control browser signal automatically, and you can change your mind any time from . We don’t sell personal information collected through a law firm’s own Burt intake, and both firms and claimants have real deletion controls. The one exception is Burt Intake, our own free intake page for injured people, where we share cases with attorneys who may pay us; that is explained below.
Cookies & your privacy choices (this website)
hiburt.com uses cookies and similar technologies in three groups. Nothing outside the strictly-necessary group runs until you make a choice in the cookie banner — if you reject a category, those scripts are never loaded and their cookies are not set.
- Strictly necessary — keep the site working (and remember your cookie choice). Always on; no tracking.
- Analytics — help us understand how the site is used, via Google Analytics. Loaded only if you allow analytics.
- Advertising — measure our marketing and show relevant ads, via Google Ads, Meta, LinkedIn, and TikTok. Loaded only if you allow advertising. Under California law, using these counts as a “sale” or “sharing” of personal information (see below).
You control all of this from the cookie banner or the link in the footer. If your browser sends a Global Privacy Control (GPC) signal, we treat it as an opt-out of advertising/sharing automatically — you don’t have to do anything.
| Group | Examples | Provider | Purpose | Typical duration |
|---|---|---|---|---|
| Necessary | burt_consent | Burt (first-party) | Stores your cookie choice | 180 days |
| Analytics | _ga, _ga_*, _gid | Measure site usage | Up to 2 years | |
| Advertising | _gcl_*, _fbp, _ttp, LinkedIn insight | Google, Meta, LinkedIn, TikTok | Ad measurement & targeting | Up to 1 year |
The website contact form
If you submit the demo-request form, we receive the name, firm, email, and notes you typed, and we use them only to reply to you and to follow up about Burt. If we ever add you to a marketing list, it will be with an unsubscribe link in every message.
The Burt product
When a law firm uses Burt, two kinds of data exist:
- Firm account data: the firm’s name, its team members’ emails, its configuration, and its billing records. We use this to provide and bill the service.
- Intake data: conversations, contact details, incident descriptions, and evidence (photos, video, documents, recorded statements) that a visitor or caller shares during intake with a specific law firm. The firm decides what to collect through its intake criteria; Burt processes it on the firm’s behalf and makes it available only to that firm.
Intake data is strictly separated per firm. One firm can never access another firm’s conversations or claimants. Every time Burt platform staff open an intake conversation, including when acting inside a firm’s account for support, that access is recorded in an audit log.
Security and spam prevention. To protect law firms and their visitors from spam and abuse, Burt records technical information about chat visitors, such as the IP address used to connect. We store it only as a one-way, keyed hash (never the raw address), use it only to recognize visitors a firm has marked as spam, and never use it for advertising or tracking. These records are kept only for a limited time and are deleted automatically (records based on an IP address expire after 14 days).
Burt Intake (hiburt.com/intake)
Burt Intake is different from the firm product above: here Burt itself collects your information, because you came to us rather than to a specific law firm. Burt is not a law firm and does not give legal advice.
- What we collect: what you tell Burt in the chat or by text, including your contact details, what happened, your injuries and treatment, and any photos, video, or documents you upload.
- Who we share it with: personal-injury attorneys and law firms who may be able to help you. Until an attorney buys your case, they see only a preview: your first name and last initial, with your full name, phone, and email removed. Photos appear in a preview only after a person at Burt has reviewed them and approved them, and they are watermarked.
- Why it counts as a “sale”: attorneys who receive your case may pay Burt a fee. Under California law that counts as a “sale” of personal information, including sensitive information about your health. You agree to it when you start a Burt Intake chat, and you can withdraw that agreement at any time.
- Your choices: email hello@hiburt.com with “Burt Intake request” in the subject to stop further sharing of your case, see what we hold, correct it, or have it deleted. When you ask us to stop, we take your case off our listings and no new attorney will receive it. Records we must keep, such as the record that an attorney received your case, are kept only as long as needed.
What we don’t do
- We don’t sell personal information collected through a firm’s own Burt intake. (Burt Intake cases are shared as described above.)
- We don’t share one firm’s intake data with any other firm.
- We don’t use intake data to train AI models, and our AI providers don’t either.
- We don’t contact a firm’s claimants for our own purposes.
AI processing
Burt uses AI models to hold intake conversations, to pull structured case facts out of them, and to describe uploaded photos and video. Conversations are processed to serve the firm the visitor contacted: for answering, organizing, and packaging the intake for attorney review, and for keeping the service reliable and safe. The AI does not give legal advice, and an intake score is an estimate of how well the facts match intake criteria, not a legal opinion.
- Providers: Anthropic (conversation, fact extraction, and removing names before a case preview is shared) and Google’s Gemini API (describing uploaded photos and video).
- No training: both are used through their paid commercial APIs, under terms that don’t allow them to train their models on the data we send.
- Retention by providers: under their standard terms, providers may keep request data for a limited period to monitor abuse and safety, then delete it. We don’t currently have zero-data-retention agreements with them.
- Separation: each AI request contains only one case’s information. Nothing from one firm’s intake reaches another firm’s conversations.
Retention and deletion
- Firm-controlled retention: firms set their own automatic retention window (1 to 7 years, or keep forever), after which old conversations are deleted or redacted.
- Deletion requests: when a claimant asks a firm to delete their data, it is carried out in one action, by the firm’s owner or by our team at the firm’s request; related records are deleted or redacted, with a narrow carve-out for data needed as evidence of an active billing dispute, which is completed as soon as that hold clears.
- Export: a firm’s owner can download all of its conversations, case files, and evidence files as one ZIP.
Service providers
These providers process data for us. Each receives only what it needs for its role. Our database and application servers are in the United States (Supabase in Ohio, Render in Oregon).
| Provider | Role | Data it handles |
|---|---|---|
| Anthropic | AI conversation, fact extraction, redaction | Intake conversations and case facts |
| Google (Gemini API) | Describing uploaded evidence | Uploaded photos and video |
| Supabase | Database and evidence file storage | All product data |
| Render | Application hosting | All product data, in transit and in processing |
| Twilio | Text-message intake and follow-up | Phone numbers and text messages |
| Resend | Email delivery | Email addresses and notification content |
| Stripe | Payments | Firm billing details. Card numbers go directly to Stripe and never reach our servers. |
| Netlify | Hosting this website | Website requests |
| Ghost (run by us on Render) | Blog and newsletter | Subscriber email addresses |
| Google Analytics, Google Ads, Meta, LinkedIn, TikTok | Website analytics and advertising | Cookie and device identifiers, and only with your consent (see Cookies) |
Your California privacy rights (CCPA/CPRA)
This section applies to California residents. It describes our practices for personal information we handle as a business: information from this marketing website, and Burt Intake cases. For intake data collected through a law firm’s own Burt intake, that firm is the business responsible for the data and Burt acts as its service provider; direct requests about that data to the firm.
Burt Intake: for these cases we collect identifiers (name, phone, email), your account of the incident, and sensitive information about your health (injuries and treatment), and we sell them to attorneys as described above. You can opt out of that sale, and exercise your other rights, by emailing hello@hiburt.com.
Categories of personal information we collect
- Identifiers — name, email, and (from the contact form) firm name; online identifiers and device/cookie IDs from analytics and advertising cookies.
- Internet/network activity — pages viewed and interactions, via analytics and advertising cookies (with your consent).
- Geolocation — approximate location inferred from IP address.
- Commercial information — records of your inquiry or interest in Burt.
- Inferences — limited marketing inferences drawn from the above.
We collect these from you directly, from your device/browser as you use the site, and from our analytics and advertising providers. We use them to run and secure the site, respond to you, and measure and improve our marketing. We retain them no longer than needed for those purposes (see Retention).
“Sale” and “sharing”
We do not sell your personal information for money. However, when you allow advertising cookies, the resulting online identifiers may be disclosed to advertising partners (Google, Meta, LinkedIn, TikTok) for cross-context behavioral advertising — which California law treats as a “sale” and/or “sharing.” You can opt out of this at any time:
Opt out of sale/sharing: use the link (in the footer of every page of this marketing site), reject advertising in , or send a Global Privacy Control signal from your browser — we honor GPC automatically.
Sensitive personal information
We do not use sensitive personal information on this website to infer characteristics about you. (Intake data collected in the product can include health information; that is handled for the law firm under its own instructions, and you can exercise the right to limit its use with that firm.)
Your rights
- Know / access the personal information we hold about you and how we use it.
- Delete personal information we collected from you.
- Correct inaccurate personal information.
- Opt out of the sale or sharing of your personal information.
- Limit the use of sensitive personal information.
- Non-discrimination — we won’t treat you differently for exercising these rights.
To exercise the know, delete, or correct rights, email hello@hiburt.com with “California privacy request” in the subject. We will verify your request (typically by confirming details we already hold) and respond within 45 days. You may use an authorized agent with proof of authorization. Opt-out of sale/sharing does not require verification — use the links above.
Your rights in the EU/UK (GDPR)
If you are in the European Economic Area, the United Kingdom, or Switzerland, the following applies to personal data we control (this website’s data). Burt is the controller for that data; contact us at hello@hiburt.com. For intake data in the product, the law firm is the controller and Burt is its processor.
Legal bases. We rely on your consent for analytics and advertising cookies and for marketing (you can withdraw it any time via Cookie Preferences); on our legitimate interests in running and securing the site and responding to your inquiry; and on legal obligations where they apply.
Your rights. Access, rectification, erasure, restriction of processing, data portability, objection to processing, and withdrawal of consent. You also have the right to lodge a complaint with your local supervisory authority.
International transfers. We and our providers may process data in the United States and elsewhere; where required, transfers are covered by appropriate safeguards such as the EU Standard Contractual Clauses.
To exercise any of these, email hello@hiburt.com. We respond within one month.
Changes and contact
If this policy changes materially, we’ll update the date above and note the change here. Questions or requests: hello@hiburt.com.