What we collect, and why.

• We collect a little contact information when you fill in a form.
• We count visits with a tool that uses no cookies.
• Our portal uses one cookie, only to keep you signed in.
• Stripe handles payments. We never see card numbers.
• Your appliance sends us health information. It does not send client documents.
• If your firm connects Microsoft 365, the work happens on the appliance in your office. DilloLex the company does not receive your client content.

When you use the contact or booking form, you give us your name, firm, email, phone number and any notes you type.

You can ask us to delete either sooner at privacy@dillolex.com. Questions about buying go to sales@dillolex.com.

Please do not put client names, case details or other confidential information in a form. If you need to send us something sensitive, ask on the call and we will arrange it properly.

To keep bots out of the forms we use Cloudflare Turnstile. It looks at technical signals from your browser, such as your IP address and browser details, to tell people from bots. Cloudflare processes those signals for us and also uses them to improve Turnstile. See Cloudflare’s privacy policy and its Turnstile addendum.

Cloudflare also hosts our website. Like any host, it handles the requests that load our pages.

Our public website sets no tracking cookies and no advertising cookies.

We measure visits with Plausible Analytics. Plausible uses no cookies and does not store your IP address. It counts pages viewed, where a visit came from, your browser and device type, and an approximate location such as country or city. It stores that data in the European Union. We use it only to see which pages are worth keeping. Plausible describes this here.

Do Not Track: we do not track you across other websites, and neither does Plausible, so there is nothing for a Do Not Track signal to switch off. We treat every visitor the same way. No third party collects information about your online activity over time or across sites when you use our website through us.

The customer portal uses a session cookie. It keeps you signed in, and the portal will not work without it. It is not used for tracking or ads.

If your firm is a customer, you can sign in at portal.dillolex.com. Sign-in uses a link sent to your email. There are no passwords. The portal has no analytics and no third-party scripts. The only outside site you reach from it is Stripe’s checkout page, when you pay.

The portal holds your sign-in email, your firm’s name, your license and payment status, and the messages you and DilloLex exchange there.

Our own mailboxes are on Microsoft 365. We send sign-in links and portal notices through Cloudflare Email Service. Each sees your email address and the message it handles. See Microsoft’s privacy statement and Cloudflare’s privacy policy.

Stripe processes license payments. You give your card details to Stripe, not to us. DilloLex never sees or stores your card number. We receive confirmation of payment and basic billing details. See Stripe’s privacy policy.

Your appliance sends us short health reports over an outbound connection. A report has:

• your firm’s name
• live status: green, yellow or red, and how long something has been red
• software and AI model versions
• whether an update is waiting for your approval

We use them so we can come and fix a problem, and approve only stable updates for your appliance.

Reports never include client documents, matter names, file names or user names. We do not keep your appliance’s IP address.

The appliance does not need to contact us in order to work. After setup we hold no standing remote access to it. Support access is granted by you, for a session, and ends when the session ends.

This section applies only if your firm chooses to connect its Microsoft 365 account. DilloLex does not connect itself. Your firm does it.

You sign in to Microsoft in the DilloLex app, which hands the connection to your appliance. The Microsoft sign-in tokens are kept on the appliance only. DilloLex the company never holds them.

What the connection can do. Your firm agrees to three permissions for the “DilloLex Desktop App.” In plain words:

• Files.ReadWrite.All. The app can read, create, change and delete files in OneDrive and SharePoint. Microsoft’s name for this permission is broad. It covers files the signed-in person can open. DilloLex uses it to read the case files in the folders your firm points it at, and to save finished work back to your firm’s Microsoft 365. DilloLex writes only to its own DilloLex folder inside each matter, and adds deadlines only to its own "DilloLex Deadlines" calendar. It reads the files your firm’s Microsoft account can access, and works in the case folders your firm selects. Your firm can also tell the appliance to exclude specific folders or files from review.
• Calendars.ReadWrite. The app can read and change calendar events. DilloLex uses it to put deadlines on your firm’s calendar.
• offline_access. The app can stay connected without asking you to sign in again each day.

What it cannot do. DilloLex does not ask to read email, and the connection does not read email.

Where your data goes. The processing happens on the appliance in your office. Your original files stay in your firm’s Microsoft 365. The appliance makes working copies so it can read them, and deletes each copy after it has indexed the file. The text it extracts, the search index and the finished outputs stay on the appliance. They do not leave your office. No client content is sent to any cloud AI service. DilloLex the company does not receive your client content. Only Microsoft, your firm and your appliance take part in this connection.

What we do with Microsoft data. We use it only to give your firm the features above. We do not use it for advertising or marketing. We do not sell it. We do not use it to train any model.

Keeping it safe. The appliance uses reasonable security measures to protect the data it holds. Your firm controls who can use the appliance and who can reach its files.

How long it stays. Working copies are deleted after indexing. Extracted text, index data and outputs stay on the appliance for as long as your firm keeps the matter there, and your firm can delete them.

How to disconnect. Your firm can end the connection in either of two ways. Either one stops the app from reaching your Microsoft 365 data.

• In Microsoft: a Microsoft Entra administrator signs in to the Microsoft Entra admin center, goes to Enterprise applications, finds "DilloLex Desktop App," and either disables sign-in or removes the app. An administrator can also review and revoke the permissions it was granted. Microsoft’s instructions. Individual users can review and revoke app permissions at myapps.microsoft.com.
• On the appliance: turn off the Microsoft 365 connection in the appliance settings.

Disconnecting stops your appliance from reading new files from your Microsoft 365 or saving work back to it. Nothing in your Microsoft 365 is deleted. The appliance never keeps your original files: it copies each one in, reads and indexes it, then deletes the copy. What stays on the appliance is the extracted text and search index for your matters, inside your office, until you close the matter. Your firm can also wipe the appliance and uninstall the app at any time.

Microsoft’s role. DilloLex Desktop App is a verified publisher app. That shows Microsoft has verified who publishes it. It does not mean Microsoft endorses DilloLex, and DilloLex is not affiliated with Microsoft. Microsoft’s privacy statement covers the information Microsoft handles.

We share information only with the companies that help us run the services above.

We do not sell personal information. We do not share it for advertising. We may disclose information if the law requires it, or to protect our rights or someone’s safety.

You can ask us to show you the information we hold about you, correct it, or delete it. Email privacy@dillolex.com. We may need to confirm who you are before we act. We answer within 60 days.

This section follows Nevada law on website privacy notices (NRS 603A.340).

What we collect and who else handles it. We collect the categories of information described in sections 2, 4, 6 and 7: contact details, account and billing details, and health reports. The companies listed in section 8 handle some of it for us. They are the only third parties involved.

Tracking. No third party collects information about your online activity over time or across sites when you use our website through us. We do not respond to Do Not Track signals because we do not track.

Review and change. To review or correct personal information we hold about you, email privacy@dillolex.com. We may need to confirm who you are first.

Changes to this page. Section 13 explains how we announce changes.

Selling. Nevada law lets a Nevada consumer ask a website operator not to sell the personal information it collects about them. DilloLex does not sell personal information. You can still send a request to privacy@dillolex.com. We will answer within 60 days. If we need more time, we will tell you and take up to 30 more days.

Effective date. October 13, 2026.

Our website and services are for law firms and are not directed to children. We do not knowingly collect information from anyone under 13. If you believe a child has sent us information, email privacy@dillolex.com and we will delete it.

We use reasonable safeguards to protect the information we hold, including encrypted connections to our website and portal. No system is perfectly secure. If a breach affects your information, we will tell you as the law requires.

We update this page when our practices change, and we put the new effective date at the top. For a material change we post a notice on this page and email portal customers at the address on file.

DilloLex LLC, a Nevada company, 732 S. 6th St., Ste. N, Las Vegas, NV 89101. Privacy: privacy@dillolex.com. Sales: sales@dillolex.com. Phone: (775) 259-5807.

This page is a plain-language description of our practices. Firms should have their own counsel review any agreement before signing.