Privacy Policy
Effective date: July 1, 2026
This Privacy Policy explains how MAILRABBIT, LLC. ("Blackacre," "we," "us," or "our") collects, uses, stores, and shares information in connection with the Blackacre software service (the "Service") and the website at getblackacre.com.
Blackacre is a business tool used by law firms and their staff. Most of the information processed through the Service is submitted by our customers (law firms) about their own matters and clients. When a law firm uses the Service, that firm controls the underlying transaction information, and we process it on the firm's behalf under our Terms of Service and Data Processing Addendum. If you are an individual whose information appears in a firm's materials, please direct requests about that information to the firm.
1. Information We Collect
Account information. Names, business email addresses, firm name, and login credentials for the people who use the Service.
Customer content. The documents and data our customers submit to the Service, which may include real estate contracts, attorney-review correspondence, title and closing documents, conveyance instruments, and the personal information of the buyers, sellers, and other parties contained in those materials, along with the outputs generated from them.
Connected-service data. When a customer connects Google Calendar, we access data from that account to the extent needed to provide the requested calendar synchronization features, such as reading and writing calendar entries. We request the narrowest access necessary for the features in use.
Usage and device information. Log data, device and browser information, and information about how the Service is used, collected to operate, secure, and improve the Service.
Public-website analytics. On the public pages of getblackacre.com, we use PostHog to understand website traffic, site performance, errors, and whether visitors use links such as scheduling, email, telephone, and sign-in calls to action. Until you make a choice, PostHog does not capture analytics events. If you choose "Continue cookieless," PostHog uses a privacy-preserving, daily rotating server-side identifier and does not store PostHog identifiers in cookies, local storage, or session storage. Cookieless measurement may include the page viewed, referring source, campaign parameters, general browser and device information, Web Vitals, and labels describing the interaction.
If you choose "Use enhanced analytics," PostHog may additionally store a browser identifier and collect masked session replays, heatmaps, clicks on links and buttons, dead or repeated clicks, JavaScript exceptions, feature-flag or experiment exposure, and responses to an occasional website feedback survey. We configure session replay to mask all inputs, exclude the question form and scheduling interface, omit console logs and network bodies, and stop outside the public website. We do not create person profiles or send names, email addresses, telephone numbers, firm names, questions, booking identifiers, customer matter data, or anything typed into a form to PostHog.
2. How We Use Information
We use information to: provide, maintain, and support the Service; extract data from and generate documents for our customers' matters; synchronize deadlines and content to connected calendars and tools; authenticate users and secure the Service; communicate about the Service; comply with law; and detect, prevent, and address fraud, abuse, and security issues.
We do not use customer content to train, fine-tune, or develop any machine-learning or generative model, and we require our service providers to observe the same restriction. We do not sell personal information, and we do not use customer content for advertising.
3. How We Share Information
We share information only as follows:
Service providers (subprocessors). We use a limited set of vendors that process information on our behalf to deliver the Service, under contracts that restrict their use of the information to providing services to us. These include:
- Amazon Web Services (AWS Textract, S3, SNS, and Lambda) — scanned-document analysis and OCR-processing infrastructure.
- OpenAI, Anthropic, and Google — automated analysis of document content to extract and organize information, under zero-retention and no-training terms.
- Vercel and Supabase — application hosting, database, authentication, and file storage.
- ntfy — developer operational alerts.
- PostHog — consent-managed analytics for the public Blackacre website only, including cookieless aggregate measurement and, when accepted, masked website interaction diagnostics; PostHog does not receive customer content through this integration.
A current list of subprocessors is available on request and in our Data Processing Addendum.
Connected services. We exchange data with the third-party services a customer chooses to connect, as directed by the customer.
Legal and safety. We may disclose information if required by law or legal process, or to protect the rights, safety, or property of Blackacre, our customers, or others.
Business transfers. If we are involved in a merger, acquisition, or sale of assets, information may be transferred subject to this Policy.
4. Google User Data — Limited Use
Our use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
Specifically, we access Google user data (such as Google Calendar entries) only to provide and improve the user-facing features of the Service that the user has chosen to use; we do not transfer or sell Google user data for advertising, marketing, or other purposes; we do not use Google user data to train or develop any generalized or non-personalized machine-learning or artificial-intelligence model; and we do not allow humans to read Google user data unless we have the user's affirmative agreement for specific messages, doing so is necessary for security or to comply with law, the data is aggregated and used for internal operations in accordance with applicable requirements, or it is necessary to provide or maintain the features the user has requested.
5. Data Retention
We retain account information for as long as the account is active and as needed for legitimate business and legal purposes. We retain customer content in accordance with our agreement with the customer; customers may export and request deletion of their content as described in the Data Processing Addendum. On termination, we delete or return customer content as set out in that Addendum.
6. Security
We use administrative, technical, and physical safeguards designed to protect information, including encryption in transit and at rest, access controls, and monitoring. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.
7. Your Choices and Rights
Account users may access and update their account information. Depending on your jurisdiction, you may have rights to access, correct, delete, or restrict the processing of personal information. Because most content we process belongs to our law-firm customers, we will refer requests concerning that content to the relevant customer and assist them in responding. To make a request or ask a question, contact us at hello@getblackacre.com.
You can change your public-website analytics choice at any time using the "Privacy choices" control shown on public pages. Choosing "Continue cookieless" prevents PostHog identifiers from being stored in browser cookies, local storage, or session storage and disables session replay, heatmaps, automatic click capture, surveys, experiments, and automatic exception capture. Browser privacy tools and content blockers may also block analytics requests.
8. International Users
The Service is operated in the United States and intended for use by United States law practices. If you access the Service from outside the United States, you understand that information will be processed in the United States.
9. Changes to This Policy
We may update this Policy from time to time. We will post the updated Policy with a new effective date and, for material changes, provide reasonable notice.