Folio

Privacy Policy

Last updated: 14 June 2026

1. Who we are

Folio ("we", "us", "our") operates the Folio platform at folio.konanspade.com. We are committed to protecting the privacy of our users and their clients.

2. Information we collect

We collect the following categories of information:

  • Account information: name, email address, and role when your administrator grants you access to the platform.
  • Firm data: practice areas, lawyer profiles, client names, work highlights, contacts, and referee details that your firm enters into the platform.
  • Microsoft 365 data (if connected): email and calendar metadata — sender/recipient/attendee addresses, subject lines, a short body preview, and timestamps — used to build your firm’s private relationship graph. We do not ingest full email or meeting bodies, or attachments.
  • Enrichment data: public professional information about your contacts (job title, employer, LinkedIn, work history) obtained from third-party providers and public web sources — see section 5.
  • Access requests: name, email, firm name, and any message you provide when requesting access through our landing page.
  • Usage data: server logs including IP addresses, browser type, and pages visited, collected automatically for security and service improvement.

3. How we use your information

  • To provide and operate the Folio platform.
  • To generate, refine, and manage legal directory submissions on your behalf.
  • To build relationship-intelligence (who-knows-who) within your firm from connected mailboxes.
  • To send transactional emails (access confirmations, draft notifications, review requests).
  • To respond to access requests and support enquiries.
  • To improve the platform and fix issues.

4. Microsoft 365 connection

If your firm connects Microsoft 365, we read mailbox and calendar metadata for provisioned users to map professional relationships. We store sender/recipient/attendee addresses, subjects, a short preview, and timestamps — never full message or meeting bodies, and never attachments. The relationship graph is strictly per-firm and is never shared across firms. A firm administrator can disable an individual user’s sync, and disconnecting Microsoft 365 stops further ingestion.

5. Contact enrichment & shared knowledge base

When enabled, Folio enriches your contacts with public professional information. To do this we send a contact’s business email address (and, for the optional AI lookup, their work domain) to third-party enrichment subprocessors — Apollo, People Data Labs, Proxycurl, Hunter — and to our AI relay, which performs a public web search. We do not send your firm’s private relationship data (mailbox/calendar history, relationship scores, or notes) to any of them.

Verified public facts may be cached in a shared knowledge baseso that repeated lookups across the platform are cheaper and faster. This cache contains only public, broker-, and AI-sourced professional facts and surface-level identity — the same kind of business-contact data these providers already publish. It carries no firm attributionand no relationship data: it never reveals that a particular firm knows or works with a person. Our lawful basis for this processing of business-contact data is legitimate interest.

Enrichment is enabled by default; a firm administrator can disable it entirely, and it never runs for a contact (or organisation) marked do-not-enrich. You can opt a contact out at any time, and an erasure request removes the person’s entry from the shared knowledge base.

6. AI-assisted features

Our platform uses AI to assist with drafting submission narratives and matter descriptions, and to perform the optional contact research described above. Data processed by AI features is used solely to deliver those features and is not used to train third-party AI models.

7. Data sharing

We do not sell your data. We share information only with:

  • Infrastructure providers (hosting, email delivery) necessary to operate the service.
  • AI service providers for generating submission content and contact research, subject to their data processing agreements.
  • Enrichment subprocessors (Apollo, People Data Labs, Proxycurl, Hunter) for contact enrichment, as described in section 5.

8. Data retention

We retain your firm data, submissions, and relationship metadata for as long as your account is active or as needed to provide the service. Access request data is retained for 12 months. You may delete a contact — including its interactions and its shared-cache entry — from within the platform at any time, or request deletion by contacting us.

9. Security

We use industry-standard measures to protect your data, including encrypted connections (TLS), encryption at rest for credentials and access tokens, secure authentication via Microsoft Entra ID, and role-based, per-firm access controls within the platform.

10. Your rights

You may request access to, correction of, or deletion of your personal data. Authorised firm users can erase a contact directly in the platform, which also removes the person from the shared knowledge base. For any other request, contact us at info@konanspade.com.

11. Changes

We may update this policy from time to time. Material changes will be communicated via the platform or email.

12. Contact

For privacy-related enquiries, contact us at info@konanspade.com.