LedesFix Convert your invoice

Privacy Policy

Effective date: September 8, 2026

1. Introduction

Cubist Labs LLC (“LedesFix,” “we,” “us,” or “our”) operates the LedesFix service and the website at ledesfix.com. This Privacy Policy describes how we collect, use, disclose, and protect information when you use our website, create an account, or use the LedesFix service (collectively, the “Service”).

LedesFix is a web service for lawyers and law-firm staff who bill corporate clients through e-billing portals. It turns a billing spreadsheet you upload into a LEDES invoice file that you submit to your client’s portal yourself. This Privacy Policy covers both visitors to our website and users of the Service.

2. Information We Collect

We collect only the information necessary to provide, maintain, and secure the Service.

Account Information

When you create an account or sign in, we collect:

  • Profile information. Your email address and, if you use Google or Microsoft sign-in, the name and profile photo URL that provider supplies.
  • Session data. Session tokens, the IP address and browser (user agent) you signed in from, and sign-in timestamps, for authentication and security.

If you choose a password, we store a password hash rather than the password itself. We also use expiring email links to verify your email address, sign you in, and let you set or reset your password.

Billing Data

When you use the Service, we store:

  • The spreadsheet you upload. Stored as a file. It typically holds dates, hours, narratives describing legal work, matter numbers, client and matter names, timekeeper names, rates, and amounts.
  • Your client profile. The facts you enter for each client: the client’s name, which e-billing portal it uses, your firm’s ID (often an EIN), the client’s portal ID, the invoice description, default task and activity codes, and your timekeeper roster (each person’s name, portal ID, classification, and hourly rate).
  • The LEDES file we produce. Stored as a file.
  • Preparation records. A record of how your spreadsheet’s rows became invoice lines, which includes the narrative text and matter names from those rows.

We treat all of this as your confidential information.

Website Usage Data

When you visit ledesfix.com, we may collect:

  • Log data. IP address, browser type, operating system, pages visited, and timestamps. Sign-in, sign-out, failed sign-in, and other account events are also logged with your email address and IP address.

Communications

If you contact us (for example, via email or a support request), we collect the information you provide in those communications.

3. How We Use Information

To Provide and Operate the Service

  • Authenticate users and maintain sessions
  • Read your spreadsheet and produce your LEDES file
  • Keep your client profile so later invoices for that client start filled in

AI Processing

When your spreadsheet’s layout is not one the Service already knows, its contents and the client profile facts needed to interpret it are processed by AI systems to work out which columns hold which facts. See Section 5 for details.

To Maintain Security and Integrity

  • Detect and prevent fraud, abuse, and unauthorized access
  • Investigate security incidents and keep records of sign-ins

Service Improvement

We may use aggregated or de-identified data (that cannot reasonably identify you) to understand usage patterns and improve reliability and product experience. We do not use your data for advertising.

Communications

  • Contact you about changes to the Service, this policy, our Terms of Use, or a security matter
  • Respond to support requests

Compliance

Comply with legal obligations, enforce our Terms of Use, and protect the rights, safety, and property of our users and Cubist Labs LLC.

4. Legal Basis for Processing

If you are located in the European Economic Area (EEA), United Kingdom, or another jurisdiction that requires a legal basis for processing personal data, we rely on the following:

  • Contract performance. Processing data as necessary to provide the Service you have requested.
  • Legitimate interests. Improving the Service, ensuring security, and preventing fraud, where these interests are not overridden by your rights.
  • Legal obligation. Complying with applicable laws and regulations.
  • Consent. Where you have given specific consent for a particular use (for example, when you sign in with Google or Microsoft), which you may withdraw at any time.

5. Artificial Intelligence and Data Processing

We may use AI models from third-party providers to read spreadsheets whose layout the Service does not already know. When we do, here is how it works:

  • AI providers. Google (Gemini), Anthropic (Claude), and OpenAI (GPT). The active provider may change over time. We will update this list if our providers change.
  • What is sent. When your spreadsheet’s layout is not one the Service already knows, the contents of the spreadsheet (which can include narratives, names, matter numbers, and amounts) and the saved client profile facts needed to interpret it are sent to an AI provider to work out which columns hold which facts and to prepare the rows for the invoice.
  • No model training. We do not use your data to train AI models, and we use AI services only under terms that prohibit the provider from training on your data.
  • Data processing agreements. We maintain data processing agreements with our AI providers that govern their handling of data.
  • Provider changes. If we intend to use a new AI provider whose commercial terms do not include a prohibition on using customer data for model training, we will notify affected users in advance and obtain consent before transmitting data to that provider.

6. Google API Services User Data Policy

LedesFix uses the information Google provides at sign-in (your name, email address, and profile photo) only to create and identify your account. We request no other access to your Google account. LedesFix’s use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

We use the information Microsoft provides at sign-in in the same way, and we request no other access to your Microsoft account.

7. Information Sharing and Disclosure

We do not sell, rent, or trade personal information. We have not sold personal information in the preceding 12 months.

We share information only as necessary to provide and support the Service:

  • AI providers. Google (Gemini), Anthropic (Claude), and OpenAI (GPT) for reading spreadsheets whose layout the Service does not already know. Data is sent only as needed to read your spreadsheet.
  • Cloud hosting. Railway for application hosting and infrastructure.
  • File storage. Cloudflare R2 for the spreadsheets you upload and the LEDES files we produce.
  • Error tracking. Honeybadger for error monitoring. We filter sensitive fields from what is sent.
  • Sign-in. Google and Microsoft, which authenticate you and provide your basic profile.
  • Account email. Resend delivers verification, sign-in, and password emails using your email address and the message contents.

Each service provider is bound by agreements that require them to protect data and restrict their use of it to providing services to us.

We may also disclose information when required by law, subpoena, or court order, or when we reasonably believe disclosure is necessary to protect our rights, your safety, or the safety of others.

In the event of a merger, acquisition, restructuring, or sale of assets, information may be disclosed to advisors and successor entities subject to appropriate confidentiality protections.

8. Who at LedesFix Can See Your Data

Authorized personnel may access your billing data to troubleshoot a failed conversion or to provide support you ask for. Access is limited to the people who operate the Service and is used only to provide it.

9. Data Retention

  • Account and billing data. Your account information, uploaded spreadsheets, client profiles, and the LEDES files we produce are kept while your account is open.
  • Backups. Backups are used only for business continuity. Backup copies are removed as they age out on their normal rotation schedule.
  • Log data. Server logs are kept by our hosting provider for a limited time for operational and security purposes.

You can delete an invoice, with its uploaded spreadsheet and LEDES file, from your Invoices list. To delete a client profile or your account, email us at support@ledesfix.com. When an account is closed or we receive a verified deletion request, we delete data from production systems within 90 days. We may retain information as reasonably necessary to comply with law, resolve disputes, and enforce our agreements.

10. Data Security

We use reasonable administrative, technical, and organizational safeguards designed to protect information. Data is encrypted in transit. Stored files are encrypted at rest and are private to the account that uploaded them, and the identifiers on your client profiles are encrypted in the database. Passwords are stored as hashes, and email sign-in links expire after use or after 15 minutes. We filter sensitive fields from logs and error reports.

While we take reasonable steps to protect information, no method of transmission or storage is 100% secure, and we cannot guarantee absolute security. You are responsible for maintaining the security of your password, email account, and any Google or Microsoft account you use to sign in.

11. Your Rights

Depending on your location, you may have the following rights regarding your personal information:

  • Access. Request a copy of the personal information we hold about you.
  • Correction. Request that we correct inaccurate or incomplete information.
  • Deletion. Request that we delete your personal information.
  • Portability. Request your data in a structured, machine-readable format.
  • Restriction. Request that we limit how we process your data.
  • Objection. Object to processing based on legitimate interests.
  • Withdrawal of consent. Where processing is based on consent, withdraw consent at any time.

To exercise any of these rights, contact us at support@ledesfix.com. We will respond to verified requests within 45 days.

Your clients are not our customers. People whose information appears in your billing data (your clients, your timekeepers, and anyone named in a narrative) should direct privacy requests to you. We process that data as a service provider on your behalf, and we will help you respond to such requests.

12. California Privacy Rights (CCPA/CPRA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA):

  • Right to know. You may request the categories and specific pieces of personal information we have collected about you in the past 12 months.
  • Right to delete. You may request deletion of your personal information, subject to certain exceptions.
  • Right to correct. You may request correction of inaccurate personal information.
  • Right to non-discrimination. We will not discriminate against you for exercising your privacy rights.
  • Right to opt out of sale. We do not sell your personal information. We do not share your personal information for cross-context behavioral advertising.

To submit a rights request, email support@ledesfix.com.

13. International Data Transfers

The Service is hosted in the United States. If you access the Service from outside the United States, your information will be transferred to and processed in the United States.

14. Cookies and Tracking

The Service uses essential cookies required to maintain your session and authenticate your account. These cookies are strictly necessary for the Service to function. We do not currently use advertising cookies, analytics cookies, or third-party tracking cookies.

If we add analytics or other non-essential cookies in the future, we will update this section and provide appropriate notice and controls.

15. Children’s Privacy

The Service is not intended for children under the age of 18. We do not knowingly collect account information from anyone under 18, and we will delete such information if we discover it. Contact support@ledesfix.com if you believe a child has provided personal information.

16. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. If we make material changes, we will notify you by email or by posting a notice on the Service at least 30 days before the changes take effect. The “Effective date” at the top of this page indicates when this policy was last updated.

17. Contact Us

If you have questions about this Privacy Policy or wish to exercise your privacy rights, contact us at:

Cubist Labs LLC
720 Seneca Street Ste 107 #759
Seattle, WA 98101
Email: support@ledesfix.com

Please also review our Terms of Use.