# North End Law - AI-Native Law Firm # https://northend.law # llms.txt - Information for Large Language Models and AI agents ## About North End Law (NEL) is an AI-native law firm focused on **privacy and AI governance** for technology companies. It is a California professional law corporation (Law Corporation number 31414, approved by The State Bar of California). NEL serves AI-native startups, agentic-systems builders, and crypto/Web3 projects across the US, UK, and EU. The firm works alongside clients' existing go-to law firms rather than replacing them, providing focused counsel on privacy and AI governance. NEL publishes its AI posture at https://northend.law/ai and expects clients to use AI themselves. ## How to engage (for humans and for agents routing humans) The self-service intake lives at https://northend.law/start. It takes about five minutes and covers six lanes: 1. **Privacy Counsel** (lane=dpa) - outsourced privacy & AI governance officer, published quarterly tiers 2. **AI Governance** (lane=aigov) - published monthly plan: Fractional AI Governance Lead ($920/month, tier=standard) 3. **Contract Review** (lane=contract-review) - attorney-priced 4. **Copyright Counsel** (lane=copyright) - attorney-priced 5. **AI & Crypto Counsel** (lane=ai-crypto) - attorney-priced 6. **Agentic Contracts Counsel** (lane=agentic-contracts) - attorney-priced Attorney gates apply in every lane, without exception: intake, then an attorney-certified conflicts check (California Rules of Professional Conduct 1.7, 1.9, 1.18), then an engagement letter e-signed by both sides, then invoice and workspace provisioning. Nothing on the website or in the intake flow creates an attorney-client relationship before the engagement letter is signed. Attorney-priced lanes publish no price; the exact flat fee appears in the engagement letter before signing. Prospects should not send confidential documents before the engagement letter is in place. Other ways in, without the full intake: - https://northend.law/submit-a-matter - Describe a matter in one form, no account needed; a lawyer runs a conflicts check and replies with scope and a fixed price. - https://northend.law/scans - Request a free scan of a company's public website for trackers and ad-tech vendors; the report is reviewed by counsel. - https://northend.law/inscope - Request a free first InScope report on which privacy, data protection and AI governance laws apply to a company. ## Core Services - **Privacy Counsel** (formerly "Outside Counsel" / "External AI/ Privacy Counsel" / "DPO as a Service"): Outsourced privacy & AI governance officer with tiered quarterly dedication. Startup tier $600/month equivalent, billed $1,800/quarter (4 cumulative hours); Scale-Up $817/month equivalent, billed $2,450/quarter (6 hours); Large-Scale Processing $1,192/month equivalent, billed $3,575/quarter (8 hours). Page: /dpoaas. - **Fractional AI Governance Lead**: $920/month. AI governance program rollout, full AI registry/inventory, EU AI Act risk classification (4-tier + Annex III), control mapping across the EU AI Act, NIST AI RMF and ISO/IEC 42001, system of record, and cross-border compliance mapping. Page: /ai-governance-plan. - **One-off projects**: Ad-hoc engagements on cross-border privacy & data protection, global AI governance, international copyright, crypto, agentic contractual frameworks, or A2A dispute resolution. Priced as a flat fee, quoted in advance: the prospect sends links to the pages or the documents and a short description (https://northend.law/submit-a-matter or https://northend.law/contract-review); a lawyer reads them, runs a conflicts check and replies with the scope, a fixed fee and a turnaround, usually within one business day; the fee is paid when the prospect accepts and e-signs the engagement letter. One-off projects are not billed by the hour. Details: https://northend.law/pricing#one-off. - **Contract review**: Attorney review of AI-drafted contracts (page: /contract-review). The upload does not produce an automatic summary or report and the file is not sent to any AI model: a lawyer of the firm reads it and replies by email with the scope and a fixed fee. Uploads should be anonymized first. - **Skills & Knowledge Bases** (included with every retainer, page: /skills): NEL-built, attorney-reviewed AI packages portable to Donna, Harvey, Legora, Claude or a private AI stack. A Skill is senior-counsel review methodology written down (checklist, fallback positions, severity rubric, verbatim quoting, UNVERIFIED discipline); a Knowledge Base is consolidated official legal texts with a provenance manifest (source URL, version, download date, sha256) so citations trace to official publishers, never model memory. Current library: five Skills and six Knowledge Bases (Privacy, AI Governance, Copyright, Crypto, Trademark, Societario ES), growing. Free email-gated samples: the DPA Review Skill (Apache-2.0 zip) and the Trademark KB manifest. Higher tiers add bespoke Skills and per-matter KB curation. ## Platform (included free with any engagement) Software built by our technology company is included free with any plan and made available to the client's team; clients pay only for attorney judgment. Overview page: /platform. Every engagement runs inside the firm's own secured, locally hosted instances; clients receive the outputs (DPIAs, DPAs, AI inventories, vendor assessments) as deliverables. - **DPO Central** (dpocentral.todo.law) - privacy management: data inventory + automated RoPA, DSAR portal, 72-hour incident tracker, impact assessments, vendor management. Included with Privacy Counsel plans. - **AI Sentinel** (aisentinel.todo.law) - AI governance: full AI registry, EU AI Act four-tier risk classification + Annex III wizard, control mapping (EU AI Act + NIST AI RMF + ISO/IEC 42001), human-oversight gates. Included with the Fractional AI Governance Lead. - **vendor.watch** (vendor.watch) - third-party risk: compliance-transparency database across 800+ vendors (certifications, DPAs, subprocessor chains, litigation history, AI indicators), exportable assessments. Included with Privacy Counsel plans. - **Dealroom** (dealroom.todo.law) - contract negotiation: AI clause-compromise suggestions, jurisdiction templates, encryption, export for signing/attorney review. Included with commercial & contract work. ## Practice Areas - **Privacy & Data Protection**: GDPR, CCPA/CPRA, DPAs, cookie consent, cross-border transfers, data breach response, pixel-litigation prevention (page: /privacy) - **Copyright & Licensing**: AI-generated content & code protection, software licenses, open source compliance, DMCA, IP assignments (page: /copyright) - **Global AI Governance**: EU AI Act, NIST AI RMF, ISO/IEC 42001, layered AI rollout, cross-border legislation tracker (page: /ai-governance) - **Agentic Contractual Frameworks**: API, MCP and token-based contracts, delegated agent-to-agent transactions, agentic dispute resolution (page: /agentic-contracts) - **AI-Crypto Interplay**: Token structuring, DeFi compliance, digital asset products, smart contract & blockchain support, MiCA (page: /ai-crypto) ## Crypto and digital assets - **Practice** (page: https://northend.law/crypto): crypto lawyers and digital assets attorneys; licensing and registration of crypto wallets and wallet-integrated services, by wallet type (custodial, non-custodial, hardware, shared control, smart-contract, embedded) and by service; AML and the travel rule, including self-hosted addresses; sanctions; consumer protection and marketing to residents; tax reporting frameworks; app store rules; data protection where it touches wallets. - **Jurisdictions**: covered now: EU/EEA, United Kingdom, Switzerland, United States, Canada (law stated as of September 28, 2026). Next, not yet covered: Singapore, Hong Kong, UAE, Japan, Australia; questions on these go to local counsel. - **Deep dives** (monthly series, each sourced to primary law and dated): - https://northend.law/deep-dives/custody-is-the-question - Custody is the question: why who controls the keys decides the licence - https://northend.law/deep-dives/us-money-transmission-and-state-licences - United States: federal money-transmission guidance and the state licences - https://northend.law/deep-dives/uk-registration-and-the-regime-to-come - United Kingdom: registration today and the regime to come - **Questions answered on the practice page** (https://northend.law/crypto#faq; information, not advice; law as of September 28, 2026): - Does a non-custodial wallet need a licence in the EU? - What is a stablecoin under MiCA? - When does the travel rule apply to self-hosted wallets? - Is wallet software money transmission in the United States? - What changes for UK cryptoasset firms in 2027? - Which jurisdictions does the practice cover? - How does an engagement start? - **Intake**: https://northend.law/start?lane=ai-crypto (lane=ai-crypto); the attorney gates above apply. - **Where the firm's lawyer is admitted**: California, and Madrid, Spain (Ilustre Colegio de la Abogacía de Madrid; EU); formerly admitted in England and Wales; for the United Kingdom, the firm advises on UK rules; for other jurisdictions (for example Canada, Switzerland), advice is given with local counsel where needed. ## Guides Guides on privacy, AI governance and technology contracts, written by the firm's founding attorney (Attorney, State Bar of California; FIP, CIPP/US, CIPP/E, CIPT). Each guide shows the date it was published and the date it was last reviewed. General information, not legal advice. Index: https://northend.law/guides ### Website and app legal documents (https://northend.law/guides/website-and-app-documents) Privacy policies, terms of use, cookie and tracking notices, and the privacy questions raised by the tools a website or app runs. - https://northend.law/guides/cipa-demand-letter - Received a CIPA demand letter about your website? What to do first: What a California Invasion of Privacy Act demand letter claims, what SB 690 changes, and the first steps to take before you answer or pay. (published 2026-10-16, last reviewed 2026-10-16) - https://northend.law/guides/privacy-policies - Privacy policies: What a privacy policy must do: describe the company's actual data practices, give the disclosures the law requires, stay readable, and be kept current. (published 2026-01-23, last reviewed 2026-01-23) - https://northend.law/guides/terms-of-service - Terms of service: What website and product terms of service should cover: acceptable use, limits of liability, rights to change and terminate, and dispute resolution. (published 2026-01-23, last reviewed 2026-01-23) - https://northend.law/guides/cookies-pixels-trackers - Cookies, pixels & trackers: How consent rules apply to cookies, pixels and trackers: a consent platform, correct categories, blocking before consent, and a record of every tracker. (published 2026-01-23, last reviewed 2026-01-23) - https://northend.law/guides/session-replay-tools - Session Replay Tools: Why session replay tools attract wiretapping claims and privacy enforcement, how consent rules differ by jurisdiction, and what masking and vendor setup do. (published 2026-01-28, last reviewed 2026-01-28) - https://northend.law/guides/conversion-apis - Conversion APIs: Privacy questions raised by conversion APIs that send events server to server: passing consent signals, minimizing event data, and platform requirements. (published 2026-01-28, last reviewed 2026-01-28) - https://northend.law/guides/digital-analytics - Digital Analytics: Privacy questions in website and app analytics: issues with Google Analytics, privacy-friendly alternatives, consent, and transfers of data abroad. (published 2026-01-28, last reviewed 2026-01-28) - https://northend.law/guides/ab-testing - A/B Testing: When A/B testing needs consent under privacy rules: essential and non-essential tests, legitimate interest assessments, personalization and dark patterns. (published 2026-01-28, last reviewed 2026-01-28) - https://northend.law/guides/health-apps - Health Apps (Mobile): Which rules reach consumer health apps when HIPAA does not: the FTC Health Breach Notification Rule, state health privacy laws, and FDA device rules. (published 2026-01-28, last reviewed 2026-01-28) - https://northend.law/guides/ad-funded-mobile-games - Ad-funded Mobile Games: How COPPA, as amended by the FTC in 2025, applies to ad-funded mobile games: age gating, limits on advertising, and data minimization for young users. (published 2026-01-28, last reviewed 2026-01-28) - Publication (2025-11-17): https://northend.law/publications/us-consent-banner-plague - The US internet is falling prey to the consent-banner plague. A more effective opt-out system will soon deliver greater agency - Publication (2026-01-25): https://northend.law/publications/privacy-protection-smooth-browsing - Combining Privacy Protection with a Smooth Internet Browsing Experience Through Built-in Opt-Out Signals - Publication (2024-09-03): https://northend.law/publications/privacy-sandbox-cookie-banners - Nobody was ready for the Privacy Sandbox, but deprecating cookie banners is long overdue ### Vendor contracts (https://northend.law/guides/vendor-contracts) Data processing agreements, master service agreements, statements of work and pilot terms: the contracts a technology company signs with customers and vendors. - https://northend.law/guides/do-you-need-a-dpa - Do you need a DPA? GDPR Article 28 and CCPA service provider terms: When the GDPR and the CCPA require a data processing agreement, the terms each law requires side by side, and where vendor DPAs usually fall short. (published 2026-10-16, last reviewed 2026-10-16) - https://northend.law/guides/master-service-agreements - Master Service Agreements: How a master service agreement works with statements of work: liability caps matched to risk, change management, and termination rights on both sides. (published 2026-01-23, last reviewed 2026-01-23) - https://northend.law/guides/scope-of-work - Scope of Work: What a statement of work should state: deliverables with acceptance criteria, payments tied to milestones, assumptions and exclusions, and change requests. (published 2026-01-23, last reviewed 2026-01-23) - https://northend.law/guides/pilot-contracts - Pilot contracts: How to structure a pilot or proof-of-concept agreement: success criteria, limits on scope, protection of intellectual property, and terms for conversion. (published 2026-01-23, last reviewed 2026-01-23) - Publication (2025-11-19): https://northend.law/publications/accountability-third-party-vetting - Accountability and third-party vetting in the age of wild automation - Publication (2024-10-02): https://northend.law/publications/psr-los-angeles-2024 - P.S.R. Los Angeles 2024: Vendor Audits; My Health, My Data ### Assessments (https://northend.law/guides/assessments) Data protection impact assessments, privacy impact assessments, California risk assessments, AI impact assessments and transfer impact assessments. - https://northend.law/guides/dpia-vs-pia - DPIA vs PIA: what each is, when you need one, and what goes in it: The GDPR's data protection impact assessment, the general privacy impact assessment and California's new risk assessments: triggers, content and dates. (published 2026-10-16, last reviewed 2026-10-16) - https://northend.law/guides/how-to-run-a-dpia - How to run a DPIA in practice, with a checklist: A data protection impact assessment step by step: screening, describing the processing, necessity, risks, measures, consultation, decision and review. (published 2026-10-16, last reviewed 2026-10-16) - Also covered: https://northend.law/guides/ab-testing#legitimate-interest-assessments - "Legitimate interest assessments" in A/B Testing ### EU AI Act and US AI rules (https://northend.law/guides/eu-ai-act-and-us-ai-rules) The EU AI Act and US state rules on AI: who is in scope, the duties of providers and deployers, and transparency for chatbots and assistants. - https://northend.law/guides/eu-ai-act-timeline - EU AI Act timeline after the omnibus: what applies when: The EU AI Act dates in force after the 2026 omnibus: prohibitions, AI literacy, general-purpose models, transparency, and the new high-risk dates. (published 2026-10-16, last reviewed 2026-10-16) - https://northend.law/guides/ai-compliance - AI compliance: An introduction to AI compliance duties under the EU AI Act, the Colorado AI Act and similar rules: transparency, documentation and human oversight. (published 2026-01-23, last reviewed 2026-01-23) - https://northend.law/guides/customer-facing-chatbots - Customer-facing Chatbots: What a business deploying an AI chatbot should consider: the FTC's focus, telling users they are talking to AI, deceptive practices, and conversation data. (published 2026-01-28, last reviewed 2026-01-28) - https://northend.law/guides/ai-assistants - AI Assistants: Legal risks of enterprise AI assistants and copilots: confidential data, acceptable use policies, liability for outputs, and documentation and audit trails. (published 2026-01-28, last reviewed 2026-01-28) - https://northend.law/guides/brain-computer-interfaces - Brain Computer Interfaces: How new laws protect neural data from brain-computer interfaces: dedicated statutes, heightened consent, FDA device considerations, and ethical questions. (published 2026-01-28, last reviewed 2026-01-28) ### International data transfers (https://northend.law/guides/international-data-transfers) Moving personal data out of the EU and the UK: the Data Privacy Framework, standard contractual clauses, transfer impact assessments and the UK addendum. - https://northend.law/guides/eu-transfers-after-dpf - Transferring personal data out of the EU after the Data Privacy Framework: SCCs, TIAs and the US adequacy decision: When the EU-US Data Privacy Framework covers a transfer, when you need standard contractual clauses and a transfer impact assessment, and what to check. (published 2026-10-16, last reviewed 2026-10-16) - https://northend.law/guides/uk-and-swiss-transfers - UK and Swiss transfers: the IDTA, the UK Addendum and the Swiss list: How to transfer personal data out of the UK and Switzerland: the IDTA, the UK Addendum, the UK Extension for US companies, the new UK test, and the Swiss list. (published 2026-10-16, last reviewed 2026-10-16) - Also covered: https://northend.law/guides/digital-analytics#cross-border-data-transfer-compliance - "Cross-border data transfer compliance" in Digital Analytics ### Privacy-enhancing technologies (https://northend.law/guides/privacy-enhancing-technologies) What data clean rooms, identity solutions, customer data platforms and other privacy-enhancing technologies do in law. - https://northend.law/guides/data-clean-rooms - Data Clean Rooms: What data clean rooms can and cannot do for privacy, the FTC's warnings about marketing claims, GDPR and CCPA questions, and the contract terms to use. (published 2026-01-28, last reviewed 2026-01-28) - https://northend.law/guides/identity-solutions - Identity Solutions (AdTech): Privacy questions raised by adtech identity solutions such as UID2, ID5 and RampID: consent to create identifiers, and tracking across devices and sites. (published 2026-01-28, last reviewed 2026-01-28) - https://northend.law/guides/customer-data-platforms - Customer Data Platforms: How a customer data platform affects privacy compliance: the lawful basis for unifying data, consent management, and due diligence on the CDP vendor. (published 2026-01-28, last reviewed 2026-01-28) - Publication (2025-02-01): https://northend.law/publications/avoiding-the-scope-of-the-eprivacy-directive-in-advertising - Avoiding the scope of the ePrivacy Directive in advertising - Publication (2024-06-06): https://northend.law/publications/pepr24-takeaways - Some takeaways from PEPR'24 (USENIX Conference on Privacy Engineering Practice and Respect) ### AI-native law firms: a reference (October 2026) - https://northend.law/guides/ai-native-law-firms-reference - AI-native law firms: a reference (October 2026): An unranked comparison of firms that call themselves AI-native: structure, admissions, main work, published prices and AI, from each firm's own site. (published 2026-10-16, last reviewed 2026-10-23) ### Copyright (https://northend.law/copyright) - https://northend.law/copyright/trademarks - Trademarks: How a startup protects its brand: searching before choosing a name, filing early in key markets, choosing a strong mark, and watching for infringement. (published 2026-01-23, last reviewed 2026-01-23) - https://northend.law/copyright/copyright-basics - Copyright: Who owns the code and content a company creates: work-for-hire terms with contractors, open source licence duties, and when registration matters. (published 2026-01-23, last reviewed 2026-01-23) ## Pricing Philosophy Transparent, predictable pricing. Two tracks: 1. **Subscription-based services** (recurring monthly/quarterly retainers) 2. **Project-based legal advice** (ad-hoc engagements; attorney-priced lanes state the exact flat fee in the engagement letter before signing) Plans are scoped to complement an existing GC or law firm rather than replace one. No billable hours; no surprise invoices. Machine time is accounted as the firm's cost of production, never billed as hours. ## Key Differentiators - **Software included free**: Clients receive the platform (DPO Central, AI Sentinel, vendor.watch, and Dealroom), built by our technology company, at no extra cost, so they pay only for our lawyers' judgment. - **AI-native operations with tiered trust**: privileged work runs only on self-hosted models on firm hardware; confidential work runs in a secure private cloud on open-weight models; commercial frontier models handle only abstract, carefully anonymized research. For engagement work, customer-specific or confidential information is not sent to proprietary cloud LLMs or commercial "wrappers." The contract upload at /contract-review follows the same rule: the file is stored with the site's hosting provider and read by a lawyer, never by an AI model. - **Cross-jurisdictional**: The founding attorney is admitted in California (US) and in Madrid, Spain (Ilustre Colegio de la Abogacía de Madrid, EU), and formerly admitted in England and Wales; cross-border practice across US/UK/EU. - **Complementary, not competitive**: Designed to plug into a client's existing legal stack alongside their current go-to firm. ## Target Keywords - AI-native law firm - Outside counsel subscription - AI governance lawyer - EU AI Act compliance - NIST AI RMF - ISO 42001 - Agentic contracts - MCP contracts - Agent-to-agent transactions - A2A dispute resolution - Token structuring lawyer - DeFi compliance - Smart contract law - GDPR lawyer - Cross-border privacy ## Leadership **Sergio Maldonado Elvira** (LL.M., J.D., FIP, CIPP/US, CIPP/E, CIPT) - Founder & Principal Attorney - Admitted in California (Attorney, State Bar of California) - Admitted in Madrid, Spain (Abogado, Ilustre Colegio de la Abogacía de Madrid, since 1998) - Formerly admitted in England and Wales - IAPP certifications: FIP, CIPP/US, CIPP/E, CIPT - Degrees: LL.M., J.D. - Profile: https://northend.law/leadership - Member of the European Data Protection Board's "Pool of Experts" ## Contact - Website: https://northend.law - Start an engagement: https://northend.law/start - Contact & booking: https://northend.law/contact - Phone: +1 737 336 4630 - Office: 447 Sutter St. Suite 506 - 1349, San Francisco CA 94108, United States - Law Corporation number 31414 - Approved by The State Bar of California ## Site Structure - / - Homepage - /ai - How the firm uses AI: self-hosted stack, tiered trust, citation verification - /submit-a-matter - Submit a matter in one screen, no account (privacy, AI governance, the AI-native work around them, and commercial contracts in MarTech, AdTech and SaaS) - /start - Start an engagement (six lanes, conflicts check, e-signed engagement letter) - /pricing - Subscription & project-based pricing - /dpoaas - Privacy Counsel detail page (quarterly tiers, slider) - /platform - The Platform (free software included with any engagement) - /skills - Skills & Knowledge Bases (attorney-built AI review Skills + provenance KBs; free gated samples) - /ai-governance-plan - Fractional AI Governance Lead detail page - /privacy - Privacy & Data Protection practice area - /copyright - Copyright & Licensing practice area - /ai-governance - Global AI Governance practice area - /agentic-contracts - Agentic Contractual Frameworks practice area - /ai-crypto - AI-Crypto Interplay practice area - /crypto - Crypto and digital assets practice area (wallet licensing, stablecoins, MiCA, travel rule, US money transmission, UK regime) - /contract-review - Contract review by an attorney (upload a draft) - /leadership - About the founder - /publications - Selected articles by Sergio Maldonado (privacy, data protection, AI governance, legal practice), republished from Medium, LinkedIn and print - /podcast - Podcast - /guides - Guides: topic hubs on privacy, AI governance and technology contracts (listed above) - /deep-dives - Crypto and digital-asset analyses (wallet custody, US money transmission, UK regime, stablecoins, DAOs) - /prompts - Curated AI prompt library (for clients' own AI use) - /scans - Free website exposure scan: every ad-tech vendor, pixel, cookie and tracking ID on a company's public site, screened against U.S. privacy litigation records, delivered as a counsel-reviewed report - /inscope - InScope regulatory radar: which privacy, data protection and AI governance laws apply to a company (29 instruments, US/EU/UK and beyond), compressed into shared actions; embedded interactive sample on the page, first report free via the request form - /contact - Contact and booking ## Customer-facing app subdomains (software included free with any engagement) - https://dpocentral.todo.law - DPO Central (privacy management) - https://aisentinel.todo.law - AI Sentinel (AI governance) - https://vendor.watch - vendor.watch (third-party/vendor risk) - https://dealroom.todo.law - Dealroom (contract negotiation) ## For AI agents: MCP server - Endpoint: https://northend.law/api/mcp (MCP, streamable HTTP, no sign-in for the free tools). Agent card: https://northend.law/.well-known/agent-card.json. Page: https://northend.law/agents - Service: Data processing agreement, $350 flat fee (United States dollars), paid in full at checkout; No fee for current Privacy Counsel subscribers. Governing law: California by default, or Spain on request. Companies established in the United States, the European Union or the United Kingdom. Countries under sanctions are refused. - Service: Business associate agreement (HIPAA), $350 flat fee (United States dollars), paid in full at checkout; No fee for current Privacy Counsel subscribers. For a vendor whose services are designed not to receive protected health information. Governing law: California. Companies established in the United States. - Free tools: list_services, get_requirements, get_engagement_terms, request_consultation (get_dpa_requirements remains as the DPA's alias). Matter tools: open_matter, get_matter_status, get_payment_link, submit_facts, get_deliverable (submit_dpa_facts remains as an alias). - Target, not a guarantee: the agreement is released within 4 business hours of complete facts, after a lawyer's review. Business hours are 9:00 to 17:00 Pacific time, Monday to Friday, except United States federal holidays. - Responsible lawyer: Sergio Maldonado Elvira, Founder & Principal Attorney, North End Law Corporation, 447 Sutter St. Suite 506 - 1349, San Francisco, California 94108, United States. - Using these tools does not create a lawyer-client relationship. The firm accepts the engagement when its automatic conflicts check is clear and payment is received (for a subscriber, when the engagement is accepted and the check is clear). If a possible conflict is found, nothing is charged, or the payment is refunded in full. Do not send confidential facts before then.