Privacy policy

1. Who is responsible

LawPal is operated by Olee AI (Pvt) Ltd, a company incorporated in Sri Lanka. Who decides how personal data is used depends on whose data it is:

• We are the controller of the case-law library (judgments and Acts) and of LawPal's own accounts: the people who sign up, and how they use LawPal.
• We are the processor for what a firm uploads and records about its clients and matters. The firm is the controller of that data, and we process it only on the firm's instructions, to provide LawPal to it.

Our Data Protection Officer is Thanura Manujith, reached at info@lawpal.lk.

2. What we hold

• Your account: name, email address, an optional telephone number, a hashed password, two-factor settings, and the version of these documents you accepted and when.
• Your firm's records: what the firm enters or uploads, including clients, matters, diary dates, notes, drafts and documents. These often contain other people's personal data, which is why the firm is its controller.
• Usage: the questions asked and the AI work done, with the tokens each used, an activity log of who did what, and payments made (never card details).
• The library: published judgments, which name the parties and others involved, as the courts delivered them.
• Messages to us: what you send through a form on this site or by email, so we can answer it.
• Technical logs: request and error logs, which contain IP addresses. Application logs never contain document text, questions, answers or personal identifiers.

3. What we don't hold

• Card details. Card payments are taken by PayHere and never reach LawPal.
• Advertising or tracking data. This site runs no advertising, analytics or cross-site tracking, uses cookies only to keep you signed in, and keeps your light or dark preference in your own browser.
• The text of AI requests in our AI audit log, which records fingerprints (hashes) of what was sent, not the text itself.

4. Why we hold it

• To provide the service you signed up for: the contract between us.
• To keep LawPal secure and keep a record of who did what: our legitimate interest, and the firm's.
• To bill correctly and keep proper accounts: our legal obligation.
• To answer you when you write to us.

We do not sell personal data, and we make no automated decision about you that has a legal effect.

5. AI providers

Before any text from a firm's records reaches an AI provider, personal identifiers are masked: email addresses, NIC numbers (old and new formats), passport numbers, labelled account numbers and telephone numbers. Only public library text is sent unmasked. A firm can have work on a confidential matter sent to a separately chosen model.

6. Sub-processors and regions

Running LawPal means using other companies' infrastructure. These are all of them, what each handles, and where. The primary data region is India. Each provider acts under its data processing terms; for a firm's data, the firm remains the controller and each provider acts as our sub-processor. A new provider is added to this list before it is used.

Oleon (Olee AI)Hosting: runs the application, the API and background work

Everything the service handles while it is being processed

Region: Region to be confirmed

Microsoft Azure (Database for PostgreSQL)Database

Accounts, firm records and the search index

Region: India (Central India)

Microsoft Azure (Blob Storage)File storage

Uploaded files, exports and backups

Region: India (Central India)

Google (Vertex AI)AI: generation, embeddings, ranking and speech

Masked text and public library text

Region: Region to be confirmed

OpenAI (OpenAI API or Azure OpenAI)AI: generation, embeddings and speech

Masked text and public library text

Region: Region to be confirmed

ZeptoMailEmail

Recipient address and the message

Region: Region to be confirmed

Cloudflare (Email Worker)Incoming mail to LawPal mailboxes

Messages sent to LawPal addresses

Region: Cloudflare's global network

Cloudflare (Turnstile)Bot check on sign-up and public forms

Browser signals read by the check

Region: Cloudflare's global network

Dialog Axiata (e-SMS)Text messages

Telephone number and the message

Region: Sri Lanka

TwilioText messages, as a fallback or with a firm's own account

Telephone number and the message

Region: Region to be confirmed

Meta (WhatsApp Cloud API)WhatsApp messages

None at launchNot used at launch

Region: Region to be confirmed

PayHereCard payments

Order, amount and the payer's name, email and telephone. Card details never reach LawPal

Region: Sri Lanka

Google DriveFiles a firm links from its own Drive

The files and folders the firm choosesOnly when a firm connects its own Drive

Region: Region to be confirmed

7. How long we keep it

• Logs (questions asked and activity): 12 months by default. A firm can choose a different period for its question log, and its activity log is kept at least 12 months.
• Backups: 30 days. A deleted record leaves the backups within 30 days.
• Records of which documents were viewed: 7 days.
• Firm records and documents: while the account is open. After it closes, the export stays available for 30 days and the records are then deleted.
• Consent records (what was accepted, and when): 6 years after the account closes.
• Everything else, such as payments and invoices: as our retention policy and the law on keeping accounts require.

8. Personal data breaches

If a personal data breach affects data we hold, we notify the affected firms and the Data Protection Authority of Sri Lanka within 72 hours of becoming aware of it, saying what happened, what data was involved and what we have done. Where it concerns a firm's records, we give the firm what it needs to meet its own duties as controller.

9. Your rights

Under the Personal Data Protection Act, No. 9 of 2022, you may ask for a copy of the personal data we hold about you, ask us to correct or delete it, object to a use of it, or withdraw a consent you gave. Write to our Data Protection Officer at info@lawpal.lk; we answer within 30 days. A firm admin can also export the firm's data and close the account directly.

If your request is about data a law firm holds about you in its own matter, the firm is the controller, and we will tell you so rather than quietly doing nothing. If you are named in a judgment in the library, use the removal requests page.

10. Complaints

If you are not satisfied with how we handled your data or your request, you have the right to complain to the Data Protection Authority of Sri Lanka, established under the Personal Data Protection Act, No. 9 of 2022. You don't have to come to us first.

11. Minimum age

LawPal is a professional tool. You must be 18 or over to hold an account, and we do not knowingly hold an account for anyone younger. A firm's records may contain data about minors, which the firm controls and we process on its instructions.