Privacy Policy: How Legalise Protects Your Data

Effective Date: 13 October 2026 (first published 20 March 2026)

This Privacy Policy describes how Legalise ("we", "us", "the platform") collects, uses, stores, and protects information from users of the Legalise platform. By using this platform, you consent to the data practices described in this policy.

1. Information We Collect.

Account Data: Email address, display name, phone number (optional), bar council number (optional), firm name (optional), preferred court (optional), and verification status.
Authentication Data: Password hash (never stored in plain text), Google OAuth identifier if using Google sign-in, session identifiers, login timestamps, IP address, and user agent information.
Usage Data: Pages visited, features used, document generation history, reviewer and compiler usage, template type, timestamps, instrument counts, and related service metadata.
Generated Outputs and Case Files: Document content, uploaded inputs, compiled briefings, reviewer reports, research reports, attachments, notes, and Desk case-file material are processed to provide the service. They are stored only where the service requires it, such as when you save them to Desk, generate a persisted output, attach material to a case file, or create a share link. Template filing data that is not saved is not retained as document content. We store generation metadata such as template used, timestamp, and instrument count for billing, service records, and abuse prevention.
Sharing Data: If you create a Desk share link, we store the information necessary to make that link work, including the shared item, recipient-access state, limits, expiry or revocation status, and access metadata. Shared-link recipients may be able to view the material you choose to share until the link expires, is revoked, or otherwise becomes unavailable.
Notification and Communication Data: Service notices, account alerts, Complimentary usage and subscription reminders, payment confirmations, Gazette or newsletter preferences, opt-out status, suppression status, delivery metadata, and support correspondence.
Payment Data: Records needed to confirm and account for your payments, such as the transaction reference, amount, and membership dates. We never ask for your banking or wallet passwords or PINs.
Advocacy Page: Anything you choose to publish on your advocacy page is public. You can change or remove it at any time.

2. How We Use Your Information.

To provide and maintain document generation, matter review, case compilation, Desk storage, sharing, and legal research services.
To manage your account, verification status, subscription status, Complimentary access, monthly instrument and research uses, carryover, renewals, refunds, and payment records.
To send service-related communications, including Complimentary usage notices, subscription reminders, security alerts, payment confirmations, account notices, and support responses.
To operate optional or administrative communications such as the Gazette or similar updates. Members are enrolled in the Gazette by default. Every edition supports one-click unsubscribe through your email app, and the preference can also be changed from the account page at any time. Opting out never affects necessary service, security, payment, or account notices.
To monitor platform health, detect abuse, enforce usage limits, maintain service quality, and protect the integrity of member accounts and case files.
To comply with applicable Pakistani law, including the Prevention of Electronic Crimes Act 2016 (PECA), and lawful requests from competent authorities.

3. AI Processing and Third-Party Infrastructure.

AI features, authentication, analytics, email delivery, hosting, and related platform functions may rely on carefully selected third-party infrastructure and service providers. These functions include hosting and content delivery, transactional email delivery, newsletter delivery, and analytics. When you generate, compile, review, upload, or share material through Legalise, the data necessary to perform that action may be transmitted to such providers for processing, delivery, storage, security, or availability purposes.

For AI features, the providers currently in use include:

Google AI (Gemini API)
OpenRouter

Content transmitted to AI providers is used to generate, compile, review, or research the requested output. AI requests run under specific provider arrangements that are opted out of model training by default, are not processed for marketing, and carry no permanent data retention with the providers. This applies to every account, Complimentary and paid alike.

Each provider operates under its own privacy policy:

Google AI / Gemini API: https://ai.google.dev/terms
OpenRouter: https://openrouter.ai/privacy

4. What We Do Not Do.

We never retain your prompts and inputs.
We do not sell, rent, license, or trade your personal data or document content to any third party.
We do not share your advocate profile data (bar number, firm, court preference) with AI providers unless a specific workflow requires a user-supplied field to be included in the requested output.
We do not use your generated documents, uploaded matter material, compiled briefings, reviewer reports, Desk case files, or shared-link contents for marketing, advertising, or model training purposes.
We do not retain unsaved template filing data as document content beyond what is necessary to provide the requested service, maintain saved case files, operate share links, comply with legal obligations, and preserve service records.

5. Cookies, Local Storage, and Analytics.

We use browser cookies for authentication session management and local storage for user preferences, form state, and interface settings. We use Google Analytics 4 to collect visitation and usage information to improve the service, understand traffic patterns, and diagnose platform issues. Analytics uses pseudonymous identifiers and never includes your email address or the contents of your documents. Analytics data is used for service improvement and is not used to sell personal data. On our public pages it also helps us understand how visitors find Legalise; these tools never run inside your Desk, documents, research reports or account pages.

6. Data Retention.

Account data is retained for the duration of your account. Deleted accounts are permanently removed from active account records, subject to limited retention of email, IP, security, payment, or abuse-prevention logs where necessary.
Generation and usage metadata (template, timestamp, instrument count, feature used, and related service metadata) is retained for billing records, usage limits, security, and service analytics.
Case file documents, attachments, notes, compiled briefings, reviewer reports, and research reports are retained as long as your account is active. A completed research inquiry is kept as a research report containing your question, the answer, and the authorities it cited, so that you can return to it. When you delete an item, it is removed from your account and our live database immediately, including any file you uploaded with it. It cannot be recovered, and deletion is not reversible.
Shared-link records are retained while the share is active and for a reasonable period after expiry or revocation for security, audit, and abuse-prevention purposes.
Communication and opt-out records are retained as needed to honour opt-outs, suppressions, subscription notices, legal notices, and support history.
Routine service records are kept as needed for security, abuse and fraud prevention, and to operate and improve the service.

7. Data Security.

We use industry-standard administrative, technical, and organisational safeguards designed to protect your information, including encryption in transit and access controls. No method of electronic storage or transmission is completely secure, and we cannot guarantee absolute security. In the event of a data breach that materially affects your personal data, we will notify affected members and, where required by law, the competent authorities without undue delay. Members are responsible for keeping their credentials safe and for sharing Desk links only with intended recipients.

8. Data Location and International Transfer.

Legalise is operated from Pakistan, but the third-party infrastructure described in this policy, including hosting, content delivery, email delivery, analytics, and AI processing, operates on servers that may be located outside Pakistan. Information handled by those providers may accordingly be stored or processed outside Pakistan under the safeguards described in this policy and each provider's own terms. By using the platform you consent to this transfer, storage, and processing.

9. Children and Eligibility.

Legalise is a professional tool intended for adults aged 18 and over engaged in legal practice, legal education, or legal research. The platform is not directed at children, and we do not knowingly collect personal data from anyone under 18. If you believe a minor has provided personal data to the platform, contact support@legalise.pk and the data will be deleted.

10. Your Rights.

We voluntarily extend the following rights to you as a matter of platform policy:

Request correction of inaccurate account data.
Request deletion of your account and associated data, subject to lawful retention requirements and abuse-prevention records.
Revoke Desk share links where the interface permits revocation.
Opt out of Gazette, newsletter, or non-essential update emails while continuing to receive necessary service, security, payment, and account notices.
Contact support for account recovery after reasonable verification if login credentials are lost or compromised.

To exercise these rights, contact: support@legalise.pk

11. Changes to This Policy.

We may update this Privacy Policy as our infrastructure, services, or legal obligations change. Material changes will be communicated via email, in-app notification, or an updated policy page. Continued use of the platform after notification constitutes acceptance of the updated policy.

12. Governing Law.

This Privacy Policy is governed by the laws of the Islamic Republic of Pakistan, with particular reference to the Prevention of Electronic Crimes Act 2016 and any subsequent data protection legislation applicable in Pakistan.

13. Contact.

For privacy-related inquiries, account requests, or support issues, email support@legalise.pk.