Legalise policies

Privacy Policy

Learn how Legalise safeguards your account, generated outputs, Desk case data, shared links, analytics data, and service communications.

Effective Date: 20 March 2026

This Privacy Policy describes how Legalise ("we", "us", "the platform") collects, uses, stores, and protects information from users of the Legalise platform. By using this platform, you consent to the data practices described in this policy.

1. Information We Collect.

  • Account Data: Email address, display name, phone number (optional), bar council number (optional), firm name (optional), preferred court (optional), and verification status.
  • Authentication Data: Password hash (never stored in plain text), Google OAuth identifier if using Google sign-in, session identifiers, login timestamps, IP address, and user agent information.
  • Usage Data: Pages visited, features used, document generation history, reviewer and compiler usage, template type, timestamps, token counts, instrument counts, and related service metadata.
  • Generated Outputs and Case Files: Document content, uploaded inputs, compiled briefings, reviewer reports, attachments, notes, and Desk case-file material are processed to provide the service. They are stored only where the service requires it, such as when you save them to Desk, generate a persisted output, attach material to a case file, or create a share link. Template filing data that is not saved is not retained as document content. We store generation metadata such as template used, timestamp, and instrument count for billing, service records, and abuse prevention.
  • Sharing Data: If you create a Desk share link, we store the information necessary to make that link work, including the shared item, recipient-access state, limits, expiry or revocation status, and access metadata. Shared-link recipients may be able to view the material you choose to share until the link expires, is revoked, or otherwise becomes unavailable.
  • Notification and Communication Data: Service notices, account alerts, trial and subscription reminders, payment confirmations, Gazette or newsletter preferences, opt-out status, suppression status, delivery metadata, and support correspondence.
  • Payment Data: Transaction references, payment amounts, approval status, member number, contract dates, and invoice-related information. We do not store bank account numbers, card numbers, or financial credentials.

2. How We Use Your Information.

  • To provide and maintain document generation, matter review, case compilation, Desk storage, sharing, and legal research services.
  • To manage your account, verification status, subscription status, trial access, billing cycle, instrument allowance, carryover, renewals, refunds, and invoices.
  • To send service-related communications, including trial expiry notices, subscription reminders, security alerts, payment confirmations, account notices, and support responses.
  • To operate optional or administrative communications such as the Gazette or similar updates, subject to opt-out and suppression controls.
  • To monitor platform health, detect abuse, enforce usage limits, maintain service quality, and protect the integrity of member accounts and case files.
  • To comply with applicable Pakistani law, including the Prevention of Electronic Crimes Act 2016 (PECA), and lawful requests from competent authorities.

3. AI Processing and Third-Party Infrastructure.

Document generation, matter review, case compilation, authentication, analytics, email delivery, hosting, and related platform functions may rely on carefully selected third-party infrastructure and service providers. When you generate, compile, review, upload, or share material through Legalise, the data necessary to perform that action may be transmitted to such providers for processing, delivery, storage, security, or availability purposes.

For AI-assisted drafting and review, the providers currently in use include:

  • Google AI (Gemini API)
  • OpenRouter

Content transmitted to AI providers is used for generating, compiling, or reviewing the requested output during that session. We do not authorize these providers to retain, train on, or redistribute your content beyond what is necessary for processing under their applicable terms and policies. These providers operate under their own privacy policies:

  • Google AI / Gemini API: https://ai.google.dev/terms
  • OpenRouter: https://openrouter.ai/privacy

4. What We Do Not Do.

  • We do not sell, rent, license, or trade your personal data or document content to any third party.
  • We do not share your advocate profile data (bar number, firm, court preference) with AI providers unless a specific workflow requires a user-supplied field to be included in the requested output.
  • We do not use your generated documents, uploaded matter material, compiled briefings, reviewer reports, Desk case files, or shared-link contents for marketing, advertising, or model training purposes.
  • We do not retain unsaved template filing data as document content beyond what is necessary to provide the requested service, maintain saved case files, operate share links, comply with legal obligations, and preserve service records.

5. Cookies, Local Storage, and Analytics.

We use browser cookies for authentication session management and local storage for user preferences, form state, and interface settings. We use Google Analytics 4 to collect visitation and usage information to improve the service, understand traffic patterns, and diagnose platform issues. Analytics data is used for service improvement and is not used to sell personal data or target advertising.

6. Data Retention.

  • Account data is retained for the duration of your account. Deleted accounts are permanently removed from active account records, subject to limited retention of email, IP, security, payment, or abuse-prevention logs where necessary.
  • Generation and usage metadata (template, timestamp, instrument count, token count, feature used, and related service metadata) is retained for billing records, allowance enforcement, security, and service analytics.
  • Case file documents, attachments, notes, compiled briefings, and reviewer reports are retained as long as your account is active, until you delete them, or until retention is otherwise required for service, legal, security, or support reasons.
  • Shared-link records are retained while the share is active and for a reasonable period after expiry or revocation for security, audit, and abuse-prevention purposes.
  • Communication and opt-out records are retained as needed to honour opt-outs, suppressions, subscription notices, legal notices, and support history.
  • Session logs (IP address, user agent, timestamps) are retained for up to 90 days for security auditing unless a longer period is reasonably required for abuse prevention, dispute handling, or legal compliance.

7. Data Security.

We implement technical and organizational measures to protect your data, including password hashing, HTTPS transport encryption, session-based authentication, rate limiting, IP-based abuse detection, access controls, and regular backups. No method of electronic storage or transmission is completely secure, and we cannot guarantee absolute security. Members are responsible for keeping their credentials safe and for sharing Desk links only with intended recipients.

8. Your Rights.

We voluntarily extend the following rights to you as a matter of platform policy:

  • Request correction of inaccurate account data.
  • Request deletion of your account and associated data, subject to lawful retention requirements and abuse-prevention records.
  • Revoke Desk share links where the interface permits revocation.
  • Opt out of Gazette, newsletter, or non-essential update emails while continuing to receive necessary service, security, payment, and account notices.
  • Contact support for account recovery after reasonable verification if login credentials are lost or compromised.

To exercise these rights, contact: support@legalise.pk

9. Changes to This Policy.

We may update this Privacy Policy as our infrastructure, services, or legal obligations change. Material changes will be communicated via email, in-app notification, or an updated policy page. Continued use of the platform after notification constitutes acceptance of the updated policy.

10. Governing Law.

This Privacy Policy is governed by the laws of the Islamic Republic of Pakistan, with particular reference to the Prevention of Electronic Crimes Act 2016 and any subsequent data protection legislation applicable in Pakistan or the Islamabad Capital Territory.

11. Contact.

For privacy-related inquiries, account requests, or support issues, email support@legalise.pk.