Privacy Policy & Data Processing

LawandLegal operates the platform at lawandlegal.app for lawyers and law firms. For questions or data-rights requests, write to support@lawandlegal.app.

• Account data — name, work email, phone, firm, role, job title, and authentication records including sign-in codes and OAuth identifiers.
• Matter and client content — matters, parties, documents, notes, hearing dates, time entries and invoices you create or upload.
• Usage data — pages viewed, searches run, API requests, device and browser type, IP address, and error diagnostics.
• Billing data — plan, subscription status and invoices. Card details are handled by Polar; we never see or store them.
• Communications — support messages, and WhatsApp or email notifications you opt into.

To provide and secure the service, authenticate users, run search and AI features you invoke, bill subscriptions, send service and notification messages, detect abuse, meet legal obligations, and improve reliability using aggregated statistics. Our lawful bases are performance of contract, legitimate interests in operating and securing the platform, consent where you opt into marketing or push notifications, and legal obligation.

We do not sell personal data and we do not use client content to train foundation models.

• Supabase — database, authentication and file storage.
• Cloudflare — application hosting and edge delivery.
• Polar — subscription billing and merchant of record.
• AI model providers — process only the text you submit to an AI feature.
• Resend — transactional and notification email.
• Twilio — WhatsApp messaging, where a firm enables it.

Each is bound by confidentiality and data-protection terms. We will give notice before adding a sub-processor that materially changes how matter data is handled.

We keep account and matter data for as long as your subscription is active. After cancellation or deletion we retain it for a 30-day grace period so it can be restored or exported, then delete it from live systems; encrypted backups age out within a further 30 days. Billing records are kept as long as tax law requires. Audit logs are retained for security purposes.

Where we process client matter data on your behalf, we commit to:

• process it only on your documented instructions;
• bind staff and sub-processors to confidentiality, and enforce tenant isolation through row-level security so one firm cannot read another's data;
• apply encryption in transit and at rest, least-privilege access, and multi-factor authentication for administrative access;
• assist you with data-subject requests, impact assessments and security reviews;
• notify you without undue delay, and in any case within 72 hours, of a personal data breach affecting your data;
• delete or return your data on termination, as set out in section 5.

Our infrastructure providers may process data outside Ghana, including in the European Union and the United States. Such transfers rely on standard contractual clauses or equivalent safeguards.

Subject to applicable law, including Ghana's Data Protection Act, 2012 (Act 843) and the GDPR where it applies, you may request access, correction, deletion, restriction, portability, or object to processing. Email support@lawandlegal.app and we will respond within 30 days. If you are a client of one of our subscribing firms, contact the firm — they control that data and we will refer your request to them.

We use strictly necessary cookies and local storage for sign-in sessions, language preference and offline reading. We do not run third-party advertising trackers.

We will post material changes here and notify account owners by email at least 14 days before they take effect.