Privacy policy

Effective [date]. This policy explains what personal information Law Automator handles, why, and the choices you have. We process personal information in line with the Privacy Act, 2075 (2018), the Electronic Transactions Act, 2063 (2008) and other laws of Nepal.

1. Who we are and our two roles

Law Automator is operated by [Company legal name], a company registered in Nepal (registration no. [—], PAN [—]), [registered address] ("we"). For accounts, subscriptions, payments to us, support and this website, we decide how information is used. For the information a law firm puts into its workspace (its clients, matters, parties, documents, messages and invoices), the firm is responsible and we process it only on the firm's behalf, under our data processing terms. If a law firm holds information about you, please contact that firm first.

2. What we collect

Account: name, email, phone number if given, language, password (stored only as a one-way hash), two-step verification secret and recovery codes (encrypted).
Firm: firm name, members and roles, invitations, billing settings, VAT/PAN details entered for invoices, and the firm's eSewa merchant credentials (encrypted, never shown again).
Workspace content, on the firm's behalf: clients, parties, matters, case facts and file notes, enquiries, appointments and advice notes, tasks, dates, drafts, documents, client messages, notary records, translations, time entries and invoices. Case facts, client identity numbers, file notes, enquiry notes, advice notes and client messages are encrypted in the database.
Payments: plan, amounts, invoice numbers and the transaction references returned by eSewa, Khalti or your bank. We never receive your wallet PIN, card details or bank password.
Technical: IP address, browser type, the pages and requests you make, security events (sign-ins, failed sign-ins, password and role changes) and error logs with a reference number.

3. How we use it

To provide the service: sign-in, workspaces, the features you use, reminders and notifications you have not turned off.
To keep it secure: two-step verification, rate limits, virus scanning of uploads, audit logs and fraud prevention. When you set a password in production we check whether it appears in known breaches using a k-anonymity range query: only the first five characters of a hash of the password leave our servers.
To bill subscriptions and confirm payments with the payment provider.
To answer support requests and to comply with the law.

We do not sell personal information, show advertising, use advertising or analytics trackers, or use your content to train artificial intelligence. Law Automator does not use AI to process your content.

4. Who we share it with

Hosting and email providers that run the service for us under confidentiality obligations: [hosting provider and data-centre location], [email delivery provider].
Payment providers (eSewa, Khalti, banks) for the payments you make.
Google Fonts, which serves the typefaces and receives your IP address when a page loads.
Authorities, only when Nepali law or a court or authority order requires it. Where the law allows, we tell the firm concerned first.

Within a workspace, a firm decides what its members and its clients (through the client portal) can see.

5. How long we keep it

Accounts: until you delete your account. Deleted accounts are anonymised; uploads and documents are erased.
Unfinished document drafts: 180 days after the last change. Deleted documents: 30 days.
Firm workspaces: while the subscription is active or read-only. After a cancelled subscription ends, the workspace and its files are deleted after the retention period shown on the Subscription page (currently 60 days), with a warning a week before. Firm data exports are available for 7 days.
Encrypted backups: 14 days.
Invoices, payment and tax records: as long as tax and accounting law requires.
Security and audit logs: as long as needed to investigate incidents and meet legal obligations.

6. Security

Connections are encrypted (HTTPS). Sensitive fields are encrypted at rest, every firm's records are isolated, staff accounts require two-step verification, backups are encrypted, and access to the admin console is limited and logged. See our security overview. No system is perfectly secure; if a breach affects your personal information we will tell you and the firm concerned without undue delay.

7. Your rights

You can see and correct your account details, download your data (Account → Export) and delete your account (Account → Delete) at any time. You can also ask us what information we hold about you, ask us to correct or delete it, or object to a use of it. For information held by a law firm in its workspace, the firm handles your request and we help it. Contact us through the contact page.

8. Cookies

We use only the cookies needed to run the service and remember your language. See the cookie notice.

9. Children

Law Automator is a professional tool and is not intended for people under 18. A firm may hold information about minors as part of a matter; that information is the firm's responsibility.

10. Changes and contact

We will post changes here and, for significant changes, tell account holders by email before they take effect. Questions and complaints: contact page or [privacy contact email]. Grievance officer: [name and contact].