Privacy Policy

Introduction

Lawzana Ltd ("Lawzana," "we," "us," or "our") operates the Lawzana Flow platform (the "Service"). This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our Service.

We are committed to protecting your privacy and the confidentiality of client data entrusted to legal professionals. Please read this policy carefully to understand our practices regarding your personal data.

Electronic signatures

When you sign a document through Flow, we record the document, your name, email address, IP address, device and browser details, the date and time of each step, your signature image and your consent. We also store a fingerprint (hash) of each PDF.

We use these records only to run the signing and to show how the document was signed. We do this for the firm that sent you the document: the firm is the controller and Lawzana is its processor. Contact that firm with any question or request about your data.

The records are kept with the firm's data until the firm deletes them or closes its account. Database backups roll off after 7 days.

The public verification page shows only whether a document was signed and when. It shows the signers' names only to someone who checks a matching copy of the signed PDF. It never shows the document, email addresses or IP addresses.

Information We Collect

Account Information

When you create an account, we collect:

Name and email address
Organization name and details
Role within your organization
Password (stored in hashed form only)
Profile information you choose to provide

Content You Upload

To provide our services, we store content you upload, including:

Documents (PDFs, Word files, and other file types)
Matter and case information
Contact and client records
Notes, tasks, and communications within the platform

Usage Information

We automatically collect certain information when you use the Service:

Log data (IP address, browser type, access times)
Device information (device type, operating system)
Feature usage patterns (to improve our Service)
Error reports and performance data, which may include personal data such as your email address, and occasional session replays with on-screen text masked

Payment Information

Payment processing is handled by Stripe. We do not store your full credit card number. We receive only limited information from Stripe necessary for billing (last four digits, card type, expiration date).

How We Use Your Information

We use your information for the following purposes:

Provide the Service: To operate and maintain Lawzana Flow, including document storage, matter management, and AI-powered features
AI Processing: To process your documents and queries through our AI features (see AI Privacy section below)
Account Management: To manage your account, process payments, and communicate with you about your subscription
Security: To detect, prevent, and respond to security incidents
Improvement: To understand how the Service is used and improve it, including through Google Analytics
Legal Compliance: To comply with applicable laws and regulations

AI Privacy

We understand the critical importance of confidentiality for legal professionals. Our AI features are powered by Google Vertex AI with the following privacy protections:

AI Data Handling: We use Google Vertex AI. Google does not use your content to train its models, and request logging is off on our project. Google may keep requests in memory for up to 24 hours for caching, and may log them to detect abuse. Lawzana Flow itself stores your AI chat history, summaries and extracted facts as part of your matter.
No Model Training: Your data is never used to train or improve AI models. Google's terms say it will not use your data to train its models without your permission.
You Stay in Control: AI drafts, you decide. Automatic AI replies to prospects and the client-portal AI assistant are off by default; you turn them on in your settings or per lead, and per client link.

Data Storage and Security

Data Residency

Your uploaded files are stored in one of three Google Cloud regions. Firms that join from the Lawzana Directory choose the region during setup; firms that sign up directly on flow.lawzana.com are stored in the European Union:

United States: Google Cloud, Iowa
European Union: Google Cloud, Belgium
Asia Pacific: Google Cloud, Singapore

The region cannot be changed later. It applies to uploaded files only: our database, search, background jobs and application servers run on DigitalOcean in the United States, and AI requests are processed by Google Vertex AI on its global endpoint.

Security Measures

Our security measures include:

HTTPS encryption for data in transit
Encryption at rest for uploaded files (Google Cloud) and the database (DigitalOcean)
Role-based access controls
Audit logging of key actions
Error monitoring
Daily database backups, kept for 7 days

For more details, see our Security page.

Data Sharing and Disclosure

We do not sell your personal information or client data. We may share information only in the following circumstances:

Service Providers (Subprocessors)

We use trusted third-party service providers to operate our Service:

Google Cloud Platform: File storage and AI processing (Vertex AI)
DigitalOcean: Hosting for the application, database, search and background jobs (United States)
Stripe: Payment processing
SendGrid (Twilio): Sending our emails and receiving emails you forward to Flow, with open and click tracking
Sentry: Error monitoring and session replays (on-screen text masked); error reports may include personal data
Crisp: In-app support chat
Canny: Product feedback board
Google Analytics: Usage analytics
Cloudflare: Network delivery and protection for our websites

These providers are contractually bound to protect your data and use it only for the services they provide to us.

Legal Requirements

We may disclose information if required by law, such as in response to a valid subpoena, court order, or government request. We will notify you of such requests where legally permitted.

Business Transfers

If Lawzana is involved in a merger, acquisition, or sale of assets, your information may be transferred. We will provide notice before your data is transferred and becomes subject to a different privacy policy.

Your Rights

Depending on your location, you may have the following rights regarding your personal data:

Access: Request a copy of the personal data we hold about you
Correction: Request correction of inaccurate personal data
Deletion: Request deletion of your personal data (subject to legal retention requirements)
Portability: Request your data in a machine-readable format
Objection: Object to certain processing of your personal data
Withdrawal: Withdraw consent where processing is based on consent

To exercise these rights, contact us at [email protected].

For EEA and UK Users (GDPR)

If you are in the European Economic Area or United Kingdom, the following applies:

Data Controller: Lawzana Ltd is the data controller for personal data collected through the Service
Legal Basis: We process your data based on: (a) contract performance, (b) legitimate interests, (c) consent where applicable, and (d) legal obligations
Data Transfers: Our database and application servers are in the United States and AI requests are processed on a global endpoint, so personal data may be transferred outside the EEA and UK. Where required, we rely on the transfer mechanisms in our providers' data processing terms, such as Standard Contractual Clauses.
Supervisory Authority: You have the right to lodge a complaint with your local data protection authority

For California Users (CCPA)

California residents have additional rights under the California Consumer Privacy Act:

Right to Know: You can request disclosure of the categories and specific pieces of personal information we have collected
Right to Delete: You can request deletion of personal information we have collected
Right to Non-Discrimination: We will not discriminate against you for exercising your privacy rights
No Sale of Personal Information: We do not sell personal information as defined by the CCPA

Data Retention

We retain your data for as long as your account is active or as needed to provide the Service. In addition:

When you ask us to close your account, we delete your organization's data, including uploaded files
Database backups roll off after 7 days
Anonymized, aggregated analytics data may be retained indefinitely
Certain records may be retained longer if required by law

Cookies and Tracking

We use essential cookies required for the Service to function (authentication, session management, and security checks by Cloudflare). We also use Google Analytics, which sets its own cookies, to understand how the Service is used. Inside the app, our support chat (Crisp) sets its own cookies. When you pay for a plan, you do so on Stripe's checkout page, which sets its own cookies. Emails we send use open and click tracking.

Children's Privacy

Our Service is not directed to individuals under the age of 18. We do not knowingly collect personal information from children. If you become aware that a child has provided us with personal information, please contact us.

Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the new policy on this page and updating the "Last updated" date. For significant changes, we will provide additional notice (such as email notification).

Contact Us

If you have questions about this Privacy Policy or our data practices, please contact us:

Email: [email protected]
Company: Lawzana Ltd
Address: Unit 2904-05, 29/F, Universal Trade Centre, 3 Arbuthnot Road, Central, Hong Kong S.A.R
Business registration number: 72690196