Privacy Policy

This Privacy Policy explains how LegalFinder ("LegalFinder", "we", "us", "our") collects, uses, shares, and protects personal data when you use our website, desktop application, and mobile applications (together, the "Service"). It applies to clients, advocates, police and judiciary users, and administrators alike, except where a section says otherwise. It should be read together with our Terms of Service.

LegalFinder, based in Kampala, Uganda, is the data controller responsible for your personal data under this policy. You can reach us at support@legalfinder.co for any question about this policy or how your data is handled.

Account and identity data. When you sign up, our authentication provider, Clerk, collects your name, email address, and password (your password itself is never visible to or stored by LegalFinder). If you sign in with Google or another social provider, we receive the basic profile information that provider shares with us. We store your requested and granted role (client, advocate, police, judiciary, or administrator).

Profile and directory data. For advocates, this includes headline, firm, practice areas, languages, fees, bar number, and licence status shown in the public directory.

Case, messaging, and document data. Content you create using the Service — case details, case updates, messages with another user, uploaded documents, appointments, reviews, and incident reports.

Payment data. When you pay a consultation fee, our payment processor, Pesapal, collects your card or mobile-money details directly. We store only the resulting transaction reference, amount, and status — never your full card number or mobile-money PIN.

Assistant conversations. If you use the AI legal assistant, the questions you send it are processed to generate a response. Avoid sharing information in that chat that you would not want processed to answer your question.

Device and usage data. We use privacy-respecting, aggregate analytics (Vercel Analytics) to understand which pages and features are used, and to keep the Service reliable. If you enable notifications, we store a push-notification subscription token for your device.

We use the information above to:

• Create and secure your account, and authenticate you when you sign in;
• Operate the directory, matching, case, messaging, and booking features;
• Verify advocate credentials before a listing is published;
• Process payments and send related receipts and confirmations;
• Send account, case, and appointment notifications you have opted into;
• Maintain the security, integrity, and auditability of the Service, including role-based access control and audit logging for administrator actions;
• Respond to support requests and legal or regulatory obligations; and
• Understand aggregate usage so we can improve the Service.

We process your data because it is necessary to perform our contract with you (providing the Service you signed up for), because you have given consent (for example, to receive notifications or use the AI assistant), because we have a legitimate interest in keeping the Service secure and improving it, or because we are required to by law — consistent with Uganda's Data Protection and Privacy Act, 2019.

We do not sell your personal data. We share it only:

• With the advocate, client, or other user you choose to interact with, to the extent needed to provide that service (for example, your message content, or the details needed to complete a booking);
• With our service providers, who process data on our behalf under contract: Clerk (authentication), Supabase (database hosting), Pesapal (payment processing), ImageKit (file storage and delivery), Cloudflare (bot/abuse protection), and Vercel (hosting and analytics);
• With law enforcement or courts where required by law, to protect someone's safety, or to investigate misuse of the Service — including public-interest incident reports and wanted-person notices, which are visible to the public by design;
• With your consent, or as part of a merger, acquisition, or asset sale, with notice to you first.

We keep your data for as long as your account is active, and afterwards for as long as needed to comply with legal, tax, or regulatory obligations, resolve disputes, and enforce our agreements. If your account is deleted, your profile and role records are removed; case, payment, and audit records that form part of a legal or financial file may be retained for a longer, legally required period even after account deletion.

Access to your data is enforced at the database layer through row-level security, so a given account can only read the records its role is permitted to see. Administrator actions that change roles or records are written to an audit trail. No method of transmission or storage is completely secure, and we cannot guarantee absolute security, but we work to protect your data using industry-standard practices and reputable infrastructure providers.

Subject to applicable law, you have the right to:

• Access the personal data we hold about you;
• Correct inaccurate or incomplete data — most profile fields can be edited directly in the app;
• Request deletion of your account and associated personal data;
• Object to, or ask us to restrict, certain processing;
• Request a portable copy of the data you provided to us; and
• Withdraw consent at any time where processing is based on consent, such as notifications.

To exercise any of these rights, email support@legalfinder.co. We may need to verify your identity before acting on a request.

The Service is not directed at, and we do not knowingly collect personal data from, anyone under 18. If you believe a child has created an account or provided us data, contact us and we will take appropriate steps to remove it.

Some of our service providers process data on infrastructure located outside Uganda. Where that happens, we rely on providers with appropriate contractual and security safeguards for handling your data.

We use essential cookies and local storage set by our authentication provider, Clerk, to keep you signed in, and lightweight, privacy-respecting analytics to understand aggregate usage of the Service. We do not use third-party advertising cookies.

We may update this Privacy Policy from time to time. If we make material changes, we will update the "Last updated" date below and, where appropriate, notify you through the Service. Continuing to use the Service after changes take effect means you accept the updated policy.

Questions, concerns, or data requests relating to this policy can be sent to support@legalfinder.co.