Privacy Policy

This Privacy Policy explains how LegalFinder ("LegalFinder", "we", "us", "our") collects, uses, shares, and protects personal data when you use our website, desktop application, and mobile applications (together, the "Service"). It applies to clients, advocates, police and judiciary users, and administrators alike, except where a section says otherwise. It should be read together with our Terms of Service.

LegalFinder, based in Kampala, Uganda, is the data controller responsible for your personal data under this policy. You can reach us at support@legalfinder.co for any question about this policy or how your data is handled.

Account and identity data. When you sign up, our authentication provider, Clerk, collects your name, email address, and password (your password itself is never visible to or stored by LegalFinder). If you sign in with Google or another social provider, we receive the basic profile information that provider shares with us. We store your requested and granted role (client, advocate, police, judiciary, or administrator).

Profile and directory data. For advocates, this includes headline, firm, practice areas, languages, fees, bar number, and licence status shown in the public directory.

Professional verification. If you apply for an advocate, police or judiciary account, we collect the details and documents the application asks for — for example your Roll of Advocates number and practising certificate, your force or staff number, a letter from your station or court, and your National ID or passport. They are stored privately and seen only by you and our administrators, who use them to decide whether to approve your account.

Case, messaging, and document data. Content you create using the Service — case details, case updates, messages with another user, uploaded documents, appointments, reviews, and incident reports. If you report a message, review, or person, we keep your report with a copy of what you reported so our team can act on it; if you block someone, we keep that block until you remove it.

Payment data. When you pay a consultation fee, our payment processor, Pesapal, collects your card or mobile-money details directly. We store only the resulting transaction reference, amount, and status — never your full card number or mobile-money PIN. Advocates who are paid through the Service give us the mobile-money number or bank account their fees should be sent to; we store those payout details and pass them to our payout processor, Flutterwave, when a payout is made.

AI assistant and AI-assisted drafting. If you use the AI legal assistant or AI-assisted document drafting, what you type into them — your questions, your drafting instructions, and the draft you are revising — is sent to Anthropic, the provider of the Claude AI model, to generate a response. Your name, email address, and account details are not sent with it. We ask for your permission before these features are first used, and you can withdraw it at any time in Settings. We do not keep a copy of your conversation with the assistant; a draft you choose to save is stored with your other documents. Avoid sharing information in these features that you would not want processed to answer your request.

Device and usage data. We use privacy-respecting, aggregate analytics (Vercel Analytics) to understand which pages and features are used, and to keep the Service reliable. If you enable notifications, we store a push-notification subscription token for your device.

We use the information above to:

• Create and secure your account, and authenticate you when you sign in;
• Operate the directory, matching, case, messaging, and booking features;
• Verify advocate credentials before a listing is published;
• Process payments and send related receipts and confirmations;
• Send account, case, and appointment notifications you have opted into;
• Maintain the security, integrity, and auditability of the Service, including role-based access control and audit logging for administrator actions;
• Respond to support requests and legal or regulatory obligations; and
• Understand aggregate usage so we can improve the Service.

We process your data because it is necessary to perform our contract with you (providing the Service you signed up for), because you have given consent (for example, to receive notifications or use the AI assistant), because we have a legitimate interest in keeping the Service secure and improving it, or because we are required to by law — consistent with Uganda's Data Protection and Privacy Act, 2019.

We do not sell your personal data. We share it only:

• With the advocate, client, or other user you choose to interact with, to the extent needed to provide that service (for example, your message content, or the details needed to complete a booking);
• With our service providers, who process data on our behalf under contract: Clerk (authentication), Supabase (database hosting), Pesapal (payment processing), Flutterwave (payouts to advocates), Anthropic (the AI model behind the assistant and AI-assisted drafting), ImageKit (file storage and delivery), Cloudflare (bot/abuse protection), and Vercel (hosting and analytics);
• With law enforcement or courts where required by law, to protect someone's safety, or to investigate misuse of the Service — including public-interest incident reports and wanted-person notices, which are visible to the public by design;
• With your consent, or as part of a merger, acquisition, or asset sale, with notice to you first.

We keep your data for as long as your account is active, and afterwards for as long as needed to comply with legal, tax, or regulatory obligations, resolve disputes, and enforce our agreements. If your account is deleted, your sign-in account, profile, and role records are removed, together with an advocate's directory listing and payout details, any blocks you set or that name you, and any application for a professional account with its documents; case, payment, and audit records that form part of a legal or financial file, and reports of abuse, may be retained for a longer, legally required period even after account deletion. How to delete your account lists exactly what is removed and what is kept.

Access to your data is enforced at the database layer through row-level security, so a given account can only read the records its role is permitted to see. Administrator actions that change roles or records are written to an audit trail. No method of transmission or storage is completely secure, and we cannot guarantee absolute security, but we work to protect your data using industry-standard practices and reputable infrastructure providers.

Subject to applicable law, you have the right to:

• Access the personal data we hold about you;
• Correct inaccurate or incomplete data — most profile fields can be edited directly in the app;
• Request deletion of your account and associated personal data — you can do this yourself in Settings, as described in How to delete your account;
• Object to, or ask us to restrict, certain processing;
• Request a portable copy of the data you provided to us; and
• Withdraw consent at any time where processing is based on consent, such as notifications or the AI features.

To exercise any of these rights, email support@legalfinder.co. We may need to verify your identity before acting on a request.

The Service is not directed at, and we do not knowingly collect personal data from, anyone under 18. If you believe a child has created an account or provided us data, contact us and we will take appropriate steps to remove it.

Some of our service providers process data on infrastructure located outside Uganda. Where that happens, we rely on providers with appropriate contractual and security safeguards for handling your data.

We use essential cookies and local storage set by our authentication provider, Clerk, to keep you signed in, and lightweight, privacy-respecting analytics to understand aggregate usage of the Service. We do not use third-party advertising cookies.

We may update this Privacy Policy from time to time. If we make material changes, we will update the "Last updated" date below and, where appropriate, notify you through the Service. Continuing to use the Service after changes take effect means you accept the updated policy.

Questions, concerns, or data requests relating to this policy can be sent to support@legalfinder.co.