Privacy Policy

1. What we collect

Firm user data: name, email, role within the firm, and a password stored one-way hashed (bcrypt). We never store a readable password.

What the firm records in the system: matters, parties, documents, hearings, tasks, invoices, and messages to clients. This data belongs to the firm that recorded it, not to us.

Security telemetry: sign-in times, IP address and user agent of the device, kept in the audit log.

2. Legal basis and purpose (PDPA)

We process data to perform the contract with the firm, and on legitimate interest to keep the system secure.

For client data the law firm is the data controller and NITITAM is the data processor under Thailand's Personal Data Protection Act B.E. 2562.

We do not sell, trade, or use firm or client data for marketing.

3. Isolation between firms

Each firm's data is separated by PostgreSQL Row-Level Security at the database layer, not merely by conditions in application code. The database account the app runs as cannot bypass it.

A matter marked restricted opens only for people added as members of that matter, even colleagues in the same firm.

4. AI and your data

AI is used to summarise documents, extract fields, and draft client messages. Every output is a draft a person must review before use.

Firm and client data is never used to train AI models, and AI features are off by default.

AI does not predict case outcomes and never files anything on a lawyer's behalf.

5. Storage and security

Document files are stored outside the database with a sha256 checksum, reachable only through short-lived links.

Access to and changes of significant data are written to an audit log the application has no privilege to alter or delete.

Publishing a document to a client is an explicit, per-document action — never a default.

6. Disclosure to third parties

We disclose data to infrastructure providers only as far as running the service requires, and where lawfully ordered by a competent authority.

If a legal order affects a firm's data we will notify the firm as far as the law permits.

7. Data subject rights

Data subjects may request access, a copy, correction, erasure, restriction of processing, and may object to processing, as the law provides.

If you are a client, contact the law firm handling your matter: the firm is the controller and we act on its instructions.

8. Changes to this policy

Material changes are announced to firms through the system before they take effect.