Privacy notice
What we hold, why we hold it, who else touches it, and how to get it back or have it deleted. Written for a practice that has a professional duty of confidence to keep.
1. Who is responsible
Olee AI LLCoperates LawPal and is the controller of the personal data described here. For the documents and matters a firm puts into the service, the firm is the controller and we process them on the firm’s instructions.
2. What we hold
Your account
Your name, email address, and - if you give it - a telephone number, an address and a language preference. A hashed password, or the record of a sign-in through Google or Microsoft. Your two-factor enrolment, if you set one up.
Your firm’s records
Whatever you enter: matters and the parties named on them, diary dates, prescription clocks, file notes, drafts, playbooks, review tables, client spaces, and the documents you upload or forward in by email. These frequently contain other people’s personal data - your clients’, and opposing parties’ - which is why the rest of this notice is written as carefully as it is.
What you asked, and what it cost
The text of a question put to the research or the ask screen, who asked it, when, on which matter, and how many tokens it spent. The prose of the answer is not stored - keeping it would put a second copy of privileged material in a table an admin can read.
A firm can choose how long the question log is kept: for as long as the account exists, a year, six months, three months or one month. Anything older is deleted nightly. The audit trail of who did what is not aged out by that setting, because that record protects the firm rather than exposes it.
What the service did
An audit line for the things that matter: a matter opened, a clock moved, a draft approved, a member invited, a document tagged, an email that arrived and the address it came from. Reminder sends, so a reminder cannot fire twice. Payments, as a record of what was bought - never card details.
Ordinary technical logs
Our hosting and database providers keep the usual request and error logs, which contain IP addresses. We use cookies only to keep you signed in and to remember a display preference; we run no advertising or cross-site tracking.
3. Why we hold it
- To provide the service you asked for - performance of our contract with you. Almost everything falls here.
- To keep it secure and account for what happened - our legitimate interest, and yours: the audit log is what shows who did what.
- To bill correctly - our legitimate interest and our legal obligation to keep proper accounts.
- To answer you - when you write to us, we keep the correspondence so the next person knows what was said.
We do not sell personal data, we do not share it for advertising, and we take no automated decision about you that has a legal effect.
4. Who else processes it
Running this service means using other companies’ infrastructure. Every one of them is listed on the security page, with what it handles: the host, the database, document storage, the search index, the model that writes readings and drafts, the re-ranker, the email and SMS senders, the WhatsApp sender where a firm uses it, and the payment gateway.
Two things worth being explicit about. First, passages of your documents reach a model provider at the moment a question is asked, because that is how the answer is written from your own material rather than from a guess. Second, we do not train models on your material, and we use these providers under business terms that do not permit them to train on content sent through their APIs.
Some of these providers are outside Sri Lanka, principally in the United States and the European Union. Where personal data leaves the country it does so under the provider’s standard contractual protections.
5. Who inside your firm can see what
- By default, members of a workspace can reach that workspace’s matters. That is how a practice works.
- A matter can be set to named people only. It then does not appear in another member’s lists, searches or answers.
- An admin can read the firm’s audit log and its spend. An admin cannot read members’ messages.
- A client space is a private link. Anyone holding that link can see what was shared into it, which is why it can be replaced or switched off in one press, and why the page tells the client not to forward it.
- A folder opened to email can be written to by anyone who learns its address. What arrives is stored and indexed and nothing else, and the sender is recorded on the document.
6. How long we keep it
- Your firm’s records and documents: while the account is open, and until you delete them.
- The question log: as the firm chooses - see section 2.
- The audit log and reminder records: while the account is open.
- Billing records: as long as the law requires us to keep accounts.
- After an account is closed: we delete the workspace’s records and documents, keeping only what we must for accounts and for defending a claim.
7. Your rights
Under the Personal Data Protection Act, No. 9 of 2022 you may ask for a copy of the personal data we hold about you, ask us to correct it, ask us to delete it, object to a use of it, or withdraw a consent you gave. Two of those you can exercise yourself without asking anybody: the export on Settings gives you everything the firm holds, and the deletion on Settings closes the account and removes it.
For anything else, write to hi@lawpal.lk. We will answer within 30 days. If you are not satisfied, you may complain to the Data Protection Authority of Sri Lanka.
If your request is about personal data a law firm holds about you in their matter, we have to send you to that firm: they are the controller of it and we process it on their instructions. We will tell you that rather than quietly doing nothing.
8. Judgments that name people
The library holds judgments as the courts published them, and a judgment names the parties, the witnesses and sometimes a good deal more. That material is public record, delivered in open court. If something about you in it is wrong, or you believe it should not be there, the removal page is how you reach us, and a person reads every request.
9. Children
LawPal is a professional tool and is not intended for anyone under 18. We do not knowingly hold an account for a child.
10. When this changes
If we change something that matters, we will email the firm’s admins and change the date at the top of this page. The current version took effect on 13 September 2026.
Who we are, for the avoidance of doubt
LawPal is operated by Olee AI LLC, and every notice under this document reaches us at hi@lawpal.lk. A person reads it, and we answer within the times set out above.
This document is written in English. If we publish a translation and the two disagree, the English is the one that governs.