Privacy notice

1. Who is responsible

Olee AI (Pvt) Ltd, a private limited company incorporated in Sri Lanka, operates LawPal. It is the controller of the account and usage data described here and of the case-law library. For the documents and matters a firm puts into the service, the firm is the controller and Olee AI (Pvt) Ltd is its processor: we process them only on the firm’s instructions and for the purpose of providing the service.

Our Data Protection Officer is Thanura Manujith, Olee AI (Pvt) Ltd, who can be reached at info@lawpal.lk.

2. What we hold

Your account

Your name, email address, and - if you give it - a telephone number, an address and a language preference. A hashed password, or the record of a sign-in through Google or Microsoft. Your two-factor enrolment, if you set one up.

Your firm’s records

Whatever you enter: matters and the parties named on them, diary dates, appeal clocks, journal entries, file notes, drafts, playbooks, review tables, client spaces, and the documents you upload or forward in by email. These frequently contain other people’s personal data - your clients’, and opposing parties’ - which is why the rest of this notice is written as carefully as it is.

What you asked, and what is kept of the answer

The text of a question put to the research or the ask screen, who asked it, when, on which matter, and how many tokens it spent. The written answer on those two screens is shown to you and not stored.

Some generated text is stored, because keeping it is the purpose of the feature:

• Client spaces: the questions a client asks in a client space and the answers given there, so the firm and the client can both see the exchange.
• Review tables: the answer written into each cell, so the table can be reopened, checked and exported.
• Document summaries: the summary of an uploaded document, so it is not written again every time the document is opened.

These are kept with the firm’s records and are deleted with them.

What the service did

An activity line for the things that matter: a matter opened, a clock moved, a draft approved, a member invited, a document tagged, an email that arrived and the address it came from. Page views within the app. Reminder sends, so a reminder cannot fire twice. Payments, as a record of what was bought - never card details.

Ordinary technical logs, cookies and browser storage

Our hosting and database providers keep the usual request and error logs, which contain IP addresses. We set cookies only to keep you signed in and to remember a display preference. Some screens keep an unsent draft in your browser’s own storage on your device, so it survives a reload; that copy stays on the device and is not sent to us until you save it. We run no advertising, analytics or cross-site tracking.

3. Why we hold it

• To provide the service you asked for - performance of our contract with you. Almost everything falls here.
• To keep it secure and account for what happened - our legitimate interest, and yours: the activity log is what shows who did what.
• To bill correctly - our legitimate interest and our legal obligation to keep proper accounts.
• To answer you - when you write to us, we keep the correspondence so the next person knows what was said.

We do not sell personal data, we do not share it for advertising, and we take no automated decision about you that has a legal effect.

4. Who else processes it

Running this service means using other companies’ infrastructure. This is the complete list of our sub-processors, and the same list appears on the security page with what each one handles:

• Vercel - runs the application.
• Supabase - the database, sign-in, sessions and the search index.
• Cloudflare R2 - storage of the files you upload and the files that arrive by email.
• Cloudflare Turnstile - the automated check at sign-up that a person, not a script, is creating the account.
• Google (Vertex AI) - reads and indexes uploaded documents, ranks search results, and writes answers, summaries, review-table answers and drafts.
• Google Drive - only when a firm connects its own Drive, and only for the files the firm chooses to bring in.
• Google Fonts - serves a set of interface icons on the sign-in pages, which means your browser requests them from Google.
• ZeptoMail - sends email.
• Dialog Axiata (eSMS) - sends text messages in Sri Lanka.
• Twilio - sends text messages, only when a firm connects its own Twilio account.
• Meta (WhatsApp Business) - sends WhatsApp reminders, where a firm uses them.
• PayHere - takes card payments. Card details never reach us.

Two things worth being explicit about. First, a document reaches Google when it is uploaded, not only when a question is asked: it is sent to be read, divided into passages, indexed, embedded for search and summarised. Passages are sent again when a question needs them. Second, we do not train models on your material, and under Google Cloud’s terms Google does not use customer data sent through Vertex AI to train its models.

5. Where it is processed, and transfers out of Sri Lanka

Section 26 of the Personal Data Protection Act, No. 9 of 2022 governs the processing of personal data outside Sri Lanka. Most of LawPal’s processing takes place outside Sri Lanka, and this is where:

• India - Supabase (database, sign-in and search index) in Mumbai, region ap-south-1, and Vercel (the application) in Mumbai, region bom1.
• No fixed country: Google - Vertex AI is called on its global endpoint, which means Google may process a request in any of its regions. We cannot name one country for it.
• No fixed country: Cloudflare - R2 storage and Turnstile run on Cloudflare’s network, which chooses the location automatically.
• Other providers - ZeptoMail, Twilio, Meta, Google Drive and Google Fonts process data in the countries their own terms state. Dialog Axiata and PayHere operate in Sri Lanka.

The safeguard for each transfer is the provider’s data processing terms, which bind it to process the data only to provide its service to us and to keep it secure. For Google, that is the Google Cloud data processing addendum, and Google Cloud’s terms do not permit it to train its models on customer data. For firm uploads the firm remains the controller and Olee AI (Pvt) Ltd its processor, and each provider above acts as our sub-processor on those terms.

6. Who inside your firm can see what

• By default, members of a workspace can reach that workspace’s matters. That is how a practice works.
• A matter can be set to named people only. It then does not appear in another member’s lists, searches or answers.
• An admin can read the firm’s activity log and its spend. An admin cannot read members’ messages.
• A client space is a private link. Anyone holding that link can see what was shared into it, which is why it can be replaced or switched off in one press, and why the page tells the client not to forward it.
• A folder opened to email can be written to by anyone who learns its address. What arrives is stored and indexed and nothing else, and the sender is recorded on the document.

7. How long we keep it

• Your firm’s records and documents, including stored summaries, review-table answers and client-space exchanges: while the account is open, and until you delete them.
• The question log, page views and the activity log: 12 months by default, unless the firm sets a different period in Settings. Anything older is deleted nightly.
• Reminder records: while the account is open.
• Backups: our database backups expire after 30 days, so a deleted record leaves the backups within 30 days of its deletion.
• Billing records: as long as the law requires us to keep accounts.
• After an account is closed: we delete the workspace’s records and documents, keeping only what we must for accounts and for defending a claim.

8. Personal data breaches

If we become aware of a personal data breach affecting data we hold, we contain it, establish what was affected, and notify the affected firms and the Data Protection Authority of Sri Lanka without undue delay and in any event within 72 hours of becoming aware of it. The notice says what happened, what data was involved, what we have done, and what we are doing next. Where a breach concerns a firm’s records, we give the firm what it needs to meet its own obligations as controller.

9. Your rights

Under the Personal Data Protection Act, No. 9 of 2022 you may ask for a copy of the personal data we hold about you, ask us to correct it, ask us to delete it, object to a use of it, or withdraw a consent you gave. Two of those you can exercise yourself without asking anybody: the export on Settings gives you everything the firm holds, and the deletion on Settings closes the account and removes it.

For anything else, write to our Data Protection Officer at info@lawpal.lk. We will answer within 30 days. If you are not satisfied, you may complain to the Data Protection Authority of Sri Lanka.

If your request is about personal data a law firm holds about you in their matter, we have to send you to that firm: they are the controller of it and we process it on their instructions. We will tell you that rather than quietly doing nothing.

10. Judgments that name people

The library holds judgments of the courts, which are public court documents, and a judgment names the parties, the witnesses and sometimes a good deal more. If something about you in it is wrong, or you believe it should not be there, the removal page is how you reach us, and our Data Protection Officer handles every request.

11. Children

LawPal is a professional tool and is not intended for anyone under 18. We do not knowingly hold an account for a child.

A law firm’s records may contain personal data about minors - a party, a witness, or a child in a family matter. That data is the firm’s, the firm is its controller, and we process it only on the firm’s instructions.

12. When this changes

If we change something that matters, we will email the firm’s admins and change the date at the top of this page. The current version took effect on 15 October 2026.

Who we are, for the avoidance of doubt

LawPal is operated by Olee AI (Pvt) Ltd, and every notice under this document reaches us at info@lawpal.lk. A person reads it, and we answer within the times set out above.

This document is written in English. If we publish a translation and the two disagree, the English is the one that governs.