Leaglety collects the information a firm enters into the product: matter records, drafts, sign-off actions, audit entries, and the firm's clause library. We collect contact information for the firm's users (name, email, role) so the firm can assign matters and enforce per-matter access control.

We collect WhatsApp messages and media that the firm routes through the WhatsApp Case Ops module. These are stored against the matter they relate to, not in a separate chat log.

We use firm data to provide the product: to retrieve cause lists, draft documents from the firm's clause library, retrieve and summarize judgments, route WhatsApp messages, and enforce the sign-off. We do not train external AI models on firm data. The drafting engine retrieves from the firm's own clause library, not from a model's general knowledge.

We use contact information to communicate with the firm about the product and security updates. We do not sell firm data or contact information.

Firm data is stored in a multi-tenant system with firm-level data isolation enforced at the data layer. No firm reads another firm's matter. Within a firm, a user only sees the matters they are assigned to. Access control is enforced at the data layer, not in the UI.

Object storage for attachments is encrypted at rest. Backups are encrypted. Data in transit is encrypted. See the Security page for the full posture.

Every change to a case record is recorded in an append-only audit log with actor and timestamp. The firm can show who did what and when. The audit log cannot be edited or deleted by the firm or by Leaglety.

The firm's data is retained for as long as the firm uses the product. When a firm stops using the product, the firm can request export of its data and deletion of its records. The audit log is retained for the period required by applicable regulations, even after other data is deleted.

For privacy questions, email hello@leaglety.com.