Privacy Policy

1. Introduction

Startup Lab 24, Inc. (“we,” “us,” or “our”) operates Lawyerly (“the Service”). This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our Service.

2. Information We Collect

Information you provide:

• Account information: Name, email address, and authentication data when you create an account. Authentication is self-hosted (better-auth); passwords are hashed at rest and never stored in plaintext. There is no third-party authentication processor.
• Research queries: The legal questions and searches you submit to the Service
• Generated documents: The documents you create using our document generation feature
• Uploaded case documents: Files you attach to a case workspace (such as FIRs, court orders, and notices) and judgments you upload for analysis — see “Uploaded documents” below for how long we keep them
• Payment information: Billing details processed securely by Stripe (we do not store card numbers)
• Advocate profile: If you choose to create a profile in our public advocate directory, the details you enter — your name, username, bar council, enrolment number, self-declared licence status, practice areas, city, biography, and any contact details you switch on — see “The advocate directory” below

Information collected automatically:

• Usage data: Pages visited, features used, query frequency, and session duration
• Device information: Browser type, operating system, and device identifiers
• Analytics: First-party usage metrics derived from your account activity (pages visited, features used, query frequency). No third-party analytics or tracking cookies

3. How We Use Your Information

We use collected information to:

• Provide, maintain, and improve the Service
• Process your research queries and generate documents
• Manage your account and process payments
• Enforce usage limits and prevent abuse
• Send service-related communications (account updates, billing notices)
• Analyze usage patterns to improve our knowledge graph and AI models
• Comply with legal obligations

4. AI Processing

Your research queries are processed by third-party AI models (currently OpenAI, with OpenAI as a fallback) to generate responses. Queries are sent to the AI provider for processing and are subject to their respective privacy policies. Your queries and documents are never used to train AI: we do not train our own models on them, and our AI providers do not train on data sent through their APIs. See how Lawyerly works for the full model disclosure and the data lifecycle table for exactly how long each kind of record is kept.

Research queries may be temporarily logged for rate limiting and quality assurance purposes. Chat history is stored in your account for your convenience and can be deleted by you at any time.

Uploaded documents

Lawyerly is a processing tool, not a document store. Documents you upload are processed to extract their text so the Service can research and draft from them:

• Case files (FIRs, orders, notices attached to a case workspace) are kept on our servers for 30 days after upload, then deleted automatically. Download anything you need to keep. Deleting a case deletes its files immediately.
• Judgments you upload for analysis: we retain the extracted text and analysis as part of our legal research database; the original file is not retained.
• Google (United States): AI processing of the text of judgments you upload, to extract the citations, parties and statute references that go into our legal research database. The document text is sent there in sections as it is read.
• Text from the other documents you upload is sent to the AI providers listed in section 6 for processing under the same terms as research queries, and are not used to train AI.

4a. The advocate directory

A profile in our advocate directory is optional and is not created for you. Nothing you enter is published until you publish it yourself, and each contact detail — phone, WhatsApp, email, address — is shown only if you switch that one on. A published profile is a public web page: anyone can open it, and search engines may index it. Unpublish it at any time and the page stops being served; deleting your account deletes the profile with it.

You may also upload a photograph of your bar council licence card so we can check that it names you and carries the enrolment number on your profile. The image is sent to the AI provider listed in section 6 for that one check and is not kept — not by us and not in any backup; only the outcome of the check is stored on your profile. The check is a plausibility check, not confirmation from a bar council: we do not contact any council, and the licence status shown on your page is the one you declared.

5. Data Storage and Security

Your data is stored on secure servers. Your data is stored on managed cloud infrastructure (Hetzner). We implement appropriate technical and organizational measures to protect your information, including:

• Encrypted data transmission (HTTPS/TLS)
• Self-hosted authentication (better-auth); passwords are hashed at rest and there is no third-party auth processor
• Payment processing via Stripe (PCI DSS compliant)
• Regular security assessments

6. Third-Party Services

We use the following third-party services that may process your data:

• Stripe: Payment processing and subscription management
• OpenAI (primary) and OpenAI (fallback): AI processing for research queries and document generation
• Google: AI processing of the text of judgments you upload, to extract the citations, parties and statute references that go into our legal research database
• Cloudflare: Content delivery and DDoS protection

Each third-party service operates under its own privacy policy. We encourage you to review their policies.

7. Data Sharing

We do not sell your personal information. We may share your information only in the following circumstances:

• With third-party service providers as described above (for service delivery only)
• When required by law, court order, or government request
• To protect our rights, property, or safety, or that of our users
• In connection with a merger, acquisition, or sale of assets (with prior notice)

8. Your Rights

You have the right to:

• Access: Request a copy of the personal data we hold about you
• Correction: Request correction of inaccurate personal data
• Deletion: Request deletion of your account and associated data
• Export: Request an export of your research history and generated documents
• Opt-out: Opt out of non-essential communications

To exercise any of these rights, contact us at support@startuplab24.com.

9. Data Retention

We retain your account data for as long as your account is active. Chat history and generated documents are retained until you delete them or close your account. After account deletion, we remove your personal data within 30 days, except where retention is required by law.

Files attached to a case workspace are deleted automatically 30 days after upload (see “Uploaded documents” above). Extracted text from judgments you upload for analysis is retained as part of our legal research database.

An advocate profile is retained until you unpublish or delete it, or until your account is deleted. A licence card image is not retained at all: it is used for the single check described in section 4a and then discarded.

Anonymized, aggregated usage data may be retained indefinitely for analytics and service improvement.

Deleted files may remain in encrypted backups for up to 45 days. Deleting your data marks it for deletion everywhere: if a backup is ever restored, that deletion is automatically re-applied to the restored copy before it is used to serve the Service. See the data lifecycle table for the retention period of every record type we hold.

10. Cookies

The Service uses essential cookies for authentication and session management. We do not use third-party analytics or tracking cookies; the usage metrics described in section 2 are computed from your own account activity, not from a cookie. You can control cookie preferences through your browser settings.

11. Children's Privacy

The Service is not intended for individuals under 18 years of age. We do not knowingly collect personal information from children.

12. International Users

The Service is operated from the United States. If you access the Service from outside the United States, your information may be transferred to and processed in the United States, where data protection laws may differ from those in your jurisdiction.

13. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated policy on this page and updating the “Last updated” date. Continued use of the Service after changes constitutes acceptance.

14. Contact Us

For questions about this Privacy Policy, contact us at support@startuplab24.com.