Legal
Data Lifecycle
A companion to our Privacy Policy: exactly how long we keep each kind of record, where it lives, and what happens when it is deleted.
| Record type | Where stored | Provider | How long | Deleted how | Survives a backup restore |
|---|---|---|---|---|---|
| Uploaded case-workspace files (FIRs, orders, notices you attach to a case) | Application server disk | Self-hosted (our own VPS, not a third party) | 30 days after upload, or immediately if you delete the case | Automatic nightly purge job removes the file and its database row once the window passes | Yes — if a backup restore ever brings the bytes back, the next purge run removes any copy whose window has already passed before the Service is served from it |
| Extracted text, facts, research points, drafts and chat history | Database (Postgres) | Self-hosted (our own VPS, not a third party) | Kept until you delete it (per item, per case, or by deleting your account) | Your delete action runs immediately; account deletion runs the same erasure across every table that holds your content | Yes — every deletion is written to a separate erasure log kept outside the database, and a restore-time check re-applies any deletion the restored backup does not yet reflect before the database is served |
| Document embeddings (the search index built from your text) | Database (Postgres), self-hosted vector storage | Self-hosted (our own VPS, not a third party — no external embeddings API is used in production) | Tied to the text it was built from: deleted when that item is deleted | Same erasure pass as the row it was derived from | Yes — same erasure-log mechanism as above |
| Rate-limit / abuse-prevention counters (e.g. how many requests or uploads you made today or this month) | Database (Postgres) | Self-hosted (our own VPS, not a third party) | 2 days for most counters; up to 31 days for the monthly judgment-upload allowance, which has to look back that far to enforce a monthly cap | Automatic nightly purge job deletes rows once they age out of the window that counts them | Not applicable — these rows exist to enforce a usage limit, not to record your content, so they are pruned on their own schedule rather than through the account-deletion erasure pass |
| Server access logs (IP address, the page requested, browser type and time) | Application server disk | Self-hosted (our own VPS, not a third party) | 30 days | Automatic — the logging system rotates and deletes entries once they age past 30 days | Not applicable — not backed up, so there is nothing to restore |
| Visitor activity before you sign up (which citation you checked, not its text; page events) | Database (Postgres) | Self-hosted (our own VPS, not a third party) | 90 days if you never sign up; kept with your account (same as your other activity, above) once you do | Automatic nightly purge job removes it if you never signed up; account deletion erases it if you did | Yes — same erasure-log mechanism as above, for a stitched (signed-up) visitor’s rows |
| Citations you asked for that we do not hold, before you sign up (the citation only, against a one-way hash of your visitor id) | Database (Postgres) | Self-hosted (our own VPS, not a third party) | 90 days if you never sign up; becomes a request on your account once you sign up and verify your email | Automatic nightly purge job; account deletion erases any still linked to your visitor id | Yes — same erasure-log mechanism as above |
| Backup copies of the above (nightly database dump and uploaded-file archive) | Our own backup locations, with access restricted, plus one off-site copy outside our primary hosting account. These copies are not encrypted yet; we are switching on encryption for backups and stored case files | Self-hosted infrastructure; the off-site copy is stored with a cloud storage provider under our control | Up to 45 days | Older backup sets are rotated out automatically on a fixed schedule | N/A — this row IS the backup. See "deleted files may remain in backups for up to 45 days" in section 9 of the Privacy Policy: a deletion made today can still be sitting in a backup taken before it, for up to 45 days, until that backup ages out |
A licence card photo you upload to check your advocate-directory profile is a special case: it is never written to disk, to a database, or to a log at all — it exists only for the single check and is then discarded, so it cannot appear in a backup of ours in the first place. See section 4a of the Privacy Policy.