Privacy Policy

Lawzo ("we", "us", "our", or the "Platform") is operated by Qbitx Systems and provides the website at lawzo.pk and related mobile applications. This Privacy Policy describes how we collect, use, store, share, and protect your personal data when you use our legal marketplace, AI legal research tools, consultation booking, messaging, and payment services.

By creating an account or using our services, you agree to the practices described in this policy. If you do not agree, please do not use the Platform.

1. Information We Collect

1.1 Information You Provide

Client accounts: First name, last name, email address, phone number (+92 format), city, and password. If you sign in with Google, we receive your Google account ID, name, and verified email.

Lawyer accounts: All client data plus: Bar Council/bar number, professional bio, experience level, qualifications, practice areas, consultation fee, consultation mode preference (Video Call, In-Person, or Both), slot duration, buffer time, and cancellation policy preference.

Document uploads: Profile photographs (JPG/PNG, max 2 MB), educational degree certificates, and Bar Council certificates. Lawyers may also upload case-related documents during consultations.

Payment information: When you make or receive payments through the Platform, our payment processor (PayFast & EasyPaisa) collects card numbers, billing addresses, and transaction details. Lawzo does not store full card numbers on its servers.

Communications: Messages exchanged between clients and lawyers via the Platform's secure messaging feature, including any attached documents.

AI interactions: Questions, legal facts, case descriptions, and other text you submit to Lawzo AI, along with the AI-generated responses.

1.2 Information Collected Automatically

Session data: IP address, browser user agent, device type, operating system, and session timestamps are logged each time you sign in.

Usage data: Pages visited, features used, search queries, time spent, and interaction patterns.

Cookies & local storage: We use essential cookies and browser local storage for authentication tokens (JWT), session management, and remembering user preferences. We do not use third-party advertising cookies.

1.3 Information from Third Parties

Google OAuth: If you sign in with Google, we receive your Google user ID, email, and name from Google Identity Services.

Bar Council registries: We may verify lawyer credentials against publicly available Pakistan Bar Council records.

2. How We Use Your Information

We use the collected data for the following purposes:

• Account creation & authentication: To register your account, verify your identity via email/phone OTP or Google OAuth, and issue authentication tokens.
• Marketplace operation: To display lawyer profiles to clients, enable search and filtering by practice area, city, fee, and rating.
• Booking & scheduling: To manage consultation appointments, send reminders, and handle cancellations and rescheduling.
• Payment processing: To process escrow-protected payments, hold funds until consultation completion, and facilitate lawyer payouts.
• AI legal research: To process your legal questions through our AI system (powered by Anthropic Claude), generate citation-backed responses referencing PPC, CrPC, the Constitution of Pakistan, and case law.
• Video consultations: To facilitate encrypted video calls between clients and lawyers.
• Secure messaging: To enable communication between matched clients and lawyers, including document sharing.
• Lawyer verification: To verify Bar Council credentials, review uploaded documents, and approve or reject lawyer profiles.
• Platform safety: To detect fraud, prevent abuse, enforce our Terms of Use, and respond to legal requests.
• Service improvement: To analyze usage patterns, fix bugs, and improve platform features.
• Notifications: To send transactional emails (verification codes, booking confirmations, profile approval/rejection, payment receipts).

3. Legal Basis for Processing

We process your personal data on the following legal grounds:

• Contract performance: Processing necessary to deliver the services you signed up for (account management, bookings, payments, consultations).
• Consent: Where you explicitly opt in, such as AI interactions or marketing communications. You may withdraw consent at any time.
• Legitimate interest: Platform security, fraud prevention, analytics, and service improvement.
• Legal obligation: Compliance with applicable Pakistani laws, court orders, or regulatory requirements.

4. Sensitive & Legal Data

Given the nature of legal services, you may share sensitive information with us or with lawyers through the Platform, including:

• Details of legal disputes, criminal matters, family proceedings, or financial situations
• Government-issued identification documents (CNIC, Bar Council certificates)
• Case-related evidence and documents

We treat all legal case data as highly confidential. This data is:

• Encrypted in transit using TLS 1.2+
• Accessible only to the involved client, their matched lawyer, and authorized Lawzo administrators for dispute resolution
• Never sold, rented, or shared with third parties for marketing purposes
• Not used to train AI models — your case data submitted during consultations is not fed back into AI training

5. AI-Powered Services & Data Processing

Lawzo AI uses third-party large language model services (Anthropic Claude) to provide legal research assistance. When you use Lawzo AI:

• Your questions and submitted facts are sent to Anthropic's API for processing
• Responses are generated based on Pakistani legal databases (PPC, CrPC, Constitution, case law)
• Anthropic processes data per their data processing agreement with Lawzo and does not use your inputs to train their models
• AI interactions are stored on Lawzo servers for quality improvement and to provide conversation history
• AI responses are informational only and do not constitute legal advice or create an attorney-client relationship

6. Payment & Financial Data

Payments on Lawzo are processed through PayFast & EasyPaisa, a PCI DSS Level 1 certified payment processor.

• Escrow model: Client payments are held in escrow until the consultation is completed. Funds are released to the lawyer after successful delivery.
• Card data: Full card numbers and CVV/CVC are collected and processed exclusively by PayFast. Lawzo never stores, processes, or has access to full card details.
• Transaction records: We store transaction IDs, amounts, timestamps, and status for bookkeeping, dispute resolution, and refund processing.
• Refunds: Cancellations made 2+ hours before the appointment are eligible for full refunds, processed back through PayFast.
• Lawyer payouts: Earnings are transferred to lawyers' registered bank accounts within 24 hours of consultation completion.

7. Data Sharing & Third-Party Processors

We share personal data only with the following categories of recipients, and only to the extent necessary:

We do not sell personal data to advertisers, data brokers, or any third party.

8. Data Retention

• Account data: Retained for as long as your account is active. Upon account deletion, personal data is permanently erased within 30 days, except where retention is required by law.
• Verification codes: Email and phone OTP codes expire after 5 minutes and are automatically purged.
• Authentication tokens: JWT tokens expire after 24 hours and are stateless (not stored server-side).
• Session logs: IP addresses and user agent data are retained for 12 months for security and fraud prevention.
• Transaction records: Payment and booking records are retained for 7 years to comply with Pakistani tax and financial regulations.
• Lawyer documents: Bar certificates and degree documents are retained for the duration of the lawyer's active profile, plus 2 years after account closure for regulatory compliance.
• AI conversation history: Retained for 12 months, then automatically deleted unless the user deletes earlier.
• Messages & case documents: Retained for 3 years after the last consultation, then permanently deleted.
• Video consultations: Not recorded or stored by default. If recording is enabled by both parties, recordings are retained for 90 days.

9. Data Security

We implement industry-standard security measures to protect your data:

• Encryption in transit: All data transmitted between your device and our servers is encrypted using TLS 1.2 or higher.
• Encryption at rest: Database backups and file storage are encrypted using AES-256.
• Password security: Passwords are hashed using bcrypt with per-user salts. We never store plaintext passwords.
• Access control: Role-based access ensures clients see only their own data, lawyers see only their profile and matched client information, and admins access data only for platform operations.
• Sensitive parameter filtering: Passwords, tokens, OTPs, API keys, certificates, SSNs, and CVVs are filtered from all server logs.
• Video encryption: All video consultations are end-to-end encrypted. Lawzo cannot access the content of live calls.
• Document security: Uploaded files are served via signed, time-limited URLs. Direct public access is not permitted.
• Infrastructure: Hosted on industry-standard cloud infrastructure with firewalls, intrusion detection, and automated vulnerability scanning.

10. Your Rights

You have the following rights regarding your personal data:

• Access: Request a copy of all personal data we hold about you.
• Correction: Request correction of inaccurate or incomplete data.
• Deletion: Request deletion of your account and personal data, subject to legal retention requirements.
• Data portability: Request an export of your data in a machine-readable format (JSON).
• Withdraw consent: Withdraw consent for optional processing (e.g., AI interactions, marketing emails) at any time without affecting prior lawful processing.
• Restriction: Request that we limit processing of your data while a dispute or complaint is being resolved.
• Objection: Object to processing based on legitimate interests.

To exercise any of these rights, contact us at [email protected]. We will respond within 15 business days.

11. Children's Privacy

Lawzo is not intended for use by individuals under 18 years of age. We do not knowingly collect personal data from minors. If we become aware that we have collected data from a child under 18, we will promptly delete it and terminate the associated account.

12. Cookies & Tracking

We use the following types of cookies and browser storage:

• Essential cookies: Required for authentication, session management, and security. Cannot be disabled.
• Preference storage: Local storage for UI preferences (e.g., theme settings). Not shared with third parties.

We do not use advertising cookies, tracking pixels, or third-party analytics that identify individual users. We do not participate in cross-site tracking or retargeting.

13. Attorney-Client Privilege

Communications between clients and lawyers through the Platform's messaging and video consultation features may be protected by attorney-client privilege under Pakistani law. Lawzo:

• Does not monitor, read, or analyze the content of private messages between clients and their lawyers
• Will not disclose privileged communications except when compelled by a valid court order
• Provides end-to-end encryption for video calls to preserve the confidentiality of consultations
• Is not a party to the attorney-client relationship and does not waive privilege by facilitating the communication

Important: Communications with Lawzo AI do not create an attorney-client relationship and are not protected by attorney-client privilege.

14. Data Breach Notification

In the event of a data breach that compromises the security of your personal data:

• We will notify affected users via email within 72 hours of confirming the breach
• We will report the breach to relevant regulatory authorities as required by applicable law
• We will provide details of the nature of the breach, the data affected, and the steps we are taking to mitigate harm
• We will offer guidance on steps you can take to protect yourself (e.g., password changes)

15. International Data Transfers

Your data is primarily stored on servers. However, some data may be transferred to and processed in other countries through our third-party service providers (e.g., OpenAi in the US, AWS data centers). Where such transfers occur:

• We ensure appropriate data processing agreements are in place
• We verify that recipients maintain adequate security standards
• Transfers are made only to the extent necessary for service delivery

16. Dispute Resolution & Complaints

If you believe your privacy rights have been violated, you may:

1. Contact our privacy team at [email protected]
2. File a complaint with the relevant data protection authority in Pakistan
3. Pursue mediation or legal remedies under applicable Pakistani law, including the Prevention of Electronic Crimes Act (PECA) 2016

17. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes:

• We will update the "Last updated" date at the top of this page
• We will notify registered users via email at least 15 days before changes take effect
• We will post a prominent notice on the Platform
• Continued use of the Platform after the effective date constitutes acceptance of the updated policy

18. Contact Us

For privacy-related inquiries, data access requests, or complaints: