Privacy Policy

Our commitment: LawAOS does not sell firm content, use it for third-party advertising, or use firm documents and client information to train LawAOS-owned models. Customers retain their rights in workspace content.

Account Information: When you create an account, we collect your name, email address, firm name, billing contact details, and subscription metadata. A configured payment processor receives payment-card or bank details used to complete a transaction.

Usage Data: We collect operational information about how the Service is used, including feature events, session and device information, and diagnostic records. We use this information to operate, secure, support, and improve the platform.

Your Content: Customers retain their rights in documents, matter data, client information, and other workspace content. We process that content to provide, secure, troubleshoot, and support the Service, follow authorized instructions, and comply with legal obligations.

Technical Data: We automatically collect device type, browser type, IP address, and operating system information for security monitoring and Service optimization.

We use the information we collect to:

• Provide, maintain, and improve the Service
• Process transactions and send billing-related communications
• Send service-related notifications (e.g., security alerts, maintenance windows)
• Respond to your requests, comments, and questions
• Monitor and prevent fraud, abuse, and security threats
• Generate aggregated analytics to improve the platform

We do not sell firm content, share it with advertisers, or use firm documents and client data to train LawAOS-owned models. AI requests use the provider configured for the feature or firm; provider retention, training, residency, and contractual terms vary.

We do not sell, rent, or trade your personal information. We share data only in the following limited circumstances:

• Service Providers: We use providers for hosting, authentication, communications, payment processing, support, and configured AI features. Their access is limited to the services they provide and is governed by applicable contracts and configuration.
• Legal Requirements: We may disclose information if required by law, subpoena, or court order, or if necessary to protect the rights, property, or safety of LawAOS, our users, or the public.
• Business Transfers: Information may transfer as part of a merger, financing, acquisition, reorganization, or sale of assets, subject to applicable notice and privacy requirements.

We implement technical and organizational measures to protect your data:

• Provider-managed encryption for stored data
• Encrypted transport for application traffic
• Postgres row-level security for per-firm tenant isolation
• Role-based access controls with audit logging
• Server-side handling for payment, email, and AI provider secrets
• Security review, incident handling, and controlled change management

For more detail, see our Security page.

Depending on your jurisdiction, you may have the following rights regarding your personal data:

• Access: Request a copy of the personal data we hold about you.
• Rectification: Request correction of inaccurate or incomplete data.
• Erasure: Request deletion of your personal data (“right to be forgotten”).
• Portability: Request your data in a structured, machine-readable format.
• Restriction: Request that we limit processing of your data in certain circumstances.
• Objection: Object to the processing of your data for specific purposes.

To exercise a right that applies to you, contact privacy@lawaos.com. We may need to verify your identity and will respond within the period required by applicable law.

We use cookies and similar storage that are necessary for authentication, security, preferences, and operation of the Service. We may also use operational analytics to understand reliability and feature use.

We do not use firm workspace content for behavioral advertising. Any non-essential analytics or marketing technology must be disclosed and managed as required by applicable law.

The Service is not directed to children. If you believe a child has provided personal data outside a lawful client or legal-services context, contact privacy@lawaos.com so we can investigate and take appropriate action.

The primary application database is currently hosted in the Asia-Pacific (Sydney) region. Other providers may process operational, authentication, communications, payment, support, or configured AI data in additional regions under their service configuration.

Where cross-border processing requires a transfer mechanism or additional contractual terms, those requirements must be addressed in the applicable deployment and agreement. Contact our team before onboarding if data residency is mandatory.

We may update this Privacy Policy from time to time. We will provide notice of material changes when required by applicable law or contract. The “Last updated” date at the top identifies the latest published revision.

If you have questions or concerns about this Privacy Policy or our data practices, please contact us: