Privacy Policy
Last updated 30 October 2026 · Effective 28 October 2026
1. Who we are
Lawdex (https://lawdex.app) is a legal practice management service for Nigerian law firms and chambers. It is owned and operated by Kian Consult Ltd, a company registered in Nigeria with the Corporate Affairs Commission under RC 7617713, whose registered address is No. 6, Eesa Tuntun, Ido Osun, Osun State, Nigeria. In this policy "Kian Consult", "we", "us" and "our" mean Kian Consult Ltd.
This policy explains what personal data we collect, why, on what lawful basis, who we share it with, where it is stored, how long we keep it, how we protect it and the rights you have. It is written to meet the Nigeria Data Protection Act 2023 (the NDPA) and the NDP Act General Application and Implementation Directive 2025 (the GAID).
Privacy at Kian Consult is handled by our Data Protection Officer, Kian Consult Ltd, who can be reached at thekianconsult@gmail.com. Use this address for any privacy question, any request to exercise your rights and any complaint. For product support write to lawdexapp@gmail.com or message us on WhatsApp.
2. Our role: controller and processor
We play two different roles, and which one applies decides who answers your questions about a piece of data.
- We are the controller for the data we need to run Lawdex as a business: user accounts and sign in, billing and subscriptions, this website, our careers process, support and contact requests, security and audit logs, service notices and product news email. We decide why and how this data is used.
- We are a processor for each subscribing firm for everything the firm puts into its workspace: matters, clients and other parties, documents and files, hearings and tasks, finances, messages, meetings, and the text sent to the AI tools. The firm is the controller of that data. We process it only to provide the service and only on the firm’s documented instructions, under the Data Processing Agreement in Schedule 1 of our Terms.
If you are a client, witness or other person named in a firm’s records, please contact that firm first. If you contact us about such data, we will pass your request to the firm within 2 business days and help it respond. The Data Processing Agreement is at lawdex.app/terms#dpa.
3. The data we collect and where it comes from
| Category | What it includes | Source |
|---|---|---|
| Account | First and last name, email address, firm name, role, password (stored only as a hash), two factor authentication settings | You, when you sign up or are invited |
| Sign in with Google | Only if you choose to sign in with Google: once Google confirms who you are, it shares your name, email address, a link to your profile picture and a Google account identifier. We use them to create and sign in to your account. We never receive your Google password. You can remove Lawdex from your Google account at myaccount.google.com. | Google, when you choose it |
| Profile photo | The picture you upload, if any. Otherwise we draw your initials on your device. | You |
| Workspace content | Clients, matters, parties, hearings, tasks, documents and files, finances, properties and leases, intellectual property and corporate records, notes and comments | Your firm and its members (for people named in them, an indirect source) |
| Messages and meetings | Messages, mentions, reactions and attachments between firm members; meeting titles, attendees, and live audio and video during a call (not recorded by us) | Firm members |
| AI inputs and outputs | Text submitted to the AI tools, the summaries and drafts returned, knowledge base documents and the search index built from them | Firm members |
| Billing | Plan, billing period, amounts, payment references, the payment provider used and dates. Card and bank details stay with the payment provider; we never see full card numbers. | You and our payment providers |
| Device and security | IP address, the country of each sign in, browser and device type, sign in and security events, active sessions | Your device, and our hosting network for the country |
| Push notifications | A pseudonymous push endpoint and keys for each device where you turn notifications on | Your browser |
| Careers applications | Name, email, phone, links, cover note, CV, interview notes, stage and decision | Applicants and our hiring team |
| Support and contact | Name, email and what you tell us in a contact form, support ticket, email or WhatsApp message | You |
| Crash reports | Short, redacted error messages from the app and our servers, with the area of the app concerned | Your device and our servers |
| Privacy and consent records | Your privacy requests and how we handled them; when you turned product news on or off | You and us |
We do not buy personal data, and we do not collect data from social media or data brokers.
4. Why we use it and our lawful basis
Section 25 of the NDPA lists the lawful bases for processing. This table shows the basis we rely on for each purpose where we are the controller.
| Purpose | Data used | Lawful basis (NDPA s.25(1)) |
|---|---|---|
| Create and run your account, sign you in and provide the service your firm pays for | Account, device, workspace (as processor) | Contract: necessary to perform the subscription contract, s.25(1)(b)(i) |
| Keep the service secure: detect abuse and fraud, protect accounts, show where you are signed in, investigate incidents | Device and security, account | Legitimate interests in a secure service, s.25(1)(b)(v). We have recorded a legitimate interest assessment. |
| Take payment, issue receipts and keep tax and accounting records | Billing, account | Contract, s.25(1)(b)(i), and legal obligation, s.25(1)(b)(ii) |
| Send service notices: sign up confirmation, password resets, security alerts, billing reminders, maintenance and changes to these terms | Account | Contract, s.25(1)(b)(i) |
| Send product news by email | Name and email | Consent, s.25(1)(a). Off unless you turn it on. |
| Consider job applications | Careers applications | Steps taken at your request before entering a contract, s.25(1)(b)(i) |
| Answer support and contact requests | Support and contact, account | Contract where you are a customer, s.25(1)(b)(i); otherwise legitimate interests in replying to you, s.25(1)(b)(v) |
| Find and fix faults | Crash reports | Legitimate interests in a working service, s.25(1)(b)(v) |
| Handle your privacy requests and keep evidence of consent | Privacy and consent records | Legal obligation under the NDPA, s.25(1)(b)(ii) |
| Process workspace content, messages, meetings and AI requests for a firm | Workspace, messages, AI inputs | The firm’s own lawful basis as controller. We act as its processor. |
We do not use your data for any purpose that is incompatible with the one we collected it for, and we do not sell it or use it for advertising.
5. Sensitive personal data
Legal work often involves sensitive personal data as defined in section 65 of the NDPA, for example health, religious beliefs, ethnic origin, sex life or political opinions, as well as criminal matters. Firms decide what goes into their workspace and rely on their own grounds, usually section 30(1)(e) (establishing, exercising or defending legal claims, obtaining legal advice or conducting legal proceedings). We process such data only as the firm’s processor, and we protect it to the standard required for sensitive data.
We do not ask job applicants for sensitive data, and we ask them to leave it out of their CV and cover note.
6. Children
Lawdex accounts are for people aged 18 or over who act for a law firm or chambers. We do not knowingly create accounts for children, and we will delete an account if we learn it belongs to a child.
Firm records may include children, for example in custody, adoption or juvenile matters. Firms handle this data under section 31(4)(c) (proceedings before a court) and section 30(1)(e) of the NDPA. We give it the highest level of protection we offer.
8. Sub-processors and their locations
These are the companies that process personal data for us to run Lawdex. Last changed: 30 October 2026. We tell subscribing firms at least 30 days before we add or replace a sub-processor, and a firm may object under its Data Processing Agreement.
| Company | What it does for us | Personal data involved | Where |
|---|---|---|---|
| Supabase | Database, sign in, file storage and server functions for the whole service | All account data and all workspace content | Germany (Frankfurt, AWS eu-central-1) |
| Netlify | Hosting and content delivery for lawdex.app | IP address, browser details and request logs | United States, with a global edge network |
| OpenAI | AI Summariser, Document Generator, firm knowledge base and Ask Rah, only when a user runs them | The text a user submits and, for Ask Rah, the workspace records it looks up | United States |
| Resend | Account, notification and service emails | Name, email address and the short notice text (for example a task or hearing title) | United States |
| CozziPay | Subscription payments by bank transfer | Firm name, billing email, plan, amount and payment reference | Nigeria |
| Paystack | Earlier subscription payments; it keeps the records of those payments (checkout now uses CozziPay) | Firm name, billing email, plan, amount and payment reference | Nigeria |
| 8x8 (Jitsi as a Service) | In-app video meetings on the Plus plan | Display name, meeting room name, audio and video during the call | United States |
| Web push services (Google, Mozilla, Apple or Microsoft, depending on your browser) | Delivering push notifications you turned on | A pseudonymous device endpoint; the notice text is end to end encrypted | United States |
| Google Fonts | Font files for the website and app | IP address and browser details | United States |
| Google (sign in with Google) | Signing in with your Google account, when Lawdex offers it and you choose it | Name, email address, profile picture link and a Google account identifier | United States |
| Cloudflare Turnstile | Bot protection on sign up, password reset, the contact form and careers applications | IP address and browser signals | United States, with a global edge network |
Independent controllers
- WhatsApp (Meta): If you contact our support team on WhatsApp. They use your data under their own privacy policy.
- Your bank or card issuer: When you pay a subscription. They use your data under their own privacy policy.
9. Transfers outside Nigeria
Lawdex data is stored with Supabase in Frankfurt, Germany. Some services run in the United States (see the table above). Every time you use Lawdex, data therefore moves outside Nigeria. Part VIII of the NDPA allows this only with the right safeguards, and we keep a written record of each transfer and its basis, as section 41(2) requires.
- Germany (Supabase). Germany applies the EU General Data Protection Regulation, has an independent supervisory authority and enforceable rights. We rely on section 41(1)(a): our assessment is that its protection is substantially similar to the NDPA, backed by Supabase’s data processing agreement.
- United States. There is no NDPC adequacy decision for the United States. For these providers we rely on their data processing agreements and contractual safeguards (section 41(1)(a)) and, where it applies, on the transfer being necessary to perform our contract with you (section 43(1)(b)). We limit what is sent: for example email carries only short notice text, and push notices are encrypted end to end.
The Nigeria Data Protection Commission may require further safeguards, and we will apply them. To ask about the safeguards for a particular transfer, write to thekianconsult@gmail.com.
10. How long we keep it
We keep personal data only as long as the purpose needs it, then delete it. These are the periods we apply.
When a period ends, or when you or your firm ask us to delete data, our staff carry out the deletion using our deletion tools. Account deletions and workspace closures are carried out when their waiting period ends, and other requests within the response time in Your rights. We are preparing a scheduled job to do this automatically and will update this policy when it is switched on.
| Data | How long |
|---|---|
| Your account and profile | While the account is active. If you delete your account it is removed 14 days later (you can cancel in that time). Work records you created stay with your firm, shown as "Former member". |
| Firm workspace content, files and messages | Until the firm closes its workspace, then 30 more days for export, then deleted with every file. A lapsed workspace becomes read only and is kept until the firm closes it; we give at least 30 days notice before we delete a lapsed workspace ourselves. |
| Billing records | 6 years after the firm’s workspace is closed, for tax and accounting. They hold the firm name, amounts, payment status, gateway, references and the billing period, not who paid. |
| Sign in and security history | 12 months |
| Device sessions | 12 months after the device was last seen |
| Crash reports | 12 months after they are resolved |
| Contact form messages | 12 months |
| Password reset rate limit records | 30 days |
| In-app notifications you have read | 12 months |
| Sign ups that were never confirmed | 30 days |
| Job applicants who are not hired, and their CVs | 6 months after the decision, or after 6 months without progress once a role has closed, unless we must keep them for a legal claim |
| Audit log of sensitive actions | 6 years from each entry (needed to defend legal claims and to show compliance), then deleted. When a workspace is closed or an account is deleted, the log keeps only what happened and when; the record contents and the names in it are removed at that time. |
| Privacy requests and consent records | 6 years, as evidence of how we handled them |
| Encrypted backups | Our encrypted backup copies are replaced after 14 days, and a replaced copy is cleared from our backup storage within a further 30 days. Deleted data is gone from every backup within about 45 days. |
| Ask Rah research answers | Kept for 24 hours so the same question asked again in your firm is answered at once, then deleted. Only the answer and its sources are kept, with a fingerprint of the question rather than the question itself. |
| Data sent to OpenAI by the AI tools | Not stored by OpenAI for training. OpenAI may keep it for up to 30 days to monitor abuse, then deletes it. |
11. How we protect it
- Each firm’s data is isolated in the database with row level security, so one firm can never read another’s records. Roles are enforced on the server, not only in the app.
- Two factor authentication is available to every user and required for privileged changes once it is turned on.
- All traffic uses TLS with HSTS. Data is encrypted at rest by our hosting provider. Our own backup copies are encrypted with AES-256-GCM.
- Sensitive actions are written to an audit log that users and staff cannot edit or delete. The only changes the system allows are removing record contents and names when a workspace or account is erased, and deleting entries after 6 years, and each of those changes is itself logged.
- Our systems are monitored every 10 minutes, and payment notifications from our providers are signed and checked.
- Sign in attempts, uploads and other actions are rate limited, and you can see and sign out every device signed in to your account.
- Staff access to production systems is limited to the people who need it, and they are bound by confidentiality.
No system is perfectly secure. If you think your account has been misused, change your password, sign out other devices in Settings and tell us at once.
12. Your rights and how to use them
Under sections 34 to 38 of the NDPA you have the right to:
- be told how your data is used (this policy);
- access your data and get a copy in a common electronic format;
- have inaccurate or incomplete data corrected;
- have your data erased when we no longer need it or have no lawful basis to keep it;
- restrict how we use it while a request or objection is being dealt with;
- object to our use of it, and to stop direct marketing at any time;
- take your data to another provider (portability);
- withdraw consent at any time, as easily as you gave it, without affecting what was done before;
- not be subject to a decision based solely on automated processing that has legal or similarly significant effects;
- complain to the Nigeria Data Protection Commission.
How to use them
- In the app. Settings, under Your privacy and data: Download my data (a copy of your personal data), Delete my account, the Product news switch, and a form for any other privacy request.
- For firm data. Your workspace administrator or a partner can export the whole workspace from Settings, under Workspace data, and can close the workspace.
- By email. Write to thekianconsult@gmail.com. Tell us what you want and which account it concerns.
We may ask you to confirm your identity before acting, so that we never give your data to someone else. We acknowledge every request within 72 hours and give you a decision within 30 days, or sooner if you set a shorter period in a Standard Notice to Address Grievance (SNAG). There is no fee, unless a request is clearly unfounded or excessive. If we refuse a request we tell you why and how to complain.
Requests about records a firm keeps on its clients and other people go to that firm, as the controller. We pass them on within 2 business days.
13. Complaints
If you are unhappy with how we handle your data, please tell our Data Protection Officer first at thekianconsult@gmail.com. We will try to put it right.
You may also complain to the Nigeria Data Protection Commission at any time, whether or not you have contacted us. Website: ndpc.gov.ng. Complaints portal: services.ndpc.gov.ng.
Nothing in our Terms stops you from complaining to the Commission or going to court to enforce your data protection rights.
15. Installing the app
You can install Lawdex on a phone or computer from your browser. Before you do, this is what installing means for your data.
- What it stores. The same items listed in the table above: your sign in session, preferences, drafts and caches. Installing adds the app files themselves, so the app opens quickly. If you turn on notifications, your device also gets a pseudonymous push endpoint.
- Why. To give you the service your firm subscribes to (contract, NDPA s.25(1)(b)(i)). Nothing on the device is used for tracking or advertising.
- How it is protected. Everything the app sends or receives goes over TLS. Your data on our servers is protected as set out in How we protect it, and push notices are encrypted end to end. Items on your device are protected by your device lock and browser.
- Assessment. We carried out a data privacy impact assessment of Lawdex, including the installed app, before offering it.
- How to remove it. Uninstall it like any other app: on a phone, press and hold the icon and choose remove or uninstall; on a computer, open the app menu and choose uninstall. Then clear this site’s data in your browser settings to remove everything it stored. Signing out first also clears your session.
Questions or requests: thekianconsult@gmail.com. You can also complain to the Nigeria Data Protection Commission at services.ndpc.gov.ng.
16. Artificial intelligence
The AI Summariser, the Document Generator, the firm knowledge base and the Ask Rah assistant are optional tools on the Plus plan and during the free trial. They run only when a user starts them.
- What is sent: the text you submit and, for Ask Rah, the workspace records it looks up to answer your question.
- Who processes it: OpenAI, in the United States, as our sub-processor.
- How it is handled: requests are sent with storage turned off, OpenAI does not use them to train its models, and OpenAI may keep them for up to 30 days only to monitor abuse.
- Limits: each firm has a monthly cap on AI requests.
- Accuracy: AI output is a draft. It can be wrong or incomplete and it is not legal advice. Check it before you rely on it.
- Control: an administrator or partner can turn every AI tool off for the whole workspace in Settings, under Workspace data. When AI is off, nothing is sent to OpenAI.
17. Automated decisions
We do not make decisions about you based solely on automated processing that have legal or similarly significant effects. Our careers process has no automated scoring or filtering: people read every application. Reminders, deadline alerts and AI drafts help people decide; they do not decide.
18. If you apply for a job with us
- We collect what you send in the application form (name, email, phone, links, cover note and CV) and what our hiring team records (interview times, notes, stage and decision).
- Only our careers administrators can see your application, in our internal console. When you apply, they get an alert that names you and the role, never your CV or contact details.
- We use your application only to consider you for a role, on the basis of steps taken at your request before a contract.
- If you are not hired, we delete your application and CV 6 months after the decision. If a role closes and your application has not moved for 6 months, it is deleted too. We keep it longer only if we need it for a legal claim, and we record why.
- If you are hired, the data you need for your job moves into your employment records.
- Please do not include sensitive data such as religion, health, ethnicity or political views.
19. Product news and service emails
Product news by email is off unless you turn it on in Settings, under Your privacy and data. You can turn it off there at any time, and every product news email tells you how. We keep a record of each change.
Service emails are different: they tell you about your account, security, billing, maintenance and changes to our terms. You get them while you have an account, because we need them to run the service.
20. If something goes wrong
If a personal data breach affects data we hold, we act at once to contain it and record it in our breach register. We tell the firms affected without undue delay and within 24 hours. Where we are the controller and the breach is likely to put your rights at risk, we tell the Nigeria Data Protection Commission within 72 hours of becoming aware of it. If the risk to you is high, we tell you directly and promptly, in plain language, with steps you can take to protect yourself.
21. Changes to this policy
We will update this policy when our service or the law changes. The date at the top shows the latest version. For material changes we tell you in the app and by email before they take effect.
22. Contact us
- Kian Consult Ltd, RC 7617713
- Registered address: No. 6, Eesa Tuntun, Ido Osun, Osun State, Nigeria
- Data Protection Officer, Kian Consult Ltd, for privacy requests: thekianconsult@gmail.com
- Support: lawdexapp@gmail.com or WhatsApp
Effective date: 28 October 2026.