Privacy policy — DeLaw
Effective 8 September 2026. Korevra Technologies Limited ("Korevra", "we") of Lagos, Nigeria, operates the DeLaw platform and the DeLaw mobile application (together, "the services"). This policy explains what personal data the services process, why, and the rights you have under the Nigeria Data Protection Act 2023 (NDPA) and the General Application and Implementation Directive 2025 (GAID).
Who is responsible
- Your personal workspace. Korevra is the data controller for your account data. You are the controller of the client and matter data you record, and you are responsible for the professional obligations that attach to it.
- An organisation's workspace. The organisation that runs DeLaw (a law firm, legal department, legal aid organisation or judiciary, "the tenant") is the data controller for everything inside its workspace. Korevra is the data processor and acts only on the tenant's instructions under a data processing agreement. Requests about data held by a tenant go to that tenant's administrator.
What we collect
| Data | Why | Legal basis |
|---|---|---|
| Name, email address, phone number | Your account, sign-in codes, security notices | Contract |
| Practitioner details (enrolment number, year of call, roll status) | Verification for the Connect directory and rights-of-audience features; optional | Consent |
| Matter, client, document, time and fee-note records you or your organisation enter | Providing the service | Contract (your personal workspace) or the tenant's instructions (an organisation's workspace) |
| Document scans and photos you choose to capture | Filing documents to matters; text recognition runs on our servers in the service region and is not used for anything else | Contract |
| Notes you take, and voice recordings you choose to make (the Recorder) | Attendance notes, meeting minutes, calls and dictations on a matter; a recording is made only when you start it, after confirming that everyone present has been told; the audio is stored with the matter's documents, transcribed on our servers in the service region, and never used for anything else | Contract (your personal workspace) or the tenant's instructions (an organisation's workspace) |
| App interactions and diagnostics (screens opened, errors, crash reports) | Keeping the service working and secure | Legitimate interest |
| Device identifiers and push tokens | Delivering hearing and deadline reminders you enable | Consent |
We do not collect your location. The apps have no location permission. The microphone is used only while you record or dictate a note, and never in the background. We do not monitor keystrokes, idle time or working patterns. Client-account (trust) figures never appear in notifications or messages.
AI processing
Some features use an AI service to search authorities, draft and review text. AI processing of a client's documents happens only with a recorded consent for that purpose. Prompts and documents are processed inside the service region, are not used to train any model, and every AI-produced statement of law is linked to the authority it relies on or is labelled as an unsourced draft.
Where data is kept
Data is stored and processed in Google Cloud's Johannesburg (africa-south1) region, with encrypted backups in the same region. Data does not leave the region for processing, including AI inference. Backups are retained for 35 days.
Who we share it with
- Sub-processors that host or deliver the service: Google Cloud (hosting, storage, push delivery), Anthropic (AI inference, zero data retention), and the SMS/email providers that deliver sign-in codes. A current list is available on request.
- Your organisation, if you have linked your account to it with a join code, for the matters you work on under that tenant. Unlinking stops this and removes the tenant's matters from your device.
- Nobody else, unless the law requires it. We do not sell personal data and we do not use it for advertising.
How long we keep it
Account data is kept while your account exists and for 90 days after deletion. Professional records (matters, documents, ledgers) are kept for the retention period the controller sets, within the minimums that professional conduct rules require, because a lawyer must be able to account for a file. When a person asks for erasure, we anonymise the person and preserve the professional record.
Your rights
You can access, correct, export or erase your personal data, object to processing based on legitimate interest, and withdraw a consent at any time, from the app (Profile → My data) or by writing to privacy@korevra.com. We answer within 30 days. You may complain to the Nigeria Data Protection Commission.
To delete your account and data, see https://app.delaw.korevra.com/delete-data.
Security
Data is encrypted in transit (TLS 1.3) and at rest, with a separate key per organisation. Access inside the platform is enforced by the database itself: a user who is not on a matter, or who is walled from it, cannot read it, search it or receive AI output about it. Every access to client-account data, every export and every permission change is written to an immutable audit log.
Contact
Korevra Technologies Limited, Lagos, Nigeria. privacy@korevra.com. Data protection officer: dpo@korevra.com.