Privacy Policy

This Policy covers two categories of personal data, and our role is different for each:

Account Data — information about you as a user of the Service: your name, work email, phone number, role, and how you use the platform. For Account Data, CloudTech Analytics is the data controller— we decide why and how it's processed, as described in this Policy.

Client Data — everything your Organization submits to, uploads to, or generates within the Service in the course of managing its own legal practice: matter records, client and contact details, documents, notes, time entries, and billing records. For Client Data, your Organization is the data controller and CloudTech Analytics is the data processor, acting only on your Organization's instructions (as configured through the Service) and never using it for our own independent purposes. If you are a client of one of our Organizations and have questions about your own information within Client Data, please contact that firm directly — we act on their instructions, not yours.

We collect the following categories of information:

• Account & profile information — full name, work email, phone number, avatar, role, and organization/branch assignment, provided when you or your Organization's administrator create your account.
• Client Data — as described in Section 1, submitted by your Organization. This may include information subject to legal professional privilege.
• Payment information — handled directly by our payment processor, Paystack. We receive and store confirmation of a successful payment and your subscription status, never your full card or bank details.
• Usage & device information — pages visited, actions taken (recorded in the in-app audit log), IP address, browser and device type, and similar diagnostic data, including client-side error reports (message, stack trace, and the page URL where an error occurred) used to find and fix bugs.
• Support communications — the content of support tickets and messages you send us, and, where applicable, the reason logged for a support access session (see Section 6).

We use Account Data and usage information to:

• Provide, operate, and maintain the Service, including authentication and access control.
• Process subscriptions, billing, and payment confirmations.
• Send transactional communications — notifications you've configured, hearing/task reminders, billing receipts, and support replies.
• Diagnose and fix bugs, monitor performance, and improve the Service.
• Detect, investigate, and prevent fraud, abuse, or security incidents.
• Comply with our own legal obligations.

We process Client Data solely to provide the Service to your Organization, as instructed by your Organization through its configuration and use of the platform — never for advertising, never sold, and never used to train a model that isn't your Organization's own use of an AI feature (see Section 6).

Under the NDPR/NDPA, we rely on the following legal bases:

• Performance of a contract — processing needed to provide the Service you or your Organization signed up for.
• Legitimate interest — for security, fraud prevention, diagnostics, and improving the Service, balanced against your rights.
• Consent — for optional channels you enable yourself, such as browser push notifications or WhatsApp reminders.
• Legal obligation — where we're required to retain or disclose information by law.

The Service uses your browser's local storage (not third-party advertising cookies) to keep you signed in, remember your active organization and a few interface preferences, and — for Supabase Auth — to manage your session. We do not use third-party advertising or cross-site tracking cookies within the authenticated application.

On our public website only (the marketing pages and the sign-up page), and only if you click "Accept" on the cookie banner, we use Google Analytics to measure visits: which pages are viewed, how visitors arrived, approximate location and device type. It never runs inside the application and never sees Client Data. If you click "Decline", it is not loaded. You can change your choice at any time by clearing this site's data in your browser.

Plans that include AI features (matter summaries, AI chat, the scheduling assistant) send the relevant matter or query content to a third-party AI model provider (currently Groq) in order to generate a response. That content is processed by the provider to return a result to you and is subject to that provider's own data-handling terms for API access, which do not include using API-submitted content to train their own models. We do not send more than what's needed to answer the specific request (e.g. a matter's own status, tasks, and hearings — not your whole Organization's data at once). See Section 11 of our Terms for the "review before relying on it" limits on AI output itself.

We use the following categories of service providers to operate the Service. Each only receives what it needs to perform its function:

• Supabase — database, authentication, file storage, and backend infrastructure. This is where Account Data and Client Data are stored.
• Vercel — hosting for the web application itself.
• Paystack — payment processing for subscriptions.
• Resend — delivery of transactional emails (notifications, reminders, receipts).
• Google Analytics — website visit statistics on the public marketing pages, only with your consent (see Section 5).
• Groq — AI features, as described in Section 6, where your Organization's plan includes them.
• WhatsApp messaging providers (Twilio or Meta, whichever is configured) — only if you personally enable WhatsApp reminders and provide a number.

We do not sell personal data to anyone, and we do not share Client Data with any third party beyond what's listed here except where required by law or with your Organization's separate, explicit permission.

Our database infrastructure is hosted on servers located in the European Union. Some of our service providers (including our AI features provider, where used) may process data outside Nigeria and the EU. Where personal data is transferred internationally, we rely on our providers' own standard contractual and security safeguards.

We apply row-level security at the database layer so that one Organization's data is never accessible to another Organization, encrypt data in transit, and restrict internal access to what's needed to operate and support the Service. No method of transmission or storage is 100% secure, and we cannot guarantee absolute security — but we treat Client Data with the confidentiality it warrants, per Section 7 of our Terms.

We retain Account Data for as long as your account is active, and Client Data for as long as your Organization's subscription or account remains active — including through a suspended or expired-trial state, so you can resolve billing and regain access without losing anything. Following account closure, we retain data for a reasonable period to allow export or reactivation before permanent deletion, except where we're required to retain it longer for legal or regulatory reasons. See Section 18 of our Terms for the full detail.

Our support staff do not have standing access to your Organization's workspace. Accessing it for support purposes requires your Organization's own administrator to explicitly grant a time-limited, fully audited session — every such session, and the reason given for it, is logged and visible to your Organization.

Subject to applicable law, you have the right to:

• Access the personal data we hold about you.
• Correct inaccurate or incomplete data.
• Request deletion of your data, subject to our retention obligations described above.
• Object to or request that we restrict certain processing.
• Receive a copy of your data in a portable format.
• Withdraw consent at any time for processing that relies on it (e.g. disabling WhatsApp or browser notifications).

To exercise any of these rights over your own Account Data, contact us using the details in Section 15. If your request concerns Client Data held within an Organization's workspace, we'll direct you to that Organization, since they control that data — you're also welcome to lodge a complaint with Nigeria's Data Protection Commission (NDPC) at any time.

The Service is intended for use by legal professionals and their staff and is not directed at or knowingly used by anyone under 18. We do not knowingly collect personal data from children.

We may update this Privacy Policy from time to time. If we make material changes, we will provide reasonable notice, such as by email or an in-app notice, before the changes take effect. Continued use of the Service after the effective date of an updated Policy constitutes acceptance of those changes.

Questions about this Privacy Policy, or requests relating to your personal data, can be sent to cloudtechanalytics.consultant@gmail.com or +234 813 386 0143.