Legal

Privacy Policy

Last updated: [PLACEHOLDER — date of legal review]

Draft — pending legal review. This page was drafted as a complete, structurally-standard policy document, but fields marked [PLACEHOLDER] below are not yet filled in with real, company-specific facts (legal entity name, registered address, governing-law jurisdiction, data protection officer contact, exact retention periods). Do not treat this page as legally binding, and do not publish it as final, until a qualified lawyer has reviewed it and every placeholder has been replaced with an accurate, verified value.

1. Who we are

Juricare AI (“we”, “us”) is operated by [PLACEHOLDER — legal entity name and registered address]. For any privacy question or request, contact contact@juricare.ai or [PLACEHOLDER — designated Data Protection Officer / privacy contact, if one is appointed].

2. What data we actually collect

This section describes what the platform genuinely collects today, not a generic template:

  • Account data: full name, email, mobile number, and a bcrypt-hashed password (we never store your password in plain text) — collected at registration.
  • Case, hearing, and document data you or your advocate/client enters — case details, hearing dates, uploaded documents and their extracted text/OCR results, generated documents from templates.
  • Messagessent through the in-app Client–Advocate messaging feature, and any file/image attachments you send there.
  • AI Legal Assistant conversations — prompts you send and the responses returned. When a real AI provider is configured, your prompt is sent to that third-party provider (currently Google Gemini, whenGEMINI_API_KEY is configured server-side) to generate a response; see our AI Disclaimer for what that means and its limitations.
  • Device push-notification tokens, if you enable push notifications on the mobile app — used only to deliver notifications to your device, nothing else.
  • Request metadata (method, path, status code, timestamp, a per-request correlation ID) logged for every API request for operational/security purposes — we deliberately do not log request bodies, headers, or query strings, so this log stream never contains your passwords, tokens, or message content.
  • Aggregate, non-identifying usage statistics (e.g. total active users, documents uploaded, AI queries per day) computed for the platform’s own admin analytics — these are counts and sums, not exports of your individual records.

3. How we use your data

  • To provide the core service: managing your cases, hearings, documents, and communications.
  • To send you account-related email (password reset, email verification) and, if you opt in, push notifications.
  • To generate AI-assisted responses when you use the AI Legal Assistant.
  • To maintain security — audit logging of sensitive actions (e.g. case reassignment), rate limiting, and fraud/abuse prevention.
  • We do not sell your data. [PLACEHOLDER — confirm and expand if any other third-party sharing occurs beyond what is listed in section 4]

4. Third parties we share data with

  • Google Gemini(or another configured AI provider) — receives your AI Assistant prompts to generate a response, only when the platform’s AI feature is actually configured with a real provider key.
  • Firebase Cloud Messaging— receives your device’s push token to deliver notifications, only if you’ve enabled push notifications and the platform has a Firebase project configured.
  • Sentry (crash reporting) — receives crash reports from the mobile app, only if the platform has a Sentry DSN configured; see technical note below.
  • Email delivery provider (SMTP) — sends password-reset and verification emails on our behalf.
  • [PLACEHOLDER — any additional processors: hosting provider, managed database provider, etc., once a specific production infrastructure is chosen]

5. Data retention

[PLACEHOLDER — exact retention periods per data category. Technical note: password-reset and email-verification tokens expire automatically (1 hour and 24 hours respectively) and are marked single-use; refresh tokens expire after 30 days; access tokens after 15 minutes. Case/document/message data is currently retained indefinitely unless you request deletion — a real retention policy and automated deletion schedule is a policy decision this document defers to legal review, not a technical limitation.]

6. Your rights

Depending on your jurisdiction, you may have rights to access, correct, export, or delete your personal data, and to object to certain processing. [PLACEHOLDER — specific rights language tailored to the jurisdiction(s) this service actually operates in, e.g. GDPR/DPDP Act/CCPA as applicable]. To exercise these rights, contact contact@juricare.ai.

7. Security

Passwords are hashed with bcrypt, never stored in plain text. API access uses short-lived JWT access tokens with rotating, single-use refresh tokens. Sensitive actions are audit-logged. File uploads are validated by type and size. [PLACEHOLDER — link to a public security/trust page here, if one is ever created]

8. Changes to this policy

We may update this policy from time to time. [PLACEHOLDER — describe the actual notice process: email notice, in-app banner, etc.]