Privacy policy

Qanoon is committed to protecting your privacy under the Personal Data Protection Law issued by Royal Decree No. (M/19) and its Implementing Regulations. This policy explains what data we collect, why, and how you can control it.

1. Data we collect

• Account data: name, email address, mobile number and city when you create an account.
• Lawyer data: the office details you publish, and a copy of your licence when you request verification (kept in private storage and never shown publicly).
• Requests and messages: messages you send to lawyers through the platform, consultation requests and bookings.
• Usage data: pages you visit, searches, templates you download and device type, to personalise your experience and improve the platform.
• «مكتبي» and client portal documents: files and data uploaded by a firm or its clients. We process them on the firm's behalf, and the firm decides what is uploaded and why.
• Payment data: processed by our payment provider (Stripe); we don't store card numbers on our servers.

2. How we use data

• To let you communicate with the lawyer you chose.
• To personalise content and suggested lawyers based on your city and interests.
• To send service notifications, and our newsletter if you agreed to it (you can unsubscribe at any time).
• To meet our legal obligations and prevent fraud.
• To keep the service safe and of good quality: authorised platform administrators may review messages exchanged between clients and lawyers on the platform for quality control, handling reports and enforcing our terms; every such review is logged.

3. Sharing data

When you send a request to a lawyer, we share your name, contact details and message with them. We never sell your data to third parties. We use service providers (hosting, email, payments) bound by data-processing agreements.

Where data is hosted

Platform data is hosted outside the Kingdom, in Frankfurt, Germany: the database and files with Supabase and the website with Vercel. Email is processed by Resend and payments by Stripe. This counts as transferring data outside the Kingdom under the Personal Data Protection Law and its transfer regulation. A summary is on our security and data page.

AI provider and processing outside the Kingdom

We use Claude models from Anthropic, PBC (United States) as a data processor for the features below, and send it only the text each operation needs:

• Legal Q&A: your question's title and details, to remove personal data and classify it before publishing; lawyers' answers, to check them; and the question text when a lawyer asks for a draft answer.
• The «Adam» assistant: the messages you type in the chat and the page references you browsed (see section 5).
• "Recommend me a lawyer": the text of your request, to identify the practice area and suggest suitable lawyers.
• «مكتبي» AI tools for law offices: only the case, document or notes text the user chooses, and only after the office owner accepts the processing terms.
• Advertising: the ad image, text and link, to review them before publishing.

This data is processed only to provide the feature you use. Under its commercial terms Anthropic does not use data sent through its commercial service to train its models, and neither do we; it keeps it for a limited period for safety and abuse prevention. Processing takes place outside the Kingdom and counts as a transfer of personal data outside the Kingdom under the Personal Data Protection Law and the Regulation on Personal Data Transfer outside the Kingdom; we keep it to the minimum needed, so please don't type names, ID numbers or phone numbers into these features.

What we keep: we keep «Adam» chats for 90 days to improve the assistant and monitor its quality, without your IP address: the text of your messages and the assistant's replies after phone numbers, email addresses, ID and account numbers are automatically masked, your ratings of replies (👍/👎 and any comment you write), and the buttons you clicked, together with a random chat code kept in your browser tab and your account if you're signed in. Only platform administrators can see them, and they are deleted automatically after 90 days. To apply the daily message limit we also log the number of messages and their cost with an anonymised connection code that changes daily; this log is deleted after one year. The content of «مكتبي» AI operations is never added to these chat logs. Published questions are kept after personal data is removed; the original text is kept only if something was removed, and only for our team's review. «مكتبي» output is saved as a draft in the office workspace, and each operation is logged with who ran it, when and its cost.

4. Your rights

You can view and correct your data, ask for it to be deleted, or export a copy from your account dashboard, or by emailing info@qanoon.app.

5. Cookies

We use cookies that are needed to sign in, and analytics cookies (Google Analytics) to understand how the platform is used. You can refuse non-essential cookies in your browser settings.

We use Cloudflare Turnstile on the sign-up, sign-in and contact forms to block bots; it checks signals from your browser to confirm you're human and isn't used for advertising or to track you. This processing is governed by Cloudflare's Turnstile Privacy Addendum.

Personalization: only in your browser (local storage) we keep the city you chose or browsed and the lawyers, templates, questions and practice areas you recently viewed, to show nearby lawyers and relevant content; the «Adam» assistant uses these signals (page references only, never text you typed) to tailor suggestions. We estimate your approximate city from your connection on each request and don't store it; we never collect your precise location. If you're signed in, we use your account's city, type and plan. You can clear or pause this any time from "Picked for you" on the homepage.

Browsing log for accounts: while you're signed in, we record the links of the public pages you open and when (never text you type, and never your account, dashboard or «مكتبي» pages), so authorised platform staff can help you and improve the service; this log is deleted automatically after 90 days. When you sign up we also keep with your account how you found us: the source (such as a search engine or a campaign), your first page and the last pages you visited before signing up.

6. Data retention

We keep account data while the account is active, and transaction records for as long as the law requires. Account data is deleted within 30 days of a deletion request.

The log of emails the platform sends (recipient, subject, status) is deleted after one year. Contract-builder drafts that were never paid for are deleted 90 days after they were last edited; paid contracts stay in your account. When a «مكتبي» workspace is closed, its data (matters, contacts, documents and files) is kept for one year from the closing date and then permanently deleted; invoices, payments, the trust ledger and the billing details of the clients it names are kept for ten years from closing and then deleted. Ask for a copy of your data before then.

7. Contact

For any privacy question: info@qanoon.app.