Privacy Policy

Last Updated: October 18, 2025

LegalCompanion ("we," "our," or "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard information when you use our automated legal client intake platform.

1. Information We Collect

LegalCompanion collects and processes the following information on behalf of law firms:

1.1 WhatsApp Messages and Client Data

• Message Content: Conversations between law firms and their prospective clients conducted via our automated intake platform through WhatsApp
• Client Information: Names, contact details (phone numbers), case descriptions, and legal matter details shared during intake conversations
• Supporting Documents: Documents uploaded by clients during the intake process (contracts, correspondence, identification documents, etc.)
• Conversation Metadata: Message timestamps, delivery status, read receipts

1.2 Lawyer Account Data

• Law firm registration details and Legal Practice Council information
• WhatsApp Business Account credentials (encrypted)
• Billing and payment information
• Practice area configuration and intake question customization

1.3 Usage Data

• Platform usage analytics (conversation volumes, completion rates)
• System performance metrics
• Error logs and debugging information

2. How We Use Information

We use the collected information for the following purposes:

2.1 Provide Automated Intake Service

• Conduct automated client intake conversations via WhatsApp
• Assess case complexity and estimate legal fees
• Collect and organize case documentation
• Generate structured case files for lawyer review

2.2 Improve Platform Functionality

• Analyze usage patterns to enhance user experience
• Identify and fix technical issues
• Develop new features based on customer feedback

2.3 Comply with Legal Obligations

• Maintain audit trails for attorney-client privilege compliance
• Respond to legal requests and court orders
• Comply with South African Legal Practice Council requirements

3. WhatsApp Platform Data Handling

As a Meta WhatsApp Cloud API Tech Provider, LegalCompanion processes WhatsApp Platform Data solely to provide our automated intake service. We commit to the following:

• Limited Purpose: We use WhatsApp data exclusively to provide the legal intake automation service described in this policy. We never use WhatsApp data for marketing, advertising, profiling, or purposes unrelated to the intake service.
• Data Retention: WhatsApp messages and conversation data are retained for 90 days to enable case file generation and lawyer review. After 90 days, conversation data is automatically deleted unless the lawyer requests extended retention for active cases.
• Client Consent: We require law firms to obtain explicit consent from clients before initiating automated intake conversations. Clients can opt out at any stage of the process.
• Encryption: All WhatsApp data is encrypted using AES-256-GCM encryption both in transit and at rest.
• No Third-Party Sharing: We do not sell, rent, or share WhatsApp Platform Data with third parties for marketing or advertising purposes.

4. Data Security

We implement industry-standard security measures to protect your information:

• Encryption: All sensitive data is encrypted using AES-256-GCM encryption before storage
• AWS Infrastructure: Data is hosted on Amazon Web Services (AWS) in the Africa (Cape Town) region with enterprise-grade security controls
• Access Controls: Role-based access controls ensure only authorized personnel can access client data
• Secure Communications: All data transmissions use HTTPS/TLS encryption
• Regular Security Audits: We conduct regular security assessments and vulnerability testing
• Incident Response: We maintain an incident response plan to address security breaches promptly

5. POPIA Compliance

LegalCompanion complies with South Africa's Protection of Personal Information Act (POPIA). We ensure:

• Lawful Processing: Personal information is processed lawfully, fairly, and transparently
• Consent: We obtain appropriate consent before processing personal information
• Purpose Limitation: Data is collected for specific, legitimate purposes and not used for unrelated purposes
• Data Minimization: We collect only the information necessary to provide our service
• Data Quality: We maintain accurate and up-to-date records
• Security Safeguards: Appropriate technical and organizational measures protect personal information
• Data Subject Rights: Individuals can access, correct, or delete their personal information
• Data Residency: All data is stored in AWS Africa (Cape Town) region for POPIA compliance

6. Data Controller vs. Data Processor

Important Distinction:

• Law Firm (You): Data Controller - The law firm owns all client data collected through LegalCompanion and determines how it is used.
• LegalCompanion: Data Processor - We process data on behalf of law firms solely to provide the intake automation service.

Law firms retain full ownership and control of their client data. We process this data according to the law firm's instructions and this Privacy Policy.

7. Third-Party Services

LegalCompanion uses the following third-party services to provide our platform:

• Meta WhatsApp Cloud API: To send and receive WhatsApp messages. Subject to Meta's Privacy Policy.
• Amazon Web Services (AWS): For hosting, database storage, and file storage in the Africa (Cape Town) region. Subject to AWS Privacy Notice.

We ensure all third-party service providers comply with applicable data protection laws and maintain appropriate security standards.

8. Data Retention and Deletion

• Conversation Data: Retained for 90 days by default, then automatically deleted
• Case Files: Retained for the duration of the lawyer's subscription plus 30 days
• Account Data: Retained while the law firm maintains an active subscription
• Deletion Requests: Law firms can request immediate deletion of specific client data at any time
• Account Termination: Upon account termination, all data is deleted within 30 days unless legal retention requirements apply

9. Your Rights Under POPIA

As a data subject, you have the following rights:

• Access: Request access to your personal information
• Correction: Request correction of inaccurate information
• Deletion: Request deletion of your personal information
• Objection: Object to processing of your personal information
• Data Portability: Request transfer of your data to another service provider
• Withdraw Consent: Withdraw consent for data processing at any time

To exercise these rights, contact us at brendon@legalcompanion.co.za or contact your law firm directly.

10. Children's Privacy

LegalCompanion is not intended for use by individuals under 18 years of age. We do not knowingly collect personal information from children. If we become aware that we have collected data from a child, we will delete it immediately.

11. International Data Transfers

All data is processed and stored within South Africa (AWS Africa - Cape Town region). We do not transfer personal information outside of South Africa except as required by Meta WhatsApp Cloud API for message delivery, which is governed by Meta's Privacy Policy.

12. Changes to This Privacy Policy

We may update this Privacy Policy periodically to reflect changes in our practices or legal requirements. We will notify law firms of material changes via email. The "Last Updated" date at the top of this policy indicates when it was last revised.

13. Contact Us

If you have questions or concerns about this Privacy Policy or our data practices, please contact:

LegalCompanion
Email: brendon@legalcompanion.co.za
Location: South Africa

14. Complaints

If you believe we have not complied with POPIA or this Privacy Policy, you may lodge a complaint with:

South African Information Regulator
Website: www.justice.gov.za/inforeg
Email: inforeg@justice.gov.za