Privacy Policy

Last Updated: July 24, 2026

This Privacy Policy explains how Legalroom ("we," "us," "our," or the "Platform") collects, uses, discloses, and protects personal data when you use our website and application (collectively, the "Service"), as described in our Terms and Conditions.

This Policy is intended to comply with the Nigeria Data Protection Act, 2023 ("NDPA") and, where applicable to users outside Nigeria, other relevant data protection laws.

1. Who We Are

Legalroom is the data controller responsible for your personal data under this Policy. You can reach us at theimmanuelking@gmail.com with any privacy questions or requests.

2. What Data We Collect

2.1 Information you provide directly

  • Account information: name, email address, phone number, password.
  • Contract content: the information you input during Guided Drafting, which may include names, addresses, national ID numbers, salary or payment terms, business details, and other information relating to you and third parties named in your documents (e.g., counterparties, employees, tenants).
  • Payment information: processed via our payment provider Paystack; we do not store full card details ourselves.
  • Communications: messages you send to us or to a Reviewing Attorney through the Platform.

2.2 Information collected automatically

  • Device and usage data (IP address, browser type, pages viewed, timestamps).
  • Cookies and similar technologies (see Section 9).

2.3 Information about third parties

If your contract content includes personal data about other individuals (e.g., an employee, tenant, or counterparty), you confirm that you have the appropriate legal basis (such as their consent, or your own legitimate need in forming the contract) to share that data with us for the purpose of generating and reviewing the document.

3. Legal Basis for Processing

Under the NDPA, we process your personal data on the following bases:

  • Consent — for generating drafts using your input and for optional communications (e.g., marketing, if you opt in).
  • Contractual necessity — to create your account, process payments, and deliver the Service you requested, including Attorney Review.
  • Legitimate interest — to secure the Platform, prevent fraud, and improve our AI drafting quality (see Section 6 on how we use data for improvement, and your right to object).
  • Legal obligation — where we must retain or disclose data to comply with applicable law.

4. How We Use Your Data

We use personal data to:

  1. Generate AI drafts based on your input;
  2. Route your document to a Reviewing Attorney and enable their review;
  3. Process payments and manage your account;
  4. Provide customer support;
  5. Maintain security and prevent misuse of the Service;
  6. Comply with legal and regulatory obligations;
  7. With your separate consent, improve our AI systems and communicate product updates.

5. Who We Share Your Data With

5.1 Reviewing Attorneys. The core of our Service requires that the content of your document be shared in full with the Reviewing Attorney assigned to review it. This is disclosed here and in our Terms as a fundamental part of how the Service works — Attorney Review cannot be performed without full access to your document.

5.2 AI service providers. Our Service is built on Lovable, a software development platform that integrates third-party AI models — including Google Gemini — to power parts of our AI drafting functionality. When you use Guided Drafting, your contract content is processed by these underlying AI providers, indirectly through Lovable's infrastructure, solely to generate your draft.

We do not use your contract content to train AI models, and we do not permit our infrastructure or AI providers to use it for that purpose beyond what is strictly necessary to generate your draft.

5.3 Service providers. We share data with providers who support our operations, such as cloud hosting, payment processing, e-signature, and customer support tooling, under contractual confidentiality obligations.

5.4 Legal and regulatory disclosures. We may disclose data where required by law, court order, or to protect the rights, property, or safety of Legalroom, our users, or others.

5.5 We do not sell personal data. We do not sell, rent, or trade your personal data to third parties for their own marketing purposes.

6. AI Processing and Automated Decision-Making

Because a Reviewing Attorney reviews every document before it is marked "Validated," no document produced through the Service is finalized based on AI processing alone. However, the AI drafting step does involve automated processing of your input to generate the first draft. You have the right to:

  • Understand, at a general level, how the AI drafting process works (described in Section 4 and in our Terms);
  • Request that a human (a Reviewing Attorney) review the substance of the document before it is treated as final — which is already built into our standard process;
  • Object to automated processing of your data for purposes beyond generating your requested draft (e.g., using your data to train models), where applicable, subject to Section 5.2.

7. International Data Transfers

Because our Service is built on Lovable and uses Google's Gemini models (accessed indirectly through Lovable's AI Gateway) to power AI drafting, personal data you submit will, in the ordinary course of using the Service, be transferred outside Nigeria. Specifically:

  • Lovable. Lovable is operated by Lovable Labs Incorporated, based in the United States, with additional operations in Sweden. Account information, prompts, and platform telemetry processed through Lovable's core service may be transferred to, and processed in, the United States regardless of which regional option (if any) is selected for backend data storage.
  • Google Gemini. Contract content you submit is sent to Google's Gemini models to generate your draft. Unless a specific regional configuration has been set up, requests may be routed through Google's global infrastructure, which does not guarantee that processing occurs in any single country — this can include data centers in the United States, the European Union, or elsewhere, depending on where Google routes the request at that time.

Where personal data is transferred outside Nigeria, we take steps to ensure an adequate level of protection, including standard contractual clauses or equivalent safeguards with Lovable and Google. By using the Service, you acknowledge this cross-border processing as described in this Policy.

8. Data Retention

We retain:

  • Account data: for as long as your account is active, and for 6 months after closure for legal/administrative purposes.
  • Contract content and drafts: for 6 years after finalization, or until you request deletion, whichever is earlier, unless a longer period is required by law (e.g., for dispute resolution or regulatory purposes).
  • Payment records: as required by applicable financial recordkeeping laws.

You may request earlier deletion under Section 10, subject to any legal retention obligations we must still meet.

9. Cookies and Tracking

We use cookies and similar technologies to operate the Service, remember your preferences, and understand usage patterns. You can control cookies through your browser settings; disabling some cookies may affect Service functionality.

10. Your Rights Under the NDPA

Subject to applicable law, you have the right to:

  • Access the personal data we hold about you;
  • Correct inaccurate or incomplete data;
  • Delete your data, subject to legal retention requirements;
  • Withdraw consent at any time where processing is based on consent (this does not affect processing already carried out);
  • Object to certain processing, including for direct marketing;
  • Data portability, where technically feasible;
  • Lodge a complaint with the Nigeria Data Protection Commission (NDPC) if you believe your rights have been violated.

To exercise these rights, contact us at theimmanuelking@gmail.com. We will respond within the timeframe required under the NDPA.

11. Security Measures

We implement reasonable technical and organizational measures to protect personal data, including:

  • Encryption of data in transit and at rest;
  • Access controls limiting document visibility to your assigned Reviewing Attorney and authorized personnel only;
  • Regular security review of third-party providers.

No system is completely secure. In the event of a data breach likely to result in risk to your rights, we will notify affected users and, where required, the NDPC, in accordance with applicable timeframes.

12. Children's Data

The Service is not directed at individuals under 18. We do not knowingly collect personal data from minors. If we become aware that we have inadvertently collected such data, we will take steps to delete it.

13. Changes to This Policy

We may update this Policy from time to time. We will notify you of material changes via email or in-app notice, and indicate the "Last Updated" date above. Continued use of the Service after changes take effect constitutes acknowledgment of the revised Policy.

14. Contact Us

For privacy questions, access/deletion requests, or complaints:
Legalroom
theimmanuelking@gmail.com

You may also contact the Nigeria Data Protection Commission (NDPC) directly regarding your data protection rights.