Privacy Policy
Your privacy and data security are fundamental to our service. This policy explains how Justicesure Technology Ltd collects, uses, protects, and shares your information across our legal and business management platform.
1. Introduction and Scope
Justicesure Technology Ltd ("JusticeSure," "we," "us," or "our") is committed to protecting your privacy and ensuring the security of your personal information. This Privacy Policy describes how we collect, use, disclose, and safeguard your information when you use our AI-powered legal services and business management platform, including our website, mobile applications, WhatsApp integration, Business Suite, and related services (collectively, the "Platform").
This Policy applies to all users of the Platform, including:
- Clients/Individuals seeking legal guidance and services
- Lawyers and Legal Professionals providing services through the Platform
- Law Firms managing their practice through the Platform
- Businesses and Corporations using our Business Suite for invoicing, inventory, HR, payroll, tax, and other operations
- Employees of Businesses whose data is managed by their employer through the Platform
- Auditors and External Accountants granted access to business accounts
- Organizations (NGOs, unions, cooperatives, political parties, election observer bodies) providing legal benefits to members
- Administrators managing Platform operations
This Policy applies across all jurisdictions in which we operate, currently Nigeria, Ghana, and Kenya. We specifically comply with the Nigeria Data Protection Act (NDPA) 2023 and Nigeria Data Protection Regulation (NDPR), the Ghana Data Protection Act 2012, and the Kenya Data Protection Act 2019.
By accessing or using the Platform, you acknowledge that you have read, understood, and agree to be bound by this Privacy Policy.
2. Data Controller and Processor Roles
Understanding our role is important for compliance:
When JusticeSure is the Data Controller
When we collect and process personal data of users who interact directly with us — such as account holders, lawyers, auditors, and individual clients — JusticeSure is the Data Controller and makes decisions about how that data is processed.
When JusticeSure is the Data Processor
When businesses use our HR, payroll, or customer management modules to process data about their employees or customers, those businesses are the Data Controllers. JusticeSure processes that data only on the business's instructions and is the Data Processor. Businesses are solely responsible for having a lawful basis to process such data.
3. Information We Collect
3.1 Account and Identity Information
- All Users: Name, email address, phone number, password (hashed), profile picture, account preferences, and account type
- Lawyers: Bar enrollment number, call year, practice areas, court admissions, law school, and professional credentials
- Auditors: Professional certification details, certification body, license/certificate number, and firm name
- Businesses: Business name, registration number (CAC/DPIIT/BRS etc.), industry, business address, tax identification number (TIN), and bank account details (for payment reconciliation)
- Organizations: Organization name, registration type, address, and representative details
3.2 Legal and Consultation Data
- Legal questions, case descriptions, and instructions you submit to AI or lawyers
- Documents you upload for legal review or processing
- Communications with lawyers through the Platform
- Consultation recordings (where consent is given)
- Legal documents generated on your behalf
3.3 Business Operational Data (Business Suite Users)
- Financial Records: Invoices, receipts, expenses, payment records, bank statements imported for reconciliation, and financial reports
- Inventory Data: Product names, descriptions, SKUs, pricing, stock levels, production records, and supplier information
- Sales Data: Customer records, transaction history, POS records, and storefront activity
- Customer Data: Names, contact details, and purchase histories of the business's end-customers entered by the business
- Tax Data: VAT filings, PAYE computations, withholding tax records, pension contributions, and other tax-related information
3.4 Employee Data (Processed on Behalf of Businesses)
Employee Data Notice
If you are an employee whose data has been entered into JusticeSure by your employer, your employer (not JusticeSure) is the Data Controller for that data. Please contact your employer for information about how they process your data. You may contact us at privacy@justicesure.com for assistance in identifying the correct Data Controller.
When businesses use the HR module, they may enter the following employee personal data onto the Platform:
- Full name, date of birth, gender, and contact details
- National identity numbers (NIN, Ghana Card, National ID) and BVN where entered by the employer
- Bank account details for payroll disbursement
- Salary, allowances, deductions, and payroll history
- Employment terms, role, department, and reporting line
- Leave records, attendance, and timesheet data
- Performance records, appraisals, and HR notes
- Disciplinary and grievance records
- Pension PIN and pension contribution records
- Tax identification and PAYE records
- Next of kin and emergency contact information
3.5 Auditor Access Data
- Auditor's account details and professional credentials
- Records of which business accounts the auditor has been granted access to
- Audit access logs including login times, data accessed, and actions taken
- Any notes or annotations made by the auditor within the Platform
3.6 Payment Information
- Billing address and payment method details (processed and stored by our payment partners — we do not store full card numbers)
- Transaction history for Platform subscription payments
- Referral programme balances and transaction records
3.7 Automatically Collected Information
- Device Information: IP address, device type, operating system, browser type, and unique device identifiers
- Usage Data: Pages visited, features used, time spent, click patterns, and search queries (used for analytics and product improvement)
- Location Data: General geographic location based on IP address (not precise GPS location)
- Session Data: Login times, session duration, and authentication events
- Cookies and Similar Technologies: Session cookies, preference cookies, and analytics identifiers
3.8 Information from Third Parties
- Authentication Providers: When you sign in using Google OAuth, we receive basic profile information (name, email, profile picture)
- Payment Processors: Transaction confirmation and fraud prevention signals from Paystack, Flutterwave, or Stripe
- Banking Data Providers: Where you connect bank accounts via Mono or similar services, we receive transaction data from your bank
- Professional Verification: Confirmation of credentials from recognized professional bodies where applicable
4. How We Use Your Information
4.1 Service Delivery
- Provide AI-powered legal guidance and document generation services
- Connect you with qualified lawyers for consultations
- Process Platform subscription payments and manage accounts
- Facilitate video and voice consultations
- Operate the Business Suite including invoicing, inventory, HR, payroll, POS, and tax tools
- Enable auditor access to authorized business accounts
- Process and display financial data as entered by the business
- Compute tax liabilities, payroll deductions, and other financial calculations based on data provided
4.2 AI Processing
Important Notice About AI Processing
Your legal questions, business queries, and interactions may be processed by AI systems including large language models (such as OpenAI's technology and Perplexity) to provide guidance, generate documents, and assist with business operations. We implement data minimization principles — we aim to send only necessary context to AI providers and do not send clearly identified sensitive personal data (such as NIN, BVN, or full bank account numbers) to AI providers.
AI-generated responses are for informational purposes only. They are not legal advice, tax advice, or professional financial advice.
4.3 Security, Fraud Prevention, and Compliance
- Detect, investigate, and prevent fraudulent activity, money laundering, and abuse of the Platform
- Maintain audit logs of access to business financial data (including auditor access)
- Comply with anti-money laundering (AML) and Know-Your-Customer (KYC) obligations under Nigerian, Ghanaian, and Kenyan law
- Respond to lawful requests from law enforcement, regulatory, and government authorities
- Enforce our Terms of Service and protect our legal rights
4.4 Communication
- Send service-related notifications (invoice reminders, case updates, appointment reminders, compliance deadlines)
- Send automated business communications on your behalf (e.g., invoice delivery emails to your customers) — these are sent as your agent, not for our own marketing purposes
- Respond to your inquiries and support requests
- Send marketing communications about JusticeSure services (with your consent; you can opt out at any time)
- Notify you of changes to our services or policies
4.5 Product Improvement
- Analyze aggregated, anonymized usage patterns to improve the Platform
- Conduct internal research and analysis on platform performance
- Test new features and improvements
We do not use identifiable personal data or business financial data for product improvement purposes without explicit consent. All improvement analytics use aggregated and anonymized data.
5. Legal Basis for Processing
We process personal data based on the following lawful grounds under applicable law:
Nigeria (NDPA 2023 / NDPR)
- • Consent (where obtained)
- • Contract performance
- • Legal obligation
- • Legitimate interest
- • Vital interest
Ghana (Data Protection Act 2012)
- • Consent
- • Necessary for contract
- • Legal obligation
- • Protection of vital interests
- • Legitimate interests of data controller
Kenya (Data Protection Act 2019)
- • Explicit consent
- • Contract necessity
- • Legal obligation
- • Public interest
- • Legitimate interests
Sensitive Data
- • Explicit consent required for sensitive categories (health, biometric, financial identity data)
- • Employment law necessity for HR data
- • We do not process sensitive data beyond what is strictly necessary
6. How We Share Your Information
6.1 Service Providers
We share information with trusted third-party service providers who assist in operating our Platform under data processing agreements:
- Payment Processors: Paystack, Flutterwave, and Stripe for subscription payment processing
- AI Services: OpenAI (GPT models) and Perplexity for natural language processing; only necessary and de-identified context is shared
- Communication Services: SendGrid (email), Africa's Talking (SMS), WhatsApp Business API (messaging)
- Cloud Infrastructure: Neon (database hosting), cloud storage and compute providers — all subject to data processing agreements
- Video Conferencing: For consultation features
- Banking Data: Mono for bank statement import and reconciliation (with your explicit authorization)
6.2 Lawyers and Legal Professionals
When you request a consultation or legal service, we share relevant case information with the assigned lawyer. This sharing is essential to provide the requested services and is protected by professional confidentiality obligations. We do not share this information with other lawyers or parties without your consent.
6.3 Auditors and External Accountants
When a business account owner grants access to an auditor through the Auditor Portal, that auditor may access the business data categories authorized by the business owner. JusticeSure logs all auditor access (login times, data viewed, and actions taken). Business owners can revoke auditor access at any time. JusticeSure does not independently authorize auditor access — all access is solely at the instruction of the business account owner.
6.4 Organizations (Member Benefit Programs)
If you access JusticeSure through an organization's member benefit program, we may share aggregate usage statistics with the organization. We will not share the details of your legal matters, queries, or personal data with the organization without your explicit consent.
6.5 Business Communications to Your Customers
When you use the Platform to send invoices, payment reminders, quotes, or notifications to your customers, we process your customers' contact details solely as your agent to deliver those communications. We do not use your customers' contact information for any other purpose, including our own marketing.
6.6 Legal and Regulatory Disclosure
We may disclose your information when required to do so by law, court order, regulatory directive, or governmental request from a competent authority in Nigeria, Ghana, Kenya, or another jurisdiction with applicable reach. Where permitted, we will notify you before complying. We may also disclose information:
- To protect the rights, property, or safety of JusticeSure, our users, or the public
- To detect, prevent, or address fraud, money laundering, or security incidents
- In connection with a merger, acquisition, or sale of business assets (subject to equivalent data protection obligations)
6.7 What We Do NOT Do
- We do NOT sell your personal information to any third party
- We do NOT share your data for third-party marketing without your explicit consent
- We do NOT access privileged lawyer-client communications
- We do NOT use business financial data or employee data for our own commercial purposes beyond service delivery
- We do NOT share your customers' contact data with any third party for marketing purposes
- We do NOT grant auditor access without explicit authorization from the business account owner
7. Data Security
We implement comprehensive security measures to protect your personal information:
Technical Measures
- • TLS/SSL encryption for all data in transit
- • Encryption for sensitive data at rest
- • Secure password hashing (bcrypt)
- • Role-based access controls throughout the platform
- • Audit logs for sensitive data access
- • Rate limiting and intrusion detection
- • Regular security assessments
Organizational Measures
- • Strict need-to-know access controls for staff
- • Employee training on data protection
- • Confidentiality obligations for all staff
- • Incident response and breach notification procedures
- • Regular backups and disaster recovery
- • Vendor due diligence for third-party processors
Auditor Access Logging: All actions taken by auditors within the Platform — including which records they view, download, or export — are logged and may be reviewed by the business account owner.
While we implement robust security measures, no method of transmission over the Internet or electronic storage is 100% secure. We cannot guarantee absolute security, but we are committed to protecting your information to the best of our ability. In the event of a data breach that is likely to result in a risk to your rights and freedoms, we will notify the relevant Data Protection Authority and affected users as required by law.
8. Data Retention
We retain your personal information for as long as necessary to fulfill the purposes outlined in this Privacy Policy, comply with our legal obligations, resolve disputes, and enforce our agreements. Our specific retention periods are:
| Data Category | Retention Period | Basis |
|---|---|---|
| Account data | Duration of account + 7 years after closure | Legal and regulatory compliance |
| Legal documents and consultations | 10 years | Professional legal standards |
| Financial and transaction records | 7 years | Tax and financial compliance (FIRS/GRA/KRA) |
| Payroll and HR records | 7 years from employment end | Labour law and tax compliance |
| Invoices and business documents | 7 years | Tax and commercial compliance |
| Auditor access logs | 7 years | Audit accountability and legal compliance |
| Security and access logs | 3 years | Security investigation and fraud prevention |
| Communication logs (support) | 3 years | Dispute resolution |
| Platform analytics (aggregated) | Indefinite (anonymized) | Service improvement |
Following account termination or cancellation, you will have 90 days of read-only access to export your data before it enters the deletion schedule above. Data subject to ongoing legal proceedings or regulatory investigations may be retained beyond these periods.
9. Your Data Rights
Depending on your jurisdiction, you have the following rights regarding your personal data. These rights apply to data for which JusticeSure is the Data Controller. If JusticeSure is acting as a Processor (e.g., for employee data managed by an employer), please contact your employer as the Data Controller.
Right to Access
Request a copy of the personal data we hold about you and information about how it is processed
Right to Rectification
Request correction of inaccurate or incomplete personal data we hold
Right to Erasure
Request deletion of your personal data, subject to our legal retention obligations (financial and legal records must be retained per applicable law)
Right to Restrict Processing
Request that we limit how we use your data in certain circumstances
Right to Data Portability
Receive your personal data in a structured, machine-readable format to transfer to another service
Right to Object
Object to processing based on legitimate interests or for direct marketing purposes
Right to Withdraw Consent
Where processing is based on consent, withdraw it at any time without affecting prior processing
Right to Lodge a Complaint
File a complaint with the Nigeria Data Protection Commission (NDPC), Ghana Data Protection Commission, or Kenya Office of the Data Protection Commissioner
To exercise any of these rights, please contact us at privacy@justicesure.com with your full name, account email, and a clear description of your request. We will respond within 30 days (extendable to 60 days for complex requests). We may need to verify your identity before processing your request.
10. Cookies and Tracking Technologies
We use cookies and similar technologies to enhance your experience on our Platform:
- Essential Cookies: Required for Platform authentication, session management, and basic security — cannot be disabled
- Preference Cookies: Remember your settings (language, theme, display preferences)
- Analytics Cookies: Help us understand how users interact with our Platform to improve it (may be opt-out)
- Security Cookies: Help detect and prevent fraudulent activity and unauthorized access
You can manage cookie preferences through your browser settings. Note that disabling certain cookies (especially essential and security cookies) will affect Platform functionality and may prevent you from logging in.
11. International Data Transfers
Your information may be transferred to and processed in countries other than your home country. In particular, our AI service providers (including OpenAI) are based in the United States, and our infrastructure providers operate globally. When transferring data internationally, we ensure appropriate safeguards:
- Data processing agreements incorporating NDPC-approved standard contractual clauses or equivalent protections
- Service provider certifications and binding data protection commitments
- Technical and organizational measures proportionate to the sensitivity of the data transferred
We apply data minimization principles to international transfers — we do not transfer clearly identified sensitive personal data (such as NIN, BVN, or detailed employee records) to AI providers. Only the context necessary to generate a useful response is transferred.
12. Children's Privacy
Our Platform is not intended for individuals under the age of 18. We do not knowingly collect personal information from children. If you are a parent or guardian and believe your child has provided us with personal information, please contact us immediately at privacy@justicesure.com, and we will take steps to delete such information promptly.
13. Special Categories of Sensitive Data
We recognize that certain data is particularly sensitive. We take extra care with:
- National Identity Numbers (NIN, Ghana Card, National ID, BVN): Processed with strict access controls; never shared with AI providers; stored encrypted
- Health-related information: Only collected where you or your employer provides it for legitimate HR purposes (e.g., sick leave records); not used for any other purpose
- Financial identity data: Bank account numbers, tax identification numbers, and pension PINs are protected with enhanced security and access controls
- Legal case information: Treated as highly confidential; shared only with the lawyer you engage and protected by privilege obligations
We collect sensitive data only where necessary for the specific service being provided and subject to appropriate legal authority for processing.
14. Changes to This Privacy Policy
We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. When we make material changes:
- We will notify you by email or through the Platform at least 30 days before the changes take effect for existing users
- We will update the version number and effective date at the top of this page
- For material changes that expand our use of your data, we will seek fresh consent where required by applicable law
- Your continued use of the Platform after the effective date constitutes acceptance of the revised Policy
15. Contact and Data Protection Officer
For any privacy-related questions, requests, or complaints, please contact us at:
Data Protection Complaints
Nigeria: Nigeria Data Protection Commission (NDPC)
Registered Company
Justicesure Technology Ltd
Incorporated under the laws of the
Federal Republic of Nigeria
Ready to get started?
Join Nigerian businesses, lawyers & individuals managing business operations, compliance and legal work smarter.