Privacy Policy

What we collect

• Account information — your name, email address, the firm or organisation you belong to, your role within it, and your authentication details. If you sign in with Google, we receive your name, email address and profile image from Google; we never receive your Google password.
• Matter content — everything your firm puts into the platform: matters, parties, deadlines, notes, chat messages to the assistant, and documents uploaded to a vault. This routinely includes client confidential and privileged material.
• Usage records — which features were used and when, AI requests and the tokens they consumed, and error diagnostics. We meter AI usage because it is billed. Product analytics record which screens and controls are used, never what they show: the text on screen is removed before an event leaves your device, and we do not record sessions.
• Billing information — subscription tier, seat counts, invoices and payment status. Card and mobile-money credentials are handled by our payment provider and are never stored on our systems.
• Technical data — IP address, browser or app version, device type, and timestamps, recorded in server logs.

Why we hold it

We process personal data to provide the service you have contracted for: to authenticate you, to store and retrieve your matter files, to calculate deadlines and send reminders, to answer questions through the AI assistant, to bill your firm, to support you when something breaks, and to keep the platform secure. We do not sell personal data, and we do not use it for advertising.

Our lawful bases are the performance of our contract with your firm, our legitimate interest in operating and securing the platform, compliance with legal obligations such as tax record-keeping, and — where it applies, for example to optional voice features — your consent.

How the AI assistant uses your content

When you ask the assistant a question, the relevant part of your matter — your prompt, and any documents or search results it retrieves — is sent to a third-party model provider to generate the answer. This is unavoidable: the models do not run on our own hardware.

• We do not train any model on your content, and we do not permit our providers to use content submitted through our API accounts to train theirs.
• Which provider handles your content is configurable. Your firm can restrict processing to a single approved provider, and an administrator can narrow that choice further for individual members.
• Voice features send audio to a speech provider for transcription and return synthesised speech. They only run when you start them.
• Assistant answers are generated text. They are not legal advice and must be checked against the cited source before you rely on them — see the Terms of Use.

Who processes data on our behalf

We use the following subprocessors to deliver the service. Each is bound by its own terms to process data only as needed to provide its function.

The current list is maintained here. We will update this page before adding a subprocessor that handles matter content. If you need advance notice of changes as a contractual term, contact us at contact@practocore.com.

Where your data goes

Our application servers and document storage are hosted outside Uganda, and the AI and speech providers listed above process data in their own jurisdictions, principally the United States and Europe. Section 19 of the Data Protection and Privacy Act, 2019 permits such transfers where the receiving country affords adequate protection or where you have consented; we rely on the contractual protections in our agreements with each provider.

How long we keep it

• Matter content — for as long as your firm keeps its account, and then for 30 days after termination so it can be exported, after which it is deleted. Your firm can delete individual matters and documents at any time.
• Account records — until the account is closed. When you delete your account (practocore.com/delete-account) it is closed at once and your personal data is erased within 30 days.
• Billing records — for as long as Ugandan tax and company law requires us to keep them.
• Server and diagnostic logs — kept on a short rolling window and then discarded.

Security and confidentiality

Traffic to and from PractoCore is encrypted in transit with TLS. Access to a firm's data is scoped to that firm; within a firm, access to matters and vaults is controlled by role and membership. Documents are held in object storage that is not publicly listable, and administrative access on our side is limited to the people who need it to run the service.

We treat everything in a matter as confidential and potentially privileged. Our staff do not read matter content except where you ask us to, in order to resolve a support issue you have raised, or where we are compelled by law.

No system is immune to compromise. If a breach affects your personal data we will notify you and the Personal Data Protection Office as the Act requires.

Your rights

Under the Data Protection and Privacy Act, 2019 you may ask us to confirm what personal data we hold about you, to give you a copy of it, to correct it if it is wrong, to delete it, or to stop processing it in certain circumstances. You may also withdraw consent where processing rests on consent.

Where the data sits inside a firm's workspace, that firm decides what happens to it and you should raise the request with them first; we will assist them in answering it. Otherwise write to contact@practocore.com and we will respond within 30 days. If you are not satisfied, you may complain to the Personal Data Protection Office of Uganda.

The Word and Outlook add-ins

Our Microsoft Word and Outlook add-ins run the same PractoCore workspace inside a task pane. They read the document or email you are working on only when you ask them to act on it, and they send that text to PractoCore under this policy. They do not scan your mailbox or your document library in the background, and they store nothing on Microsoft's servers beyond what Office itself retains.

Sign-in from the pane uses the same Google authentication as the web app, opened in an Office dialog window. Microsoft does not receive your PractoCore credentials, and we do not receive your Microsoft credentials.

Children

PractoCore is a professional tool sold to law firms. It is not directed at children and we do not knowingly collect personal data from anyone under 18.

Changes to this policy

We will update this page when our practices change and revise the date at the top. If a change materially affects how we handle matter content, we will tell account administrators directly rather than relying on this page alone.