What we hold, and what we will not do with it.

Who we are and what this covers

Wakalat is a technology platform that helps people in Pakistan find verified advocates and law firms, and gives advocates and their clients a private workspace in which to run a matter.

Wakalat is not a law firm. It does not practise law, does not provide legal advice, and is not a party to the relationship between you and any advocate you engage. It is not a payment processor and does not hold, transmit or escrow money.

This policy explains what we collect, why, who it is shared with, how long it is kept, and what you can ask us to do about it. It should be read with our Terms and Conditions.

We build to the Prevention of Electronic Crimes Act 2016 (PECA) and to Pakistan's pending personal data protection legislation: consent is captured explicitly, retention periods are defined, and deletion requests are honoured.

The roles this policy covers

Your data depends on which role your account holds.

What we collect

4.1 Account and identity — all roles

• Your name, email address and phone number.
• Authentication credentials held by our authentication layer (your password is stored only as a cryptographic hash; we never see or store it in readable form).
• Two-factor authentication settings. These are mandatory for Advocate, Firm Administrator and Platform Administrator accounts.
• Session records, including IP address and browser or device user-agent, so you can see and revoke your own active sessions.

4.2 Verification data — Advocates and Firms

• Your CNIC (Computerised National Identity Card) number and supporting identity documents.
• Your Bar Council enrolment details, enrolment category and supporting documents.
• The verification decision made about you: approve, reject or suspend, together with the reviewing administrator's identity, the timestamp and the stated reason.

Your court tier — Advocate, Advocate High Court, or Advocate-on-Record Supreme Court — is *derived* from your verified enrolment category by a fixed rule. It is never self-declared or freely typed.

4.3 Professional profile — Advocates and Firms

• Practice areas, languages spoken, city, and firm affiliation.
• Your profile photograph, if you upload one. This is stored in a separate public bucket, because it is displayed on your public profile.
• Notable reported judgments you have expressly chosen to list, and client reviews published with the reviewer's consent.

4.4 Matter and case-room data — Clients and Advocates

• Consultation requests and intake details, including any documents attached, and the opposing-party details used for conflict-of-interest checking.
• Case-room messages, case events, status updates, court orders, hearings and notes.
• Vault documents, including every version of each document, and the record of who accessed each one and when.
• The engagement agreement and the fee milestones recorded against the matter.

This is the most sensitive category we hold. See section 6.

4.5 AI legal assistant

• The text of your question, the language you asked it in, and any filters you applied.
• The answer returned, the sources it cited, its confidence level, and how the assistant responded — for example whether it answered or declined.
• If you are signed in, the question is linked to your account. If you are not signed in, it is linked only to a one-way cryptographic hash of your network address and a browser cookie. There is deliberately no column in our database capable of holding a raw IP address for the assistant.

4.6 Technical and operational

• Device push-notification tokens, if you enable push notifications on mobile.
• Your notification preferences, per category and per channel.
• An append-only audit log of privileged and administrative actions, recording who acted, on what, and when.
• Rate-limiting counters used to keep the assistant and other endpoints available.

4.7 What we do not collect

• We do not collect precise device location.
• We do not collect contacts, calendar, photos library, microphone or camera data beyond files you deliberately choose to upload.
• We do not use advertising identifiers, and we run no advertising SDKs.

How we use it, and on what basis

We process your data on the basis of the consent you give when you create an account and accept these documents, our legitimate interest in operating and securing the platform, and where applicable our legal obligations.

We do not sell personal data. We do not use privileged matter content — messages, vault documents, intake details — for advertising, for product analytics, or to train any model.

Privileged matter data

Matter workspaces, case-room messages and vault documents are treated as privileged, and that treatment is built into the system rather than promised in prose:

• All such data is encrypted in transit and at rest.
• Access is strictly matter-scoped and isolated per firm. An advocate at the same firm who is not a party to your matter cannot reach it.
• Every server action re-checks your permission against your session. The interface only reflects what you may do; it never grants it.
• Documents are served only through short-lived signed links issued after an authorisation check.
• Every privileged or administrative action is written to an append-only audit log with the actor's identity and a timestamp. That log cannot be edited or deleted by anyone, including us.

The AI legal assistant and your questions

The assistant answers only from a curated corpus of Pakistani legal material and always cites what it relied on. It gives legal information, never legal advice.

Your question text leaves our infrastructure. To generate an answer, the question is sent to our external inference provider (see section 8). Before it is sent:

• No identity field is attached — not your name, your email, your account id, or your session.
• The provider receives the question and the retrieved corpus passages, and nothing else.

Do not paste privileged material, another person's confidential information, or details that identify your own matter into the assistant. Use the case room for anything confidential.

We store your question and the answer so that a later complaint can be investigated against what was actually shown to you. If you are signed in, you can view this history and delete it at any time from the assistant.

Who we share it with

We do not sell your data. We share it only with the service providers below, each of which processes it on our instructions and for the purpose named.

Several of these operate outside Pakistan. Using Wakalat therefore involves the transfer of your data to other countries, which may have different data-protection regimes to Pakistan's. By using the platform you consent to that transfer.

We may also disclose data where we are legally required to, to enforce our Terms, to protect the rights or safety of any person, or in connection with a complaint escalated to a Provincial Bar Council — which is the body with disciplinary jurisdiction over advocates.

Cookies and similar technologies

We use a small number of cookies and equivalent local-storage entries. We do not use advertising or cross-site tracking cookies.

On mobile, the equivalent of the session cookie is a token held in the device's secure keystore.

Security

• Encryption in transit (TLS) and at rest.
• Passwords stored only as cryptographic hashes.
• Mandatory two-factor authentication for Advocate, Firm Administrator and Platform Administrator accounts.
• Server-side authorisation re-checked on every request against session data, never against an identifier supplied by the client.
• Signed, short-lived, single-purpose URLs for every document access.
• An append-only audit log that no user or administrator can alter.
• Optional device-lock (biometric or passcode) on the mobile apps.

No system is perfectly secure. If a breach occurs that is likely to affect your rights, we will notify you and the relevant authority without undue delay, describing what happened, what data was involved and what we are doing about it.

Retention and deletion

Closing your account

You can close your account yourself, at any time, from the app or the website. There is no request, no approval and no waiting period, and closure is never refused.

• In the mobile app: Account → Delete account
• On the website: Account → Delete account
• Full details: wakalat.app/delete-account

When you confirm, the following happens immediately:

• Every session is signed out, and you cannot sign back in.
• Your saved password and any two-factor authentication secrets are deleted outright.
• Your public profile, if you are an advocate, is removed from search and is no longer reachable.
• Any consultation request still awaiting your reply is closed, so no client is left waiting.
• Your registered devices stop receiving notifications.
• Your name, email address, phone number and profile photograph are erased from your account record.

What is retained, and why:

• Matter records shared with another party. A matter has two parties. Your advocate's — or your client's — copy of a shared matter is their record too, and closing your account does not delete theirs. After closure it is attributed to a closed account rather than to your name.
• Verification decisions, permanently, as above.
• Audit log entries, permanently, as above.
• Material under an open complaint. While a complaint naming you is still being investigated, your account record is kept identifiable so that the complaint can be resolved fairly. Your account is deactivated immediately regardless; the erasure of your name and contact details completes automatically once that complaint is closed.

Residual copies in encrypted backups age out on the normal backup retention cycle, currently 6 hours (our database provider's point-in-time restore window).

If you can no longer sign in, write to info@wakalat.app from the email address on the account.

Your rights and choices

• Access — see the data held about you, much of which is visible in the product itself.
• Correction — correct inaccurate details from your profile, or by writing to us.
• Deletion — close your account (section 11), delete your assistant history, or request deletion of a vault document.
• Object or restrict — ask us to stop a particular use, where the law allows.
• Communication preferences — turn off email, SMS and push notifications by category. Transactional messages essential to a matter cannot be turned off while that matter is active.
• Sessions — see every signed-in device and revoke any of them.
• Complain — write to us first at info@wakalat.app. You may also complain to the relevant authority in Pakistan.

We respond to rights requests within 30 days.

Children

Wakalat is not intended for anyone under 18. You must be 18 or over to create an account. We do not knowingly collect data from children. If you believe a child has given us data, write to info@wakalat.app and we will delete it.

Where a matter concerns a minor, any data about that minor is provided by the adult party to the matter and is held as part of the privileged matter record under section 6.

Changes to this policy

We may update this policy. The version and effective date at the top will change. Where an update materially affects your rights, we will tell you in the product or by email before it takes effect, and where the law requires it we will ask you to accept the updated policy before you continue using the platform.

Contact

• General and privacy: info@wakalat.app
• Grievance officer: Grievance Officer, Wakalat — info@wakalat.app
• Pakistan: Crystal Telecom, M2, Plot 37C, Street 10, Khadda Market, Phase 5, Karachi · 0334-1221495
• United Kingdom: Cloudex Technologies LTD, 852, 85 Dunstall Hill, Wolverhampton WV6 0SR · info@cloudextechnologies.io · +44 7840 983410
• Website: https://www.cloudextechnologies.io/