Privacy Notice

FirmStack is practice-management software for Nigerian law firms. This notice explains how we handle personal data when you use the FirmStack website and application, in line with the Nigeria Data Protection Act 2023 (NDPA).

There are two kinds of data in FirmStack, and our role differs for each. For your account (your name, email, login and security settings), FirmStack is the data controller. For the firm's records (clients, matters, dates, tasks, invoices and documents your firm enters), your firm is the data controller and FirmStack processes that data only on the firm's instructions to provide the service.

• Account data: name, work email, password (stored only as a one-way hash), two-factor settings, role and job title.
• Firm data you enter: firm profile, client contact details, matter details, court and filing dates, tasks, notes, invoices, payments recorded and generated documents.
• Client intake answers: information your clients submit through an intake link your firm sends them.
• Text read by FirmStack AI (only if your firm switches it on): what a user chooses to give it: a client brief, a hearing notice or message, or their note of what happened in court; and, when a user asks for a client update or a catch-up on a matter, that matter's record in FirmStack (its dates, tasks, notes, documents prepared and the client's name). It is sent to our AI provider to be read and is not kept by FirmStack; we keep only a record that the feature was used and how much (counts, not content).
• Usage and security data: sign-in times, IP address, device and browser details, and an audit log of actions taken in your firm's workspace.

• To provide and secure the service your firm signed up for (performance of a contract).
• To send service emails such as verification codes, invitations, reminders and invoices your firm shares (performance of a contract).
• To detect misuse, keep an audit trail and protect accounts (legitimate interests and legal obligation).
• To make suggestions with FirmStack AI when a user of a firm that has switched it on asks us to: how to open a matter from a brief, dates for the diary from a notice, the outcome and next steps from a court note, a draft update for the client, or a summary of where a matter stands. We do this on the firm's instructions, as its processor.
• To suggest next steps, dates and documents for a matter from the details the firm has entered. These suggestions are worked out by rules in the software, not by AI.
• To understand which features are used so we can improve them, using counts and events rather than the content of your records (legitimate interests).

• We do not sell personal data or use your firm's records for advertising.
• We do not read your firm's records except when your firm asks for support, or when required by law.
• FirmStack does not hold or move your firm's money and does not ask for your bank login.
• We do not use your firm's records or the briefs you paste to train AI models, and our AI provider does not use them for training either.
• FirmStack does not make decisions about anyone. Its suggestions are for a lawyer to review and decide on.

FirmStack AI is optional and off until a firm administrator switches it on in Settings; they can switch it off at any time. When it is on, a user can ask it to read a client's brief, a hearing notice or their note of what happened in court, or to draft an update for a client or summarise a matter. FirmStack sends what the user gave it, and for an update or a summary the matter's record in FirmStack, to our AI provider, Anthropic, which returns suggestions. Nothing is saved or sent to anyone until the user checks the suggestion and chooses to; a client update is sent by the user from their own WhatsApp or email, never by FirmStack.

This is your firm's data: your firm decides whether its staff may use the feature and what they give it. FirmStack does not keep the text or the suggestions, and neither FirmStack nor Anthropic uses them to train AI models.

We use a small number of service providers (sub-processors) who process data for us under contract:

• Cloud hosting and database (Railway)
• Transactional email delivery (Resend)
• File storage for generated documents
• AI processing (Anthropic), only for firms that switch on FirmStack AI, and only for the brief text a user chooses to send

We will tell firm administrators before adding a new sub-processor that handles firm data.

Our hosting providers and our AI provider may store and process data outside Nigeria. Where that happens, we rely on the safeguards the NDPA recognises for cross-border transfers, including contractual protections with each provider, and we apply the security measures described below wherever the data is held.

• All traffic is encrypted in transit (HTTPS).
• Everything about your clients and matters is encrypted before it is stored: client details, matter details, notes, dates, tasks, intake answers and uploads, bill notes and the documents FirmStack prepares. Emails waiting to be sent are encrypted too.
• Your own name, work email and job title are stored as they are, so FirmStack can find your account when you sign in. Your password is never stored, only an irreversible hash.
• Two-factor authentication, with ethical walls that hide screened matters from individual staff.
• Each firm's data is isolated from every other firm's, and actions are recorded in an audit log.

We keep firm data for as long as the firm's account is active. When a firm closes its account, it can ask us for an export of its data first; we then delete it within 90 days, except backups, which expire on their normal cycle, and records we must keep by law.

FirmStack does not keep the briefs sent to FirmStack AI. Our AI provider may keep them for a short period under its commercial terms, for safety and abuse monitoring, and then deletes them.

Under the NDPA you can ask to access, correct, delete, or receive a copy of your personal data, object to or restrict some processing, and withdraw consent where we rely on it. If your data is in a firm's records, contact that firm first; we will help them respond.

You can also complain to the Nigeria Data Protection Commission (NDPC).

Questions or requests about privacy: privacy@getfirmstack.com. We aim to respond within 30 days. If we change this notice in a way that matters, we will tell account holders by email before the change takes effect.