Privacy Policy

This Privacy Policy explains how Asem Legal Software (“Asem Legal”, “we”, “us”) collects, uses, shares and protects personal data when you use the Asem Legal desktop app, mobile apps for iOS and Android, web consoles, APIs and website at asemlegal.com (together, the “Service”). It is written to meet the Ghana Data Protection Act, 2012 (Act 843) and, where it applies, the EU General Data Protection Regulation (GDPR).

1. Who we are and our role

Asem Legal Software is based in Ghana. Asem Legal is practice-management software for law firms. Our role depends on whose data it is:

• Firm data (we are a processor). When a law firm uses Asem Legal, the firm decides what matters, clients, documents and communications go into the Service. For that data the firm is the data controller and we process it only on the firm’s instructions, under our agreement with the firm. If you are a client of a law firm that uses Asem Legal, contact that firm first about your data. We will help the firm respond.
• Our own data (we are a controller). We are the controller for account and billing data about our customers’ users, website enquiries, support requests and the security and operational data we need to run the Service.

2. Data we collect

Account and profile data

Name, work email address, firm, role (for example managing partner, lawyer, clerk or reception), password (stored only as a salted hash), language preference, profile photo if you add one, and sign-in and session records.

Content your firm puts into the Service

Matters and case records, client and party details (which can include contact details, dates of birth, identity documents and information about legal proceedings), documents and their versions, notes, tasks, calendar events, time entries, invoices, messages, comments and, where your firm uses them, call recordings, transcripts and voice notes. Legal matters can involve special-category or criminal-offence data. We process it only to provide the Service to the firm.

Identity verification and AML screening

When a firm runs client due diligence, the client’s identity document, selfie or liveness check, and the results of sanctions, politically-exposed-person and adverse-media screening are processed by our verification provider, Didit. A person at the firm reviews every result before any decision is made.

Device and app data

• Push notification token (Firebase Cloud Messaging / Apple Push Notification service), so we can send you notifications you have enabled.
• Camera, photos and microphone, only when you choose to scan or attach a document or photo, record a voice note, or join a call. We don’t access them in the background.
• Technical logs: IP address, device and operating-system type, app version, request timestamps and error details, used for security, abuse prevention and fixing faults.

Billing data

Firm subscription and invoice details. Card and mobile-money payments are handled by Paystack. We never see or store full card numbers.

Connected accounts

If you connect a Google or Microsoft account, we receive OAuth tokens and only the data needed for the feature you turned on: calendar events (to sync them both ways), sending firm email from your mailbox, files in folders your firm connects from Google Drive, and Google Meet meetings you create in Asem Legal (with their transcripts, for meeting notes). You can disconnect at any time.

Google user data and Limited Use

Asem Legal's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements. The use of raw or derived user data received from Google Workspace APIs will adhere to the Google User Data Policy, including the Limited Use requirements.

• We use Google user data only to provide and improve the features the user turned on, inside Asem Legal.
• When a user asks an AI feature to work on Google data (for example, notes from a Google Meet transcript, or reviewing a file from a connected Google Drive folder), that data is processed by Cloudflare Workers AI to produce the result for that user only. It is not used, by us or by Cloudflare, to create, train or improve foundational or generalized AI/ML models, and we do not transfer it to any other AI provider.
• We don’t sell Google user data, use it for advertising, or let people read it except with the user’s permission, for security or legal reasons, or as part of aggregated internal operations.
• Disconnecting a Google account revokes our access; the firm can delete imported data at any time.

What we don’t do

We don’t sell personal data, show advertising, use third-party advertising or tracking SDKs, or track you across other companies’ apps and websites.

3. How we use data, and our legal bases

4. AI features

Asem Legal includes optional AI features, such as document review, drafting help, transcription, research and case intelligence. Your firm controls whether they are enabled. These features run on Cloudflare Workers AI. Firm content sent to them is used only to produce your result. We don’t use your firm’s content to train AI models, and we don’t allow our providers to do so. AI output can be wrong. A qualified person must review it before relying on it.

5. Where data is stored

Firm data is stored in the European Union: the database is on Convex in the EU, and files, recordings and backups are in Cloudflare R2 with EU jurisdiction. Users in Ghana and elsewhere reach it over encrypted connections, which counts as an international transfer. We protect these transfers with contractual safeguards, encryption and access controls. Some sub-processors listed below may process limited data outside the EU under their own safeguards.

6. Who we share data with

We share personal data only with the service providers (sub-processors) that help us run the Service, only for that purpose, and under written data-protection terms:

When a firm takes payments from its own clients through Asem Legal, those payments go through the firm’s own payment-provider account (for example Paystack, Hubtel, Stripe or Flutterwave). That provider is the firm’s processor, not ours. We pass it only what’s needed for the payment: the amount, a reference, and the payer’s name and email. We store the firm’s provider keys encrypted (AES-256-GCM, with keys held in a separate secrets store), and nobody can read them back, including our staff and the firm.

We may also disclose data if required by law or a valid court order (we will tell the affected firm unless the law prohibits it), to protect the rights and safety of users or the Service, or to a successor in a merger or acquisition, which must honour this policy. Firms get advance notice of new sub-processors and can object.

7. How long we keep data

We keep firm data for as long as the firm’s account is active, then delete it under the firm’s instructions, within 90 days of the account closing. Backups roll off within a further 35 days. Some records must be kept longer, and in those cases the retention requirement overrides deletion: records under professional-conduct rules, records the firm places on legal hold, AML records (normally at least five years under Act 1044), tamper-evident audit logs, and our own accounting records. Technical logs are kept for up to 12 months.

8. Security

Data is encrypted in transit (TLS) and at rest. Every record is isolated by firm. Access follows the roles your firm assigns, and audit logs record sensitive actions. Call recording requires every participant’s consent, and recordings are kept with the same access controls as the rest of the case file. If a breach affects firm data, we will notify the firm without undue delay and within 24 hours of confirming it, so the firm can meet its own reporting duties.

9. Your rights

Under Act 843 and, where it applies, the GDPR, you may ask to access, correct, delete or export your personal data, to restrict or object to processing, and to withdraw consent. For data held by a law firm, send your request to the firm; we will help it respond. For data we control, email info@mail.asemlegal.com. We will respond within 30 days. You can also complain to Ghana’s Data Protection Commission (dataprotection.org.gh) or, in the EU, to your local supervisory authority.

To delete your Asem Legal user account, see asemlegal.com/delete-account.

10. Children

The Service is for legal professionals and their staff and is not directed at children. We don’t knowingly collect personal data from anyone under 18 except as part of a matter a law firm handles, where the firm is the controller.

11. Changes

We may update this policy. If we make material changes, we will notify account administrators and show a notice in the apps before the changes take effect. The effective date at the top always shows the current version.

12. Contact

Asem Legal Software, Ghana
Email: info@mail.asemlegal.com