PRODUCT.md §10.1

Privacy & Cookie Policy

Effective 16 September 2026. Binding long-form text is in PRODUCT.md. This page is the public copy.

Controller: the operator of Owlaw.

What we process
- Account data: name, email, firm slug, role, hashed password, optional TOTP secret.
- Practice data the firm puts in the product: clients, matters, documents, trust ledgers, call metadata, signatures, PAIA manuals, FFC numbers.
- Usage: login times, audit log, module flags, PSTN minute counts.
- Cookies / local storage: ls_access, ls_refresh, ls_user, ls_tenant (session). First-party only. No advertising pixels in the demo.

Purpose and lawful basis (POPIA ss 11–12)
- Perform the contract to host a practice system.
- Legitimate interest / compliance: security, audit, FFC gating, recon.
- Consent: call recording (opt-in).

Attorney-client privilege. Matter text belongs to the tenant. The assistant does not send prompts to a vendor unless the operator sets LEGALSUITE_AI_PROVIDER and a key (see Staff assistant). The operator is an operator under POPIA ss 20–22 for tenant files.

Rights. Access, correction, deletion, objection, and complaint to the Information Regulator (South Africa). Texas users may also use applicable US state rights.

Cookies. Strictly necessary session storage only. The demo does not set third-party cookies.
Owlaw