Privacy policy — DeLaw mobile app
Effective 24 October 2026. This page is the DeLaw privacy policy as it applies to the DeLaw mobile app for Android and iOS. The DeLaw privacy policy at https://delaw.io/privacy covers delaw.io, the DeLaw web app and this app together, with the same facts; this page repeats the part that concerns the app. It explains what personal data the app and its servers process, why, where it goes, how long it is kept, and the rights you have under the Nigeria Data Protection Act 2023 (NDPA) and the General Application and Implementation Directive 2025 (GAID).
Who we are
- Provider. Korevra Technologies Limited ("Korevra", "we"), a company registered in Nigeria, in Lagos, provides DeLaw.
- Data protection contact. support@korevra.com, with "Data protection" in the subject.
- Your personal workspace. Korevra is the data controller for your account data. You are the controller of the client and matter data you record, and you are responsible for the professional obligations that attach to it.
- An organisation's workspace. The organisation that runs DeLaw (a law firm, legal department or legal aid organisation, "the tenant") is the data controller for everything inside its workspace. Korevra is the data processor and acts only on the tenant's instructions. Requests about data held by a tenant go to that tenant's administrator.
The mobile app and the web app
The DeLaw mobile app is a companion app with its own sign-in and its own data. It does not show a firm's workspace in the DeLaw web app at app.delaw.io, and the web workspace does not see what is recorded in the app. The two run on separate servers in different Google Cloud regions.
What we collect, and why
| Data | Why | Legal basis |
|---|---|---|
| Name, email address, phone number | Your account, sign-in codes, security notices | Contract |
| Practitioner details (enrolment number, year of call, roll status) | Verifying that you are a legal practitioner; optional | Consent |
| Matter, client, document, time and fee-note records you or your organisation enter | Providing the service | Contract (your personal workspace) or the tenant's instructions (an organisation's workspace) |
| Document scans and photos you choose to capture | Filing documents to matters; their text is read by Google Cloud Vision so the document can be searched, and is used for nothing else | Contract |
| Notes you take, and voice recordings you choose to make (the Recorder) | Attendance notes, meeting minutes, calls and dictations on a matter. A recording is made only when you start it, after you confirm that everyone present has been told. The audio is stored with the matter's documents and transcribed by Google Cloud Speech-to-Text; when you summarise a note with a signal, its transcript is sent to Anthropic's Claude to draft the minutes (with no signal the summary is made on the phone) | Contract (your personal workspace) or the tenant's instructions (an organisation's workspace) |
| The server's record of what you do in the app: sign-ins, syncs, and the audit log of actions on matters | Keeping the service working and secure, and the record a firm must keep | Legitimate interest |
| Crash reports: the error, the screen and the device model | Keeping the app working | Legitimate interest |
| The app's device identifier and push token | Your list of signed-in devices, and delivering the reminders and office notices you switch on | Consent (notifications); contract (devices) |
We do not collect your location: the app has no location permission. The app collects no analytics and no advertising identifier. The microphone is used only while you record or dictate a note; on an iPhone, a recording you started keeps recording if the screen locks, until you stop it. We do not monitor keystrokes, idle time or working patterns. Client-account (trust) figures never appear in notifications or messages, and a notification names the firm and the event, never the content of a matter.
AI processing
DeLaw's cloud AI is Claude, from Anthropic in the United States. It is reached through DeLaw's own servers; the model key never reaches the phone. Under its commercial terms Anthropic does not train its models on what DeLaw sends it.
- Ask DeLaw, when your workspace has AI switched on, sends your question as you typed it and an outline of your workspace: counts, totals, dates and court rules, with matters named only by a reference, not by their titles, together with curated practice playbooks. No document or note is sent.
- Research, drafting and review, when AI is switched on, send the text you ask about. A client's documents are sent only with a consent recorded for that purpose.
- Minutes send the transcript of the note being summarised (see the table above).
Every AI-produced statement of law is linked to the authority it relies on or is labelled as an unsourced draft. Your organisation is responsible for any client consent its professional rules require before it uses these features on a client's material.
Where data is kept
The app's server and its PostgreSQL database run on Google Cloud in the africa-south1 region (Johannesburg, South Africa), with documents and recordings in Cloud Storage in the same region, encrypted in transit and at rest. The database is backed up daily in the same region; backups are kept for 7 days, with 7 days of point-in-time recovery.
The app also keeps your records on the phone so they can be read without a signal, in an encrypted database. A recording stays on the phone until it is uploaded, and is removed from the phone 7 days after upload. Signing out, leaving an organisation, being walled from a matter, or having the phone signed out from another device removes that workspace's records, documents and recordings from the phone.
Data leaves africa-south1 only through the processors below.
Processors we use
- Google Cloud and Firebase: the servers, database and storage (africa-south1); Cloud Speech-to-Text for recordings (europe-west4, the Netherlands); Cloud Vision for the text of scans (a Google global service); Firebase Cloud Messaging for notifications, which hands iPhone notifications to Apple's push service; Firebase Crashlytics for crash reports, kept 90 days.
- Anthropic (USA): DeLaw AI, as described above.
- Email: sign-in codes and notices are sent by email over SMTP.
- Text messages: Termii (Nigeria) or Twilio (USA), when a sign-in code is sent by SMS.
We share personal data with your organisation, if you have linked your account to it with a join code, for the matters you work on under that tenant. Unlinking stops this and removes the tenant's matters from your phone. We share it with nobody else unless the law requires it. We do not sell personal data and we do not use it for advertising.
Transfers outside Nigeria
The app's data is stored outside Nigeria, in South Africa. It also reaches the Netherlands through Google Cloud Speech-to-Text and the United States through Anthropic, Twilio and Google's global services. We make these transfers under the NDPA's conditions for cross-border transfer (Part VIII) and the GAID, with contractual safeguards in each processor's terms. An organisation should assess residency against its own obligations before it records its clients' matters in the app.
How long we keep it
Account data is kept while your account exists and for 90 days after you delete it. Professional records (matters, documents, ledgers) are kept for the retention period the controller sets, within the minimums that professional conduct rules require, because a lawyer must be able to account for a file. When a person asks for erasure, we anonymise the person and keep the professional record.
Your rights
You may ask for access to your personal data and a copy of it, have it corrected or deleted, restrict or object to its processing, receive it in a portable form, and withdraw a consent at any time without affecting what was done before. In the app, use Profile → My data to export or erase your own data. Otherwise email support@korevra.com with "Data protection request" in the subject. We may ask you to confirm the request is yours, and we answer within 30 days. If our answer does not satisfy you, you may complain to the Nigeria Data Protection Commission.
To delete your account and data, see https://app.delaw.korevra.com/delete-data.
Security
Data is encrypted in transit and at rest. Access inside the platform is enforced by the database itself: a user who is not on a matter, or who is walled from it, cannot read it, search it or receive AI output about it. Every access to client-account data, every export and every permission change is written to an audit log that cannot be edited.
Contact
Korevra Technologies Limited, Lagos, Nigeria. support@korevra.com.