Korevra Limited ("Korevra") provides DeLaw, a legal practice platform. This policy explains what personal data we process for delaw.io and the DeLaw application, under the Nigeria Data Protection Act 2023 (NDPA) and the Nigeria Data Protection Regulation. For the account, billing and website data below, Korevra is the data controller. For the data your firm puts into its workspace — clients, matters, documents, correspondence — your firm is the controller and Korevra is its processor under the data processing summary.
| Data | Purpose | Basis | Kept |
|---|---|---|---|
| Name, work email, password hash | Sign-in, invitations, security notices | Contract | Life of the account, then 90 days |
| Firm or organisation name, members and roles | Operating your workspace | Contract | Life of the workspace |
| Plan, trial and subscription state; invoices; payment references | Billing, receipts, tax records | Contract; legal obligation | Seven years for financial records |
| Activity counts (which screens were used, how often, per month) | Capacity, support, product decisions | Legitimate interest | 24 months |
| Audit trail of account and billing actions | Security and dispute resolution | Legitimate interest | 24 months |
| Campaign attribution (which page or advert brought you) | Measuring marketing | Consent (website analytics); legitimate interest (sign-up source) | 24 months |
| Support correspondence | Answering you | Contract | 24 months |
Matters, parties, clients, documents, time, fee notes, the trust ledger, messages and research notes belong to your firm's workspace. They are stored in a tenant-isolated database and object store on Google Cloud, encrypted in transit and at rest, and are accessible only to accounts your firm's administrators admit. Korevra staff do not read workspace data in the course of support without your firm's written instruction. When a workspace is closed, its data is deleted within 90 days unless your firm asks for an export first.
You may ask for access to, correction or deletion of your personal data, object to or restrict processing, and receive a copy in a portable form. Write to support@korevra.com; we answer within 30 days. You may complain to the Nigeria Data Protection Commission. Requests about data inside a firm's workspace are passed to that firm, which is the controller for it, and DeLaw gives firms a DSAR register to answer them.
Transport is encrypted, database access is enforced by server-side rules and signed identity claims, payment webhooks are verified by signature, privileged actions are written to a hash-chained audit log, and access to production is limited to named Korevra staff. See Security.
The app uses only the storage it needs to keep you signed in and to hold your workspace on your device for offline use. delaw.io sets analytics cookies only after you choose Allow in the consent bar; Decline keeps the site fully usable.
We will post changes here with a new effective date and notify workspace owners of material changes by email.