Privacy Policy

Effective date: 1 January 2027
Version: 2.0

1. Introduction

1.1 This Privacy Policy explains how Advora Legal ("Advora", "we", "us", or "our") collects, uses, shares, and protects personal information when you use the Advora mobile application, the website at www.advoralegal.com, the lawyer web portal, and law firm workspaces at their own advoralegal.com addresses (together, the "Platform").

1.2 What Advora is. Advora helps people ("Clients") find and consult independent lawyers ("Lawyers"), and gives Lawyers and law firms tools to manage their cases. Advora is a technology platform, not a law firm. We do not provide legal advice or representation, and we do not employ the Lawyers you find through the Platform — they are independent professionals responsible for their own services.

1.3 We have written this policy in plain, friendly language so it is easy to follow. Some terms still need to be precise for legal reasons, and where that is the case we have tried to explain them clearly.

1.4 This Privacy Policy works together with our Terms & Conditions (see Section 16). By using the Platform, you confirm that you have read and understood this Privacy Policy.

2. Who This Policy Applies To

2.1 This policy applies to everyone who uses the Platform, including:

• Clients who search for, message, book, and attend consultations with Lawyers, and clients a Lawyer or law firm invites to a case;
• Lawyers who create a profile, offer their services, and manage consultations and cases through the Platform; and
• owners, admins, lawyers, and staff of a law firm that uses a firm workspace.

2.2 Because Advora operates worldwide, the laws that protect your information may differ depending on where you live. Where local law gives you specific rights or requires specific handling of your information, we aim to honour those requirements (see Sections 9, 11, and 12).

2.3 A note on Lawyers, firms and your case information. A Lawyer or law firm decides what to record about a case, and who to share it with, as part of their own practice. In data-protection terms, the Lawyer or firm generally acts as the controller of those case records, and Advora stores them on their behalf. We explain this further in Sections 5 and 12.

3. Information We Collect

We collect the information described below. We have grouped it by type so you can see exactly what we handle and why.

3.1 Account and identity information

When you sign up and use your account, we collect:

• your name;
• your email address and, if you provide one, your phone number;
• your password in hashed form, if you sign in with email and a password;
• the sign-in identifier we receive from Google Sign-In or Apple Sign-In when you choose to sign in with one of those services. Advora never receives or stores your Google or Apple password — those companies confirm your identity to us and share only limited information (such as your name, email, and a unique account identifier);
• your user role — that is, whether you are using the Platform as a Client, a Lawyer, or a member of a law firm; and
• a copy of your government-issued ID and its details, when the Platform asks you to verify your identity (for example, before a paid booking or before uploading documents). Our staff review it to make a verification decision.

3.2 Profile information

To create your profile and make the matching service work, we collect:

• your profile photo (if you choose to add one);
• for Lawyers: professional credentials and certificates that you upload as documents, your practiceAreas, gender, phone number, country, date of birth, and your availability / schedule;
• for Clients: your country and city, and the other profile details you choose to provide.

3.3 Messages, documents and case information

We collect and store the following when you use these features:

• messages and attachments you send in free chats, engagement threads, and case threads;
• the optional "what I'd like to talk about" message a Client may add when booking;
• documents you send for review, and the Lawyer's completed review;
• your conflict-of-interest declaration at booking, including any details you add about the other party;
• case records a Lawyer or law firm keeps on our servers, such as the client's name and contact details, court and hearing dates, notes, tasks, fee entries, and documents, including every version of a document; and
• access logs showing who viewed, changed, downloaded, or shared case records.

A Lawyer may instead choose to keep their case records encrypted on their own device. Those records are not sent to our servers, so we cannot read or recover them.

A case record can include information about a client who does not use Advora. The Lawyer or firm that adds it is responsible for having the right to do so.

3.4 Booking and usage information

As you use the Platform, we collect information about your activity, including:

• appointments and bookings you make;
• reschedules and cancellations;
• ratings and feedback you give or receive;
• your online / availability status (for Lawyers, whether you are currently available); and
• other actions you take that are part of making and managing consultations.

3.5 Technical information

To keep the Platform running, secure, and reliable, we collect:

• device push-notification tokens (so we can send you notifications about your bookings and account);
• device and app information (such as device type, operating system, and app version);
• log data (such as activity records and basic diagnostic information generated when you use the Platform), including IP addresses recorded with sign-ins and identity-related actions; and
• crash reports from the app, which we send to our error-monitoring provider without your name or contact details.

3.6 Payment information

• Clients pay their Lawyer's consultation fee, and Lawyers pay Advora a fee to be listed. Payments are handled by third-party payment processors, and Advora does not store your full card number.
• We keep records of each payment and refund. We also keep the payout details a Lawyer gives us, and any bank details you give us for a manual refund.
• The payment processor collects and processes your payment details under its own terms and privacy policy.

3.7 Consultation attendance and dispute information

To help resolve problems with consultations fairly (for example, a report that one side never joined a call), we collect:

• consultation attendance records from the video-calling service used for consultations (currently Daily.co), including participant display names, join and leave times, and call duration;
• technical details included in those attendance records, which can include device type (for example, web, Android, or iOS), IP address, and approximate location;
• in-app presence signals, such as when you tap "Join" for a consultation or remain on the consultation waiting screen; and
• reports and supporting material you submit through the in-app "report a problem" feature, including the reason you select, any comments you write, and any screenshots you attach.

4. How We Use Your Information

We use the information we collect for the following purposes:

4.1 To operate the matching and discovery service — to help Clients find suitable Lawyers and to help Lawyers present their profiles to Clients.

4.2 To create and manage accounts — to set up your account, verify your identity and, for Lawyers, your credentials, and keep your account secure.

4.3 To enable bookings and scheduling — to let Clients book consultations, and to let Lawyers manage their availability, confirm consultations, and handle reschedules and cancellations.

4.4 To send notifications — to send you messages about your bookings, reminders, changes, and other account or service updates (for example, through push notifications).

4.5 To provide messaging, document review and case tools — to deliver your messages, carry out document reviews, store case records, and show each side the information they are entitled to see.

4.6 For safety and fraud prevention — to protect the Platform and our users, detect and prevent fraud, misuse, and abuse, and keep the service trustworthy.

4.7 To handle complaints, reports and disputes — to review a complaint about a Lawyer or a Client or a report that something went wrong with a consultation, using the information the parties give us and the attendance and dispute information described in Section 3.7, and to decide on any action, such as a warning or suspending an account, in accordance with our Terms & Conditions.

4.8 To provide support — to respond to your questions, troubleshoot problems, and help you use the Platform.

4.9 To comply with the law — to meet our legal and regulatory obligations and to respond to lawful requests (see Section 5.3).

4.10 Where the law requires a specific legal basis or your consent for a particular use — especially for the sensitive case-related information described in Section 3.3 — we will rely on that basis or ask for your consent as needed.

5. How We Share Your Information

We share your information only as described below. We do not sell your personal information.

5.1 With the other party to a booking

The Platform connects two people for a consultation, so some sharing between them is necessary to provide the service:

• a Client's messages, booking message, and documents sent for review are shared with the Lawyer the Client contacts or books;
• a Lawyer's messages, completed reviews, and profile information are shared with the relevant Clients; and
• on a case, the linked client sees the documents, next hearing, and timeline entries the Lawyer or firm chooses to share, and the Lawyer or firm sees what the client uploads.

This sharing is a core part of how the matching service works. Once information is shared with a Lawyer, that Lawyer handles it independently as part of their own professional practice (see Section 2.3).

5.2 With service providers and processors

We work with trusted companies that perform services on our behalf, such as:

• hosting and infrastructure providers that store and run the Platform;
• push-notification providers that deliver notifications to your device;
• the video-calling provider used for consultations (currently Daily.co);
• our email and error-monitoring providers; and
• payment processors that handle payments.

These providers may access personal information only to perform services for us, under contracts that require them to protect your information and use it only for the purposes we specify.

5.3 For legal and safety reasons

We may disclose information when we reasonably believe it is necessary to:

• comply with applicable law, regulation, legal process, or an enforceable governmental or regulatory request;
• enforce our Terms & Conditions and other agreements;
• detect, prevent, or address fraud, security, or technical issues; or
• protect the rights, property, or safety of Advora, our users, or the public.

5.4 Business transfers

If Advora is involved in a merger, acquisition, reorganization, financing, or sale of assets, your information may be transferred as part of that transaction. We will take reasonable steps to ensure your information remains protected and, where required by law, we will notify you.

5.5 We do not sell your personal information

Advora does not sell your personal information. Where applicable law (such as certain US state privacy laws) defines "sell" or "share" broadly, our practices and any choices available to you will be handled in accordance with that law.

5.6 Access by Advora staff

Our staff review credentials and ID documents and handle reports and disputes. They have no default access to case contents. Staff can read a message thread only with the right permission and a recorded reason, such as resolving a report. Law firm access is set by the firm's roles: owners and admins can see every firm case, and lawyers and staff can see the cases assigned to them.

6. Data Retention

6.1 We keep personal information for as long as we need it to provide the Platform, operate our service, and fulfil the purposes described in this policy — and for as long as your account is active.

6.2 After that, we keep information only as long as reasonably necessary to:

• comply with our legal, tax, accounting, or regulatory obligations;
• resolve disputes;
• enforce our agreements; and
• protect against fraud and abuse.

6.3 We keep messages, attachments, conflict declarations, documents sent for review, and ID documents until the account they belong to is deleted, or the law firm they belong to deletes its workspace. We keep payment and tax records for as long as the law requires.

6.4 When information is no longer needed, we take reasonable steps to delete it or to anonymize it so it can no longer be linked to you. Case records are kept by the Lawyer or law firm they belong to and are subject to that Lawyer's or firm's own retention practices and legal obligations. A Lawyer who deletes their account, or a firm that deletes its workspace, deletes those records immediately and permanently.

6.5 After you delete your account. See Section 9.4 for what is removed and what is kept.

6.6 Backups. Deleted data can remain in our backup copies, where case documents and other sensitive fields stay encrypted, until those copies expire. Backup copies expire on their normal cycle.

7. Security

7.1 We take the security of your information seriously and use reasonable technical and organizational measures designed to protect it against unauthorized access, loss, misuse, and alteration. Messages and case records are encrypted when stored on our servers, and access to them is restricted and logged. We use reputable service providers.

7.2 However, no method of transmitting or storing information is 100% secure. While we work hard to protect your information, we cannot guarantee absolute security. You also play an important role: please keep your sign-in method and device secure, and let us know promptly if you believe your account has been compromised.

7.3 Where required by law, we will notify you and the relevant authorities of a data breach affecting your personal information.

8. International and Global Data Transfers

8.1 Advora operates worldwide. This means your information may be stored and processed in countries other than the one where you live, including countries whose data-protection laws may differ from those in your home country.

8.2 When we transfer personal information across borders, we take steps designed to ensure it remains protected and that any transfer complies with applicable law. Depending on the situation, this may include relying on recognized transfer mechanisms (such as standard contractual clauses or adequacy decisions) where they apply.

8.3 By using the Platform, you understand that your information may be transferred internationally as described in this policy.

9. Your Rights and Choices

9.1 Depending on where you live, you may have rights over your personal information. These can include the right to:

• access the personal information we hold about you;
• correct information that is inaccurate or incomplete;
• delete your personal information;
• object to or restrict certain processing;
• withdraw consent where we rely on consent (this does not affect processing already carried out); and
• data portability — to receive certain information in a portable format.

The exact rights available to you depend on your local law (see Section 11).

9.2 Managing your information in the app. You can review and update much of your profile information directly within the Platform.

9.3 Notifications. You can manage push notifications through your device settings.

9.4 Deleting your account. You can delete your account from within the app or by email. Deletion is immediate. There is no restore period, and the data won't be available afterwards. If you are a client, we delete your account, profile, ID copies, uploads, and messages. If you are a Lawyer, we also delete your cases, case documents, portfolio, and credential documents, and linked clients lose access. A message thread is deleted for both sides. A Lawyer's own case record about a client stays with that Lawyer, including anything the client uploaded to it, and the client's access ends. Case records belonging to a law firm stay with the firm when a member leaves. Any upcoming bookings are cancelled, and a client's unused credit is lost. We keep payment and tax records and records of complaints and enforcement action, with your name removed. If a refund or payout is pending, we pay it first and delete your account straight after, and you can't sign in during that time. If we need your bank or payout details to pay you, add them first. If you own a firm workspace, you must delete it or transfer ownership first; the Law Firm Agreement sets out what firm deletion removes. Section 6.6 explains backups.

9.5 How to exercise your rights. To make a request, or if you have questions about your information, contact us at support@advoralegal.com (see Section 17). We may need to verify your identity before acting on a request, and we will respond within the timeframe required by applicable law. You also have the right to lodge a complaint with your local data-protection authority.

10. Children's and Minors' Privacy

10.1 The Platform is intended for use by individuals who are at least eighteen (18) years of age, consistent with our Terms & Conditions.

10.2 The Platform is not directed to children, and we do not knowingly collect personal information from anyone under 18 except where a parent or legal guardian (a) is themselves an eligible adult user, (b) has provided verifiable consent in a manner acceptable to Advora and required by applicable law, and (c) agrees to supervise the minor's use of the Platform. Where such verifiable guardian consent has not been obtained, minors must not use the Platform.

10.3 If you believe that a minor has provided us with personal information without the required guardian consent, please contact us at support@advoralegal.com and we will take appropriate steps to delete that information, as required by applicable law.

11. Regional Privacy Information

11.1 Because Advora operates globally, different privacy laws may apply to you depending on where you are located. These laws can give you additional rights and can require us to handle your information in specific ways.

11.2 Examples include the General Data Protection Regulation (GDPR) in the European Economic Area, the UK GDPR in the United Kingdom, and US state privacy laws such as the California Consumer Privacy Act (CCPA/CPRA), among others.

11.3 Where these laws apply, we will honour the rights and obligations they set out — including, for example, the lawful bases we rely on to process your information, the additional protections for sensitive case-related information, and the specific rights described in Section 9.

11.4 If you need information specific to where you live, contact us at support@advoralegal.com.

12. Case Information and Confidentiality

12.1 Advora provides case tools for Lawyers and law firms, so we may store privileged and confidential case information. We do not use it to build profiles about our users, and we do not sell it.

12.2 Access to case records is limited to the Lawyer who owns the case, the members of a law firm allowed by the firm's roles, and the linked client for what has been shared with them. Advora staff have no default access.

12.3 If, despite this, you do share case-related information, it may be privileged or otherwise sensitive and subject to additional legal protections (such as attorney-client privilege) that vary significantly by country. We aim to handle it accordingly and to rely on the legal basis or explicit consent required by applicable law.

13. Automated Decision-Making

13.1 We do not use your personal information to make decisions about you that produce legal or similarly significant effects based solely on automated processing, without human involvement.

13.2 Advora helps Clients discover and choose Lawyers, but the choice of Lawyer is always made by the Client. Advora does not assign or recommend Lawyers on your behalf.

13.3 Limited automated operational actions. The Platform applies a small number of automated operational rules described in our Terms & Conditions — for example, automatically cancelling and refunding an on-demand consultation when the Lawyer does not join within the stated time. These rules operate in your favour or apply equally to both sides of a booking, and you can always contact us at support@advoralegal.com to have any automated outcome reviewed by a person.

14. Third-Party Links and Services

14.1 The Platform may contain links to, or integrate with, third-party websites, apps, or services that we do not control — for example, Google Sign-In, Apple Sign-In, and payment processors.

14.2 This Privacy Policy does not apply to those third parties. Their handling of your information is governed by their own privacy policies, and we encourage you to read them. We are not responsible for the privacy practices of third parties.

15. Changes to This Privacy Policy

15.1 We may update this Privacy Policy from time to time. When we make material changes, we will take reasonable steps to notify you — for example, by posting the updated policy on the website with a revised "Effective date", and/or by providing notice within the Platform.

15.2 Changes take effect when posted, unless otherwise stated or unless applicable law requires advance notice or your consent. Your continued use of the Platform after changes take effect means you accept the updated policy. If you do not agree, please stop using the Platform.

16. Relationship to the Terms & Conditions

16.1 This Privacy Policy is part of, and should be read together with, our Terms & Conditions (Terms of Service). The Terms describe the rules for using the Platform, including that Advora is not a law firm.

16.2 If there is any conflict between this Privacy Policy and the Terms specifically regarding how we handle personal information, this Privacy Policy governs that subject.

17. How to Contact Us

17.1 If you have questions, concerns, or requests about this Privacy Policy or your personal information, please contact us:

• Operator: Advora Legal, Pakistan
• Email: support@advoralegal.com
• Website: www.advoralegal.com

17.2 This Privacy Policy is governed by the laws of Pakistan, without prejudice to any mandatory data-protection rights you have under the laws of the country where you live.

17.3 You also have the right to contact your local data-protection or privacy authority if you have concerns about how your information is handled.