Law OS

Privacy Policy

Last updated: October 2, 2026

This Privacy Policy explains what information Law OS (the "Service"), operated by Cochin Enterprise Solutions ("we," "us," or "our"), collects, how we use it, and how it is kept isolated between law firms. It applies to every user of the Service.

1. Information we collect

We collect:

  • Account information: your name, email address, and firm name, provided when you sign up or are invited to a firm.
  • Firm data: the cases, clients, hearings, documents, tasks, time entries, and finance records your firm enters into the Service — this is the core content you're trusting us to store, and we treat it as confidential.
  • Payment information: handled directly by Razorpay, our payment processor — we do not receive or store your card or bank details ourselves, only confirmation that a payment succeeded.
  • Usage and log data: basic technical information (such as sign-in activity) needed to operate and secure the Service.

2. How we use information

We use the information above to provide the Service to you and your firm, process payments, respond to support requests, and secure accounts (for example, detecting repeated failed logins). We do not sell your information, and we do not use your firm's case or client data to train any AI model.

3. AI features and third-party processing

When you use the AI Assistant, or run OCR on a scanned document, the relevant case, document, or question text is sent to the respective provider below solely to generate that response — never anything beyond what's needed to answer the specific request:

  • Anthropic (the AI Assistant) — processes the firm data relevant to your question (matched cases, documents, hearings, and prior AI research on the same case) to generate its answer.
  • Amazon Web Services (Textract) — processes a document's image/PDF content when you click "Run OCR," to extract its text.

These providers may process this data on servers outside India as part of providing their service to us. Neither is authorized to use your firm's data for any purpose other than fulfilling that specific request.

4. Document storage

Uploaded documents (case files, judgment PDFs, income bills) are stored on Amazon S3, in the Mumbai (ap-south-1) region. Access to a stored file always requires a signed-in session scoped to your firm — files are never reachable via a public or guessable URL.

5. How your firm's data is isolated from every other firm

Every piece of firm data is tagged with your organisation's id and scoped to it at both the application layer and the database layer (Postgres row-level security) — a member of one firm cannot see, search, or trigger AI responses that include another firm's data, even by guessing an id. See our Security page, and SECURITY.md in our public repository, for the full technical model.

6. Data retention and deletion

We retain your firm's data for as long as your account is active. If your firm's admin deletes the organisation within the Service, its data is disconnected from all members immediately and retained only so it can be restored if that was done in error; it is not otherwise shared or processed. To request permanent deletion of your firm's data, or to request a copy of it, email us at lawoperatingsystem@gmail.com with the subject line "Privacy request."

7. Who we share information with

We share information only with the service providers needed to run the Service — Amazon Web Services (hosting, file storage, OCR), Anthropic (AI features), Razorpay (payments), and Resend (sending account-related emails) — each bound to process it only on our instructions. We do not sell your information or share it with advertisers. We may disclose information if required to by law, or to protect the rights, safety, or property of our users or the public.

8. Security

We use industry-standard measures to protect your data, including encrypted connections, hashed passwords, and the organisation-level isolation described above. No system is perfectly secure, and we have not yet completed a full independent third-party security audit — see our Security page for the current state of our security practices.

9. Your rights

You may request access to, correction of, or deletion of your personal information, or ask questions about how it's processed, by emailing lawoperatingsystem@gmail.com. Because firm data is managed collectively by a firm's members and admin, a request concerning case or client data already entered into a firm should generally come from that firm's admin.

10. Children's privacy

The Service is intended for use by legal professionals and is not directed at, or intended for use by, children. We do not knowingly collect information from anyone under 18.

11. Changes to this policy

We may update this Privacy Policy from time to time. If we make material changes, we will update the "Last updated" date above and, where appropriate, notify you through the Service or by email.

12. Contact

Questions about this Privacy Policy can be sent to lawoperatingsystem@gmail.com.