On this page
LawBook is practice management software for lawyers, built by Upview Technologies (“Upview”, “we”, “us”). This policy explains what personal information we collect through the LawBook web app and mobile app, how we use and protect it, and the choices you have.
At a glance
We never sell personal data
No sale of personal information and no use of it for advertising.
Sections 6 and 8No training on client content
Your documents, notes and chatbot questions are not used to train AI models.
Section 7Access only when you grant it
Upview staff can’t open your matters. Support access is time-limited and yours to end.
Section 7Your data, your export
Export your practice data at any time. Permanent deletion needs your confirmation.
Section 10Who we are and what this policy covers
We act in two different roles, and the rules differ for each:
- Account and service data (we are the controller). Your sign-in details, practice profile, subscription, device and usage data, and support requests.
- Practice data (we are the processor). Everything you store about your clients and matters: contacts, matters, notes, documents, time entries, invoices and client account (trust) records. You, the practitioner or firm, are the controller of this data and remain responsible for your clients’ confidentiality and your professional duties. We process it only to provide LawBook to you and on your instructions.
This policy applies to the LawBook web app, the LawBook mobile app, and related support channels. It does not cover third-party services you might connect, such as Google or Microsoft, which have their own policies.
Information we collect
We collect the following, grouped by who the data is about and where it comes from.
2.1 About you (the account holder)
| Category | What it includes | Source |
|---|---|---|
| Account details | Name, email, password (stored hashed), account type (solo or firm), firm name | You |
| Professional profile | Title, registration number, signature block, default rate, working hours, photo | You |
| Practice profile | Practice areas, jurisdiction, how you charge and record time, whether you hold client money | You (onboarding and settings) |
| Subscription | Plan, billing contact, payment method token and Upview invoices (card details are held by our payment processor, not us) | You and our payment processor |
| Usage and device data | Pages and features used, app version, device type, operating system, IP address, crash and performance logs | Automatically |
| Support data | Chatbot questions, support tickets, attachments, device and app version | You and your device |
2.2 Practice data you store in LawBook
| Category | What it includes |
|---|---|
| Contacts | Names, organisations, emails, phones, addresses, tags, notes, and identity or KYC details where your jurisdiction requires them, including people who are not LawBook users such as clients, opposing parties, witnesses and courts |
| Matters | Matter number, title, practice area, parties and their roles, key dates and limitation dates, fee arrangement |
| Notes, tasks and events | Note text, images, task lists, calendar events, locations and attendees |
| Documents | Uploaded and scanned files, activity history |
| Time and billing | Time entries, expenses, narratives, invoices, payments, credit notes |
| Records of your actions | Activity timelines, audit entries, deletions and legal holds |
Practice data can include sensitive and privileged information about your clients. We do not review it except as described in section 7.
The LawBook mobile app
The mobile app captures and reads practice data. You can withdraw any permission through the application and in your device settings.
- Camera and photos. Used to scan documents and attach images to notes. Captured images are stored inside the note itself.
- Offline storage. Notes you capture are saved on your device first and synced when a connection returns. The app also caches the next 30 days of calendar entries and documents for matters you mark for offline use. Unsynced notes stay on the device until they sync.
- Push notifications. Used for reminders, deadlines and support replies. You can switch notification types on or off per event in Settings.
If you lose a device, sign out of it from Desktop Settings > Security to end its session. Offline data on the device is protected by the app lock and device encryption.
Connected services and sign-in
You choose which outside services to connect. Each can be disconnected at any time from Settings > Integrations.
- Calendar sync. If you connect a Google or Outlook calendar, we read the calendars you select and show their events in LawBook. You choose read-only or two-way sync. Events from an external calendar stay owned by that calendar; LawBook only adds its own matter link.
- iCal feed. If you turn on your iCal feed, anyone with the feed link can read the events in it. Treat the link like a password and regenerate it if it is shared by mistake.
We request only the permissions each feature needs. Disconnecting a service stops further access; entries already created in LawBook, such as an accepted time entry, remain unless you delete them.
Help chatbot and support tickets
Chatbot. The chatbot does not read the matters, notes, contacts, documents or events on your screen. Please do not type client confidential information into it. Conversations are kept to improve help content.
Support tickets. When you raise a ticket we receive your subject, description and any screenshot you attach. Tickets belong to you, not to a matter, and we never attach matter content automatically. A screenshot can show client information, so the app warns you before you attach one. Support staff see only what is in the ticket unless you grant access (section 7).
We keep ticket threads for as long as needed to resolve the issue and handle follow-up, then delete or anonymise them under section 10.
How we use information
We use account and service data to run LawBook and keep it safe. We use practice data only to provide the service to you.
| Purpose | Data used |
|---|---|
| Provide LawBook: sign-in, matters, documents, calendar, time, billing, sync, search | Account data and practice data |
| Personalise setup, such as default templates, court rules, currency, tax and trust terminology | Practice profile |
| Provide help and support | Support data |
| Billing for your subscription | Subscription data |
| Improve LawBook: fix bugs, measure performance, understand which features are used | Usage and device data only, never the content of practice data |
| Send service messages, such as security alerts, invoices and policy changes | Account data |
| Send product news or offers | Account data |
| Meet legal obligations and respond to lawful requests | As required |
We do not sell personal information, we do not use it for advertising, and we do not use practice data to build profiles of you or your clients.
Confidentiality of client data
Lawyers owe their clients confidentiality, and LawBook is built so that your practice data stays yours.
- No access by default. Upview staff cannot open your matters, documents, notes or ledgers. Access to production systems is limited to named engineers and support staff who need it, and is logged.
- Support access is granted by you. If we need to look at your account to fix a problem, you grant time-limited access under Settings > Security. You can see current and past grants and end one at any time.
- No training on client content. We do not use your practice data, including documents, notes, and chatbot questions, to train AI models, ours or anyone else’s.
- No advertising. Practice data is never shared for advertising or marketing.
- Your professional duties. Using LawBook does not change your obligations to your clients or regulator. You remain responsible for deciding what to store, who in your practice can see it, and when a client must be told about a data incident.
If a court order, regulator or other legal process requires us to disclose practice data, we will send it to you first so you can respond, unless the law prohibits it, and we will disclose only what is legally required.
How we protect your data
We use layered safeguards suited to confidential legal and financial records.
- Strong sign-in. Authenticator-app MFA, with SMS only for someone who has no other factor. Passwords are checked against known breached passwords and stored hashed. New sign-ins resolve MFA before any firm or matter is shown.
- Confirmation for sensitive actions. Permanent deletion and full data export require you to confirm your account.
- Access control. Every list and search is filtered by what the signed-in person may see. Invited users get a role limited to what they need, for example a bookkeeper sees only time, billing and the client account.
- Sessions and devices. You can see and end active sessions and devices, and review login history in Settings > Security. Idle sessions expire.
- Monitoring and testing. We log administrative access, monitor for abuse and test our security regularly.
No online service is completely secure. Please use a unique password or a passkey, keep recovery codes somewhere safe, and sign out of shared devices. If we learn of a breach affecting your data, we will tell you without undue delay and as the law requires so you can meet your own notification duties.
Retention, deletion and export
You control how long practice data stays in LawBook. We keep account data while your account is open and afterwards only as set out below.
| Data | How long we keep it |
|---|---|
| Deleted matters | Permanent deletion needs confirmation |
| Matter records after closing | You have the capability to decide whether to keep or delete the data connected to the matter |
| Invoices and reconciliation reports | Kept as long as you decide to delete them |
| Unsynced notes on your device | Never purged until they sync |
| Account and security logs | 12 months |
| Support tickets | 12 months after the ticket closes, then deleted or anonymised |
Export. You can export all your practice data at any time.
Closing your account. When you cancel, we ask you to export all data. All the data will be retained for 30 days until the permanent deletion. During this period, you are able to restore your account. Deleted data cannot be recovered after the 30 day period.
Please note that deleting a contact or document does not remove copies you already sent to others, such as an emailed invoice.
International data transfers
Upview is based in Sri Lanka, and your data is hosted in Central India. We and our service providers may process data in other countries whose data protection laws differ from yours. Where we transfer personal data across borders, we do so using safeguards the applicable law recognises, such as contractual clauses or an adequacy decision.
Your rights and choices
Depending on where you live, including under Sri Lanka’s Personal Data Protection Act, No. 9 of 2022 and, where they apply, the GDPR, UK GDPR, PIPEDA or US state privacy laws, you may have these rights over the personal data we hold about you:
- Access and portability. Get a copy of your data. You can export your practice data yourself.
- Correction. Update your profile, practice and security details in Settings at any time.
- Deletion. Delete items in LawBook, or ask us to delete your account (section 10).
- Restriction and objection. Ask us to limit, or object to, processing based on our legitimate interests.
- Withdraw consent. Disconnect calendar and email, turn off notifications and marketing, or revoke app permissions in your device settings. Withdrawing consent does not affect earlier processing.
- No solely automated decisions. LawBook will not automatically make decisions on your behalf and will ask you to review if any suggestions are made.
If you are a client or contact of a LawBook user. Your lawyer, not Upview, decides why your information is held and is responsible for it. If you write to us about your information, we will pass your request to the lawyer or firm concerned and help them respond.
How to ask. Email support@thelawbook.online from the address on your account. We may need to confirm it is you, and we aim to reply within 24 hours. If you are unhappy with our answer, you may complain to the Data Protection Authority of Sri Lanka or the regulator in your country.
Firms, invited users and client-facing features
Firm accounts and invited users. If you join a firm’s LawBook account, the firm is the controller of the practice data in it. Firm administrators can see your name, email, role, MFA status, last active time and actions recorded in the audit log, and can deactivate you and reassign your matters and tasks. Your personal sign-in details and security settings remain yours. If you belong to more than one firm, each firm sees only its own account.
Bookkeeper and assistant access. When you invite a bookkeeper or assistant, they see only what their role allows. You can change or remove their access at any time.
We will update this policy before any additional features launch and if they change what we collect.