Privacy Policy
LexFlow · Last updated 23 October 2026
This app holds a lawyer's diary: which cases you are running, for whom, when they are listed and when an order lapses. That is not ordinary customer data, and this policy is written on the basis that a leak is a professional-conduct problem for you, not merely an inconvenience for us. It says plainly what is collected, where it goes, who can see it, and how to get rid of it.
1. Who we are
LexFlow is operated by LexAiTech of 37/A, Sahara Centre, Level-10, VIP Road, Kakrail, Dhaka, Bangladesh. For anything in this policy, write to info@lexflowbd.com.
2. What the app is for
The Supreme Court of Bangladesh publishes its daily cause lists on its own website. We read those published lists every evening, compare them against the case numbers you have saved, and tell you when one of your cases appears. You can also keep your own diary of Judge Court and tribunal hearings, which nothing scrapes — those dates exist only because you typed them.
3. What we collect
What you give us
| Account | Email address, and password (stored only as a one-way hash we cannot read). If you sign in with Google, your Google account email. |
|---|---|
| Profile | Name, phone number, enrolment number, bar association, bar membership number, level of practice, place of practice, and a profile photograph if you upload one. |
| Your cases | Case type, number, year, court, division, which side you represent, filing date, and any party names, client name and client contact details you choose to enter. |
| Your diary | Hearing dates and their purpose, your notes on a case, tasks and their due dates, and orders such as bail, stay or status quo with their expiry dates. |
| Documents | Any judgment PDF you upload. And, for the papers you file on a case, client or matter: each one’s title, type, the date on the paper, what it belongs to, whether you marked it private, and — for a link — its address, or — for a paper file — where you keep it. If your chamber connects its Google Drive (section 8), the files themselves are kept in that Drive, not with us; we keep which Google account it is, a key that lets LexFlow reach only the files it created or that you chose (stored encrypted), and the identifiers of the LexFlow folders and files. |
| Case-law searches | When you search the LexFind case database: the words you type, the filters you chose, how many judgments came back and how long it took. We keep the words because the search is still being improved and real questions are the only way to improve it — a search that returned the wrong cases cannot be fixed from a count of it. We do not record which judgment you then open or read. Nothing about your own cases, clients or notes is attached, and the case database is public law reports only. |
| AI brief count | How many AI briefs you open each day, so your package’s daily allowance and the free 30-day trial can be applied. The app and website share this count and the first-use date. To avoid counting the same brief twice across devices, the server also keeps a protected, account-specific fingerprint for that day; it contains no judgment title or text. Previous-day fingerprints are removed during subsequent service use. We keep request-rate counters to slow automated collection, without recording the judgments read. |
| Clients | If you keep client records: each client’s name, whether a person or an organisation, a phone number, the person you deal with there, and who referred them to you (never shown to the client); which of your cases, matters and client pages belong to them; and, when you group or merge clients, a record of what each case said before, so that it can be undone. Your associates can see and add your clients; only you can group, merge or archive them. |
| Client pages | If you make a client page: its name, the cases you put on it, whether steps are shown for each, a note you write for that client, and when the page was last opened and how many times. Your chamber’s name, phone and address, which appear at the top of every client page. We do not record who opened a page or from where — only that it was opened. |
| Fees on a case | If you record them in the app or on the website: the fee agreed with a client, payments received on a case, the fee taken on a hearing date, and what a case cost to run. Private to you and any Accounts Manager you name; no LexFlow screen shows them. These are protected by access rules in the database, not encrypted with your own key (see the next row). |
| Your chamber’s accounts | If you use Accounts on the website: everything in it — cash, bank and wallet balances, every entry, the people the chamber pays and what each is paid, advances to staff, rent, drawings, client money and notes — is encrypted on your own computer, with a key only you and the Accounts Managers you name hold, before it is sent to us. We store scrambled text we cannot read. What we can see: that your chamber uses Accounts, which logins hold a key, how many entries are stored and when and by whom each was saved, and the receipt and voucher numbers issued (not what is on them). |
| Personal notes | If you write notes in Notes (in the app’s Tools, or on the website): each note’s title and text, whether it is pinned, its colour label, and when it was last changed. Only you can read them — not the account holder or anyone else in your chamber, and no LexFlow screen shows them. They are protected by access rules in the database, not encrypted with your own key. A note you delete is kept for 30 days so you can restore it, then removed. Notes not yet sent are kept on your phone until they are. |
| Website messages | If you write to us through the Support page on our website without being signed in: your name, email address, an optional phone number, your message, and which page you sent it from. We use them only to reply to you. If you are signed in, the message is filed with your account’s support conversation instead, like feedback sent from the app. |
| Link clicks | If you open lexflowbd.com/app (the link in our SMS) or lexflowbd.com/pay (the link to the payment page): the name of the message it came in, whether the phone is Android, iPhone or something else, the time, and a random number your browser keeps so that tapping twice counts as one phone. No IP address, phone number, name or account is recorded, and it cannot be connected to you. We use it only to count how many people opened the link. |
| Feedback | If you send feedback from inside the app: what you wrote, and a way to reach you back if you choose to give one. Sent with it are the app version, your device platform and its operating system version, and which screen you were on — shown to you on the form before you send, because a report saying “notifications are not working” cannot be answered without them. No case, note or client detail is attached. |
What the court publishes
Cause list entries — court, bench, serial number, section, case number, party names, advocate names and posted results — are published by the Supreme Court and are public information. We store them and record which of them match your saved cases. We did not obtain them from you and they are not confidential.
What the app records by itself
- When you last signed in, and when the app last requested data.
- How many cause-list rows your account has read each day. This exists to detect one account bulk-copying the entire scraped list, which is a commercial attack on the service rather than ordinary use.
- A device token, if you allow push notifications, so a message can reach your phone.
- A private calendar-feed token, if you turn on calendar syncing.
- Alerts we have sent you, and whether you have read them.
4. What we do not collect
- No location. The app never asks for it.
- No contacts, photos or files beyond a profile picture and judgment PDFs you deliberately upload.
- No advertising identifiers. There is no advertising in this app and none is planned.
- We do not sell your data, and we do not share it for anyone else's marketing. There is no arrangement under which we could.
- We no longer offer tracking of an advocate's name across the cause lists. That feature was removed and the data it used was deleted.
5. Who can see your data
Other users cannot
Every table is protected by row-level security inside the database itself, not merely by the app. Each request is filtered to the account that made it. A modified app, a copied access token or a hand-written request is filtered the same way.
What our office can see
Administration is restricted to a small list of accounts held on the server. Being signed in is not enough, and the list is checked on every privileged request.
An administrator can see, for support purposes:
- Your email, profile details, and account code.
- Counts and dates — how many cases and hearing dates you hold, when you last signed in, whether alerts were sent, your subscription state.
- The list of your saved cases by number.
- How many client pages you have — a number only. Never their names, their cases or their links.
An administrator cannot browse the app as you. There is no "view as user" function and we will not build one.
Your chamber’s accounts are locked with your own key. Everything you record in Accounts is encrypted on your computer before it is sent to us. We store only scrambled text that cannot be read without your Accounts passphrase or your printed recovery sheet — and we never have either. So no one at LexFlow can see your accounts: not our support staff, not our administrators, not the owner of LexFlow, and not anyone who obtains a copy of our database. It also means we cannot recover them for you: if you lose both your Accounts passphrase and your recovery sheet, they are permanently unreadable. The encryption runs in our website’s own code, so it protects your accounts from our database, our staff and our backups — it cannot protect them from a virus on your own computer.
Printing your court list for you. If you telephone our office and ask, we can look up your account code and print your court list for that day — your Supreme Court listings, and your own diary hearings if you ask for those too. We keep a record of every occasion we do it: who looked, whose list, which date, and the reason given. That sheet is drawn only from the court's published list and your cases' own numbers. It never includes your case notes, your clients, your fees or your documents.
6. Companies that process data for us
We keep this list short deliberately, and it is complete as at the date above.
| Supabase | Database, sign-in and file storage. Your data is held on their infrastructure in South Asia (Mumbai). |
|---|---|
| LexFind | Our own case-law database, which runs as a separate service. It receives the words you search and the fact that a signed-in LexFlow account sent them — it is never told which account. It holds no case, client or diary data of yours. |
| GitHub | Runs the scheduled scraper, and stores the nightly backup as a private file. |
| Resend | Sends notification and alert emails. |
| Firebase Cloud Messaging delivers push notifications to your device. Google sign-in, only if you choose it. Google Drive, only if your chamber connects one: your documents are stored in your own Google account, under Google’s terms with you. |
We do not transfer your data to anyone else, and none of the above is permitted to use it for their own purposes.
7. Notifications
We send you an alert when one of your cases appears on tomorrow's list, a reminder the day before a diary hearing, and warnings before an order lapses. You control push and email separately in the app's settings, and turning them off stops them.
Alerts are a convenience and not a guarantee. The court can publish late, revise a list after publication, or change its website; delivery depends on your network and your device. Always check the court's own board. Nothing in this app displaces your own professional responsibility for a hearing date.
8. Calendar syncing, client pages and Google Drive
If you turn on calendar syncing, we give you a private web address that your calendar app reads. Anyone who has that address can read your hearing dates, so treat it like a password. You can regenerate it at any time in the app, which immediately stops the old one working.
Client pages
If you make a client page, we give you a private link to send to that client. The page shows only the cases you put on it: their dates, where to be, what the court recorded and — only where you switch it on — the steps you wrote up. It never shows your notes, fees, tasks, other cases or anyone’s phone number but your chamber’s. Anyone who has the link can see that page, so send it only to the client. You, or an associate you allow to share it, can send it; only you can change what it shows. Resetting the link stops the old one working at once, and turning the page off stops it entirely.
The link is never stored in our database. It is signed with a key held separately, so a copy of the database alone would not open any client page. Client pages are not listed in search engines.
Client page alerts. A client can press “Alert me” on their page and allow their browser to show alerts. We then keep the address their browser’s alert service gives us (Google, Apple, Mozilla or Microsoft, depending on the browser), the two keys that come with it, which page it is for, and when it was last sent an alert — for at most five phones a page. We do not record the client’s name, phone number or IP address. An alert shows the case number, court and date, never party names or the court’s result; that is on the page. The phone itself remembers the page’s link so that tapping an alert opens it. Turning alerts off on the page, resetting the link, or turning the page off deletes these details. They are not included in backups. The advocate, and their staff who can see the page, are shown only how many phones have alerts on for it — never which phones, and never these details.
Google Drive
If the account holder connects the chamber’s Google Drive, papers uploaded through LexFlow are saved into a folder called LexFlow in that Drive. LexFlow asks Google for the narrowest permission it offers: access only to the files LexFlow creates or that you choose — never the rest of your Drive. The key that permission gives us is stored encrypted, and is never sent to any phone or browser.
When you or your associates open a document through LexFlow, it passes through our server on its way to you and is not stored there. On the phone it is kept in the app’s own temporary folder only until you leave the documents screen or sign out. A document marked private is shown only to the account holder, in the app and on the website. Marking it private does not change who can see it inside Google Drive itself.
You can disconnect at any time from Settings → Google Drive, or by removing LexFlow in your Google account. Either way, the files stay in your Drive. LexFlow moves a file to Drive’s Bin only when the account holder asks, and only for a file LexFlow itself uploaded; it never deletes a file permanently.
9. Payments
There are no paid subscriptions yet and the app collects no payment information of any kind. Every feature described here is free at present.
When paid plans are introduced they will be taken by mobile money, and we will then record the plan, the amount, which wallet you used, the sending number and the transaction ID, so that a payment can be matched against the statement and credited. We will never see or store your PIN, and no card details will be held anywhere in this system. This policy and its date will be updated before any of that begins.
Your saved cases are never withheld or deleted because a subscription has lapsed. A lawyer's diary is not something to hold hostage over a payment.
10. How long we keep things
- Your account and its contents: until you delete them.
- Your chamber’s accounts: until you delete your account. Entries are never edited or removed, even by you — a mistake is corrected by a new entry, so the books keep their own history. Backups of them hold only the encrypted text.
- Nightly backups: kept for 90 days, then discarded automatically. A backup taken before you deleted something may therefore contain it for up to 90 days afterwards.
- Cause list entries: these are public court records and we keep them as a historical archive.
- Records of administrator access (section 5): kept for 24 months, because the point of the record is that it outlives the occasion.
11. Deleting your account
You can do this yourself, from inside the app, and it takes effect immediately: Profile → Account and data → Delete my account. You will be asked to confirm your password and to type your email address, because this cannot be undone and we would rather it took a moment longer than happen by accident.
Deleting the account removes your profile, your cases, your hearing dates, notes, tasks, orders, matters and alert history, your chamber’s accounts, any feedback you sent us, the notification tokens for your devices, your calendar feed link, and any files you uploaded — your profile photograph and any judgment PDF. Nothing of yours is kept back. If your chamber connected a Google Drive, the list of your documents and the connection are deleted and we ask Google to withdraw LexFlow’s access; the files in your Google Drive are yours and are left there.
If you have already uninstalled the app, write to info@lexflowbd.com from the address your account uses and we will do it for you, within 30 days and in practice much sooner. See delete your account for the full detail.
Backups already taken will still contain your data until they expire, at most 90 days later (section 10).
12. Your other choices
- Correct anything in your profile and your cases from inside the app, at any time.
- Ask for a copy of what we hold about you by writing to the address above.
- Turn off alerts in settings, or revoke notification permission in your phone's own settings.
13. Security
Sign-in is handled by our database provider and passwords are stored only as one-way hashes. Access between accounts is prevented in the database rather than in the app. Uploaded files are private and are read through short-lived links rather than public addresses. Google sign-in is bound to the app's signing certificate, so a repackaged copy of the app cannot use it.
What we have not built yet, so that you can decide accordingly: the app has no PIN or fingerprint lock of its own, so anyone holding your unlocked phone can read your case list. Lock your phone.
If a breach ever affects your data, we will tell you plainly and directly. A quiet fix is not an acceptable substitute for telling the advocates whose client confidences are involved.
14. Children
This is a professional tool for practising advocates. It is not directed at children and we do not knowingly hold any child's data.
15. Changes
When this policy changes we will update the date at the top, and we will tell you in the app before any change that materially affects what we collect or who can see it.
16. Contact
LexAiTech
37/A, Sahara Centre, Level-10, VIP Road, Kakrail, Dhaka
Bangladesh
info@lexflowbd.com
This policy is governed by the laws of Bangladesh.