Privacy Policy

Who we are

MyLawOffice is a workspace for lawyers operated by Alpha Tech Solutions ("we", "us"). This policy explains what personal data we collect through the MyLawOffice website and applications, why we collect it, who we share it with — including the third-party AI provider that powers the AI assistant and the payment provider that processes your subscription — the rights you have over it, and what happens to your data when your account is suspended, cancelled or deleted.

Data we collect

We collect the following categories of data:

1. Account details: first and last name, email address and phone number, provided when you register. Your password is stored only as a secure hash.
2. Billing details: when you subscribe, the name to appear on your invoices, your Greek tax identification number (ΑΦΜ), your tax office (ΔΟΥ) and your postal address, which we need in order to issue invoices.
3. Subscription and payment data: your plan, the amount of each charge (net, VAT and total), the dates, status and billing period of each payment, the order and transaction identifiers assigned by our payment provider, the brand and last four digits of the card used, and the transaction record our payment provider returns to us. We never receive or store your full card number or its security code — those are entered directly on the payment provider's secure page.
4. Workspace content: the clients, cases, documents, notes, deadlines, document templates, calendar entries and AI chat history you store in MyLawOffice. This content is encrypted on your device before it reaches us, and only you hold the key that can read it.
5. Organisational fields: so the apps can sort your records and send you reminders, a small set of structured fields is stored in readable form — the dates and times of deadlines and calendar entries, client details such as date of birth, gender, marital status and identity-document type and validity dates, and technical details such as file sizes.
6. Messages you send us through the contact form or by email.
7. Technical and security data: IP address, browser and device type, a name and identifier for each device you sign in from, sign-in history and trusted-device status, used to keep your account secure.
8. Crash reports: if an app encounters an error, it sends us a report with the app version, operating system, device model and identifier, language, the technical error details, and the IP address of the submission. Crash reports can also be sent before you sign in, in which case they are anonymous.
9. AI usage statistics: the number of AI requests you make and the amount of text processed (token counts) — not the content itself.

AI assistant and third-party AI processing

MyLawOffice includes an optional AI assistant that drafts legal documents. When you use it, the request you type, the history of that AI conversation and any case context you choose to attach are sent to our server in readable form (protected in transit by encryption) and forwarded to OpenAI, our AI provider, which generates the response. This is the only feature in which workspace content leaves end-to-end encryption — and only the excerpts you explicitly include in the conversation.

We do not keep your requests, the attached context or the generated documents on our servers; we record only usage counters (number of requests and token counts). Your AI chat history is stored and synced across your devices end-to-end encrypted, like the rest of your workspace.

OpenAI processes this data as our service provider under its API terms, which do not permit it to use the data to train its models; it may retain the data for a limited period to monitor for abuse. Processing may take place outside the European Economic Area, in which case the transfer is protected by the European Commission's Standard Contractual Clauses or an equivalent adequacy mechanism.

If you never use the AI assistant, none of your data is sent to any AI provider.

Subscription payments

MyLawOffice is a paid, monthly subscription. Payments are processed by Viva.com (Viva Payment Services S.A.), a payment institution licensed in Greece and supervised within the European Union. When you subscribe, you are redirected to Viva's secure checkout page, where you pay by card or with a digital wallet offered there; your card details are entered on that page and never pass through our servers.

To create each payment we send Viva your name, email address, phone number, country, preferred language, the plan you chose and the amount due, together with an internal payment reference. Viva returns to us a record of the transaction that includes the card brand, a masked card number and the transaction identifier, and notifies us of the outcome. Viva also processes your data as an independent controller for its own purposes, such as fraud prevention and its regulatory obligations, under its own privacy policy.

Your first payment creates a recurring-payment mandate at Viva. We use it to charge each renewal automatically on the same day every month, at the plan's then-current price, without you re-entering your card. If a renewal fails, we tell you by email and retry on the first, third and seventh day after the due date; your account keeps working in the meantime. If the last retry also fails, your account is suspended (see "Account status" below).

You can change plan, cancel your subscription or update your billing details at any time from the billing page of your account. Cancelling stops future charges; your access continues until the end of the period you have already paid for.

We issue an invoice for every payment. It is emailed to you and stays available for download from your billing page. Invoices are prepared by us outside the application, uploaded by our staff against the payment they belong to and stored on our private storage.

Account status: activation, suspension, cancellation and deletion

What happens to your account and your data at each stage:

1. Activation: after you verify your email address, your account is switched on by your first successful subscription payment. If no payment is completed, we email you a reminder about three days after verification and delete the account eleven days after that reminder, together with anything stored in it.
2. Suspension: if every retry of a failed renewal fails, we suspend your account and notify you by email. Nothing is deleted. While suspended you cannot use the applications or synchronise data, but you can still sign in to the website to see your billing page, download your invoices and pay the overdue amount, which restores access at once. Suspended accounts are not deleted automatically.
3. Cancellation and expiry: when a cancelled subscription reaches the end of its paid period, access to the applications ends and your sign-in tokens are revoked. Your workspace is kept, so you can resubscribe from the billing page and continue where you left off, until you delete the account or ask us to delete it.
4. Disabling by us: we may disable an account where the law requires it, to protect the service or other users, or at your request. You are notified by email, any subscription ends immediately and no further charges are taken. Nothing is deleted.
5. Deletion by you: you can delete your account at any time from your account settings after re-entering your password. Any subscription is set to end at the close of the paid period and no further charges are taken. The account is deactivated immediately and can be restored by signing back in within 30 days; we send a reminder halfway through and a final one before the deadline. If you sign back in, the account and, if the paid period is still running, the subscription are restored.
6. Permanent erasure: 30 days after you delete your account — or immediately when we delete it at your written request or for a legal reason — the account and its entire workspace are permanently erased: clients, cases, documents and stored files, notes, deadlines, calendar entries, AI conversations, device and sign-in records, and the subscription and payment history. Crash reports are unlinked from you and kept only as technical data no longer associated with any account.
7. Inactive accounts: while an account is suspended or its subscription has expired, the self-service export and deletion tools in the settings are unavailable. Contact us and we will provide your data or delete the account for you.
8. Records we must keep: the invoices issued to you and the payment notifications we receive from Viva are retained after erasure for as long as tax and accounting law requires (currently five years from the end of the financial year concerned). They are held in our accounting records, separately from your workspace.

How we use your data

We use your data only to:

1. Provide and operate the service, including authentication, email verification, two-factor authentication and synchronisation between your devices.
2. Generate AI documents when you request them, as described above.
3. Bill your subscription, issue and deliver your invoices, and handle failed payments, cancellations and reactivations.
4. Send you service emails, such as verification links, security codes and account notices.
5. Respond to support requests and messages you send us.
6. Diagnose and fix crashes and errors in the applications.
7. Protect the service against abuse, fraud and unauthorised access.
8. Measure how the public website is used — only with your consent through the cookie banner.
9. Comply with our legal obligations.

Legal bases

We process your data under the General Data Protection Regulation (GDPR) on the basis of the performance of our contract with you (operating your account, billing your subscription and providing the features you invoke, including the AI assistant), our legitimate interest in keeping the service secure and reliable (security logs, crash reports, fraud prevention), your consent (website analytics cookies), and compliance with our legal obligations (such as the tax and accounting rules on invoicing). Where we rely on consent, you can withdraw it at any time.

Security and encryption

Your workspace content is protected with end-to-end, post-quantum encryption (ML-KEM-768): the private key is generated once, delivered only to you, and is never stored on our servers — which also means we cannot recover it for you. Passwords are stored only as secure hashes, two-factor secrets are stored encrypted, and access to your account is additionally protected by email verification and optional two-factor authentication.

Sharing your data

We do not sell your personal data and we do not share it with third parties for advertising. We use a small number of service providers strictly to operate the platform, each processing data only on our instructions:

1. OpenAI (USA): generates the responses of the AI assistant, as described above.
2. Amazon Web Services (S3, EU region — Stockholm): stores your documents in their encrypted form.
3. Viva.com (Viva Payment Services S.A., Greece): processes your subscription payments and holds your payment method for renewals. It receives your name, email address, phone number and the amount due; your card details are entered on Viva's own secure page and never reach us.
4. Mailjet: delivers our service emails.
5. Cloudflare Turnstile: protects our public forms against automated abuse.
6. Google Analytics and Cookiebot: website usage statistics and consent management on the public site, activated only if you accept the corresponding cookies.

Data retention

We keep your data only for as long as it is needed:

1. Accounts that are not email-verified within 24 hours of registration are deleted automatically.
2. Verified accounts that never complete their first payment are reminded about three days after verification and deleted eleven days after the reminder.
3. You can delete your account yourself at any time from your account settings. A deleted account can be restored by signing back in within 30 days (we send reminders before the deadline); after that, the account and its entire workspace — including stored files and your payment history — are permanently erased, as described under "Account status".
4. Suspended, cancelled or expired accounts keep their workspace until you delete the account or ask us to; nothing is deleted on suspension or expiry.
5. Sign-in sessions and access tokens expire automatically and are purged when they go unused. The list of devices you have signed in from is kept for the life of your account so you can review and revoke them, and is erased with the account.
6. Crash reports are kept to analyse faults; when your account is deleted they are unlinked from you and retained only as technical data no longer associated with any account.
7. Data-export downloads are single-use and expire within one hour of being prepared.
8. Invoices and the payment notifications required by tax and accounting law are kept for the statutory period (currently five years), even after your account is deleted.

Your rights

Under the GDPR you have the right to:

1. Access the personal data we hold about you and receive a copy of it (data portability). You can export your full workspace from your account settings; because your content is end-to-end encrypted, the export requires the private-key file that was delivered to you.
2. Correct inaccurate data, directly from your profile settings.
3. Have your data erased, by deleting your account or asking us to delete it.
4. If your account is suspended or inactive and the self-service export or deletion tools are unavailable, contact us and we will carry out your request.

Contact

For any question about this policy or your personal data, contact us through the contact form on our website or via alpha-tech-solutions.gr.