Draft: Draft — review with counsel before publishing.
Legal
Privacy policy
This policy explains what personal data Mizan handles, why, where it is kept and the choices you have. Effective from [Effective date].
Last updated 14 November 2026
Who we are
Mizan is a practice-management service for law firms, provided by [Legal entity name], registered at [Registered address] ("we", "us").
For information about visitors to this website, people who request a demo, and the account details of users, we decide how the data is used and act as the controller. For the content a law firm puts into Mizan, such as matters, clients, documents and invoices, the firm is the controller and we process that content on its instructions as its processor.
Information we collect
- Account information: name, work email, role, firm, language preference, sign-in and security records (for example multi-factor authentication status and sign-in times).
- Firm content: whatever a firm and its users enter or upload, including client and matter details, court dates, documents, time records and invoices. We process this only to provide the service to that firm.
- Website and demo requests: what you type into our forms (name, firm, email or phone, country, team size and an optional message), plus a one-way hash of your IP address used to limit abuse.
- Website chat: the questions you type into the website assistant and the answers it gives. Do not enter confidential client information there.
- Cookies and analytics: essential cookies to run the site and remember your choices. Visit measurement runs only if you accept it in the cookie banner.
How we use information
We do not sell personal data, and we do not use firm content to advertise to anyone.
- To provide, secure and support the service, including approving new firms and helping users who contact us.
- To reply to demo requests and questions you send us. We do not add you to marketing lists without asking.
- To keep the service safe: rate limits, fraud prevention, audit logs and investigating misuse.
- To bill firms for their subscription and keep the records the law requires.
- To improve the website, using aggregated visit measurement only when you have consented.
AI features
Some features use an external AI provider: the assistant, drafting, translation and reading of court notices. When a user asks the assistant a question, the provider receives the user's message and the records the assistant looked up to answer it. Look-ups go through the same permission checks as the normal screens, so the assistant never sees more than that user can open.
AI is optional and is switched on or off per firm. Nothing the assistant drafts takes effect until a person confirms it.
Under the provider's commercial terms, prompts and outputs are not used to train its models. [AI provider name and terms — confirm before publishing.]
Where your data is stored
The application, the firm database, uploaded files and backups are hosted with [Hosting provider and region]. A firm may ask for hosting in its own country, which we agree in writing.
Some data leaves that region only when a feature needs it, for example when an AI request is sent to the AI provider or an email is delivered. The security page lists these cases.
Who processes data on our behalf
We use a small number of service providers for hosting, backups, email delivery and AI features. Each is bound by a written agreement to process data only on our instructions and to protect it. [Sub-processor list]
We will tell firms before adding a new sub-processor that handles firm content, so they can object.
How long we keep it
Firm content is kept while the firm's subscription is active. After the subscription ends, the firm can export its data for [Export window] days; we then delete it, and backups expire within [Backup retention period].
Demo requests are kept for up to [Demo retention period] months. Audit records and billing records are kept for as long as the law requires.
Security
Data is encrypted in transit. Access inside a firm is controlled by roles and permissions enforced in the database, sign-in can require multi-factor authentication, and important actions are recorded in an audit log that cannot be edited. Details are on our security page.
No system is perfectly secure. If we learn of a breach affecting personal data, we will inform the affected firms without undue delay and as the law requires.
Your rights
Depending on the law that applies to you, you may ask to access, correct, delete or receive a copy of your personal data, or object to some uses of it. Write to in.kaushal.amit@gmail.com.
If your data is held in Mizan by a law firm, for example as one of its clients, please contact that firm: it decides how your data is used, and we will help it respond.
Children
Mizan is a service for businesses and is not directed at children. We do not knowingly collect personal data from children through this website.
Changes to this policy
We will post any change on this page with a new date. If a change is significant, we will also tell firm partners by email before it takes effect.
Contact
Questions about this policy or your data: in.kaushal.amit@gmail.com, or write to [Legal entity name], [Registered address].