Privacy Policy

Last updated: July 2026

Draft policy pending legal review — not yet verified by Thai counsel.

1. Data Controller

Responsible for data processing on this platform is LegalHub. Contact for privacy inquiries: privacy@legalhub.ai

2. What Data We Process

In the course of using our platform, we process the following categories of personal data:

• Account data: email address, name, phone number (optional)
• Case data: description of your legal matter, analyzed by our AI for classification
• Communication data: chat messages between client and lawyer
• Payment data: for lawyers, processed through our payment provider Stripe (we do not store full card details)

3. Sensitive Personal Data

Under the PDPA, sensitive personal data includes racial or ethnic origin, political opinions, religious or philosophical beliefs, sexual behavior, criminal records, health data, disability, trade union membership, and genetic or biometric data.

Depending on the nature of your legal matter, the information you provide may include sensitive personal data as defined above (for example, in criminal law or immigration-related cases). We collect two separate types of consent, at two separate points in your interaction with the platform:

• When you register an account, you confirm that you have read and agree to this Privacy Policy.
• When you submit a case, you are asked for a separate, explicit checkbox confirming that you understand your case description or attachments may include sensitive personal data (such as criminal history or health information) and consenting to its processing for case matching and legal service delivery. This consent is collected at the point you provide the information — it is not bundled into account registration.

4. Purpose and Legal Basis

We process your personal data on the following legal bases under the PDPA:

• Account and case data (non-sensitive): performance of a contract (Section 24(3) PDPA) — necessary to provide our matchmaking and case-management services to you.
• Communication data: performance of a contract (Section 24(3) PDPA) — necessary to enable the client–lawyer chat feature.
• Payment data: performance of a contract (Section 24(3) PDPA) and, for retained records, compliance with a legal obligation (Section 24(5) PDPA) such as tax and accounting requirements.
• Sensitive personal data: your explicit, freely given, specific, and informed consent (Section 19 PDPA), meeting the heightened standard for sensitive personal data set out in Section 26 PDPA. We do not rely on pre-ticked boxes or bundled, implied consent for this category — it is requested separately from your general account registration.

5. AI-Based Classification

To categorize your legal matter, we use an AI model (Google Gemini). Your case text is transmitted to this AI provider for that purpose.

6. Retention Period

We retain your data for as long as your account remains active. Upon deletion of your account, personal data is anonymized; completed case and payment records may continue to be retained where required by law (e.g., for tax purposes).

7. Your Rights

Under the PDPA, you have the right to:

• Be informed of how your data is collected, used, and disclosed
• Access and obtain a copy of the data we process about you
• Request rectification of inaccurate or incomplete data
• Request erasure or de-identification of your data — use the deletion function in your account for this, subject to legal or contractual retention obligations
• Object to processing, or withdraw your consent at any time — withdrawal must be as easy as giving consent
• Data portability, in a structured, commonly used, and machine-readable electronic format — available as a self-service export: while logged in, an authenticated request returns your data immediately, without needing to submit a manual request to support
• Lodge a complaint with the Personal Data Protection Committee (PDPC), Thailand's data protection regulator

8. Third-Party Providers

We use the following third-party providers, who process data on our behalf:

• Google Gemini — AI classification of case text, extraction of facts from uploaded case documents, translation and summarization of chat messages, and drafting of formal letters
• Stripe — payment processing (lawyer subscriptions, pay-per-lead, and escrow payments)
• Resend — sending email notifications
• Supabase Storage — storage of documents you upload as case attachments
• Sentry — error monitoring for our backend service
• Render — backend hosting infrastructure (Singapore)
• Vercel — frontend hosting on Vercel's global content delivery network
• Neon — database hosting (Singapore, ap-southeast-1)

Some of the providers listed above (Google Gemini, Stripe, Resend, Supabase Storage, Sentry, Vercel) process data outside Thailand. This constitutes a cross-border transfer of personal data under Section 29 PDPA. We are committed to ensuring that such transfers are protected by adequate safeguards — such as standard contractual clauses, binding corporate rules, or an approved certification — or are made only with your explicit consent after being informed of the destination country and the associated risks.

If you have questions about data protection, contact us at privacy@legalhub.ai.