Privacy Policy — FAI Legal Research Assistant

In one paragraph. We keep your account details, your plan and a count of your usage. Your conversations live in your own browser, not on our servers. To answer a question we send it, with the sources retrieved for it, to an AI model provider, and we hold a short-lived copy for up to 24 hours so an answer can be recovered if your connection drops. We do not sell your data, we set no advertising cookies, and we never take card details on this site.

1. Who is responsible for your data

The service is operated by Muhammad Faiz, an individual trading as FAI Productions, of Satellite Town, Behari Colony, Bahawalpur 63100, Punjab, Pakistan. FAI Productions is not a registered company. For anything in this policy, write to support@failegal.site or message +92 301 5368421 on WhatsApp.

2. What this policy covers

This policy covers the website at failegal.site, the assistant at failegal.site/app, the markdown copies of the public pages, and email or WhatsApp correspondence with us about the service. It does not cover third-party websites we link to.

3. What we collect, and why

Account details. Your email address, and the name, firm and username you give at sign-up. Used to create and secure your account, to contact you about it, and to show your name on documents you generate. Authentication is handled by Supabase. Passwords are stored only as salted hashes; they are never held in readable form and cannot be shown to you or to us. A forgotten password is replaced, never recovered.
Plan and usage count. The plan you are on, its expiry, and a running count of queries and drafts used, so the allowance can be metered. The count records that a query happened, not what it said.
A device identifier. A hash of a random value your browser generates, so the same browser counts as the same device against your plan's device limit. It identifies a browser, not a person.
A short-lived delivery copy of a question and its answer. While an answer is being produced, the question text, the conversation it belongs to and the answer are held in a server-side job record so the answer can be delivered to you even if the connection drops. The record is deleted as soon as your browser confirms it received the answer, and in any case expires and is purged within 24 hours.
Attached files. A file you attach (PDF, Word, text, image) is converted to text on the server so the model can read it, then handled like typed text. The file itself is not saved to your account.
Referral code. If you enter one, it is recorded against your account so the referrer can be credited.
Payment confirmations. Paid plans are arranged by WhatsApp or email. We keep the payment reference you send us and the date and amount, so the plan can be activated and any refund traced. We never handle card numbers.
Email delivery events. Whether a sign-up or password email was delivered or bounced, so undeliverable addresses can be detected.
Technical logs. Our hosting providers record standard request logs (IP address, browser type, time, path, response status) for security and to diagnose faults. These are kept by the provider for a short period and are not joined to your account by us.
Support correspondence. What you write to us by email or WhatsApp, kept so we can answer you and follow up.

4. What we do not collect or keep

Your conversation history. Question and answer history is held in your own browser's local storage. It is not uploaded to our database and is not readable by us. Clearing your browser storage deletes it permanently, and it does not follow you to another device.
A log of what you asked. Beyond the 24-hour delivery copy above, query text is not stored against your account.
Payment card details. Never handled by this site.
Advertising or tracking profiles. No advertising cookies, no third-party trackers, no sale or rental of personal data to anyone.

5. How answers are produced, and who sees your question

Answering a question means sending its text, any attachment text, and the statutory sections and judgments retrieved for it, to an AI model provider that generates the response. Some processing also runs on servers we operate ourselves, which may be hosted outside Pakistan. The providers we use can change as models and prices change; the categories are listed in section 9. This transmission is what produces the answer. It is not used to advertise to you and your questions are not sold.

Retrieval of statutes and judgments runs against our own mirrored index and, for some requests, against the courts' published sources. Those requests carry the search terms, not your identity.

6. Confidential and client material

You decide what to type or attach. Because the text of a question is sent to an AI provider and briefly held on our servers, do not include material you are not permitted to share with a third-party service, such as privileged client communications, unless you have considered your professional obligations and any consent you need. Where the facts of a matter are needed for research, describing them without names and identifying details is usually enough.

7. Cookies and local storage

The site sets no advertising or third-party tracking cookies. Browser storage is used for the session token that keeps you signed in, your device seed, your saved conversations, your interface preferences and any unsent draft. All of it is readable and clearable from your own browser. If bot protection is enabled on the sign-in form, the provider of that check (Cloudflare Turnstile) may set a cookie needed to run the check.

8. Email

Transactional email (sign-up confirmation, password reset, username recovery, plan notices) is sent through Resend. Delivery and bounce events are recorded so undeliverable addresses can be detected. We do not send marketing email to members who have not asked for it, and any such email will carry an unsubscribe link.

9. Who we share data with

We share data only with providers that are needed to run the service, and only what each needs:

Supabase: database and authentication (account details, plan, usage count, device hash, delivery copies).
Vercel: hosting of the website and API (request logs).
Resend: transactional email (your email address and the message).
AI model providers: the text of a question, attachment text and the retrieved sources, to generate the answer. Providers may include commercial model APIs and gateways and can change without notice.
Cloud hosting for our own servers: where retrieval or answering runs on infrastructure we operate.
Cloudflare: bot protection on forms, if enabled.

We may also disclose data where the law requires it, to a court or authority with jurisdiction, to protect the rights or safety of any person, or to a successor who takes over the service, who will be bound by this policy.

10. International transfers

Our providers and some of our own servers are located outside Pakistan. Data described in this policy is therefore stored and processed outside Pakistan, under the providers' own security commitments. By using the service you accept this.

11. How long we keep data

Account details, plan and usage count: for as long as your account exists, then deleted on request or when we close a dormant account.
Delivery copies of questions and answers: until your browser confirms receipt, and no more than 24 hours.
Attached files: not stored; converted text is discarded once the answer is produced.
Email delivery events and technical logs: a short period set by the provider, typically days to a few weeks.
Payment confirmations and support correspondence: as long as needed to resolve the matter and to meet any legal or accounting obligation.

12. Security

The site is served over HTTPS with HSTS and carries a Content-Security-Policy that restricts where scripts, styles and connections may originate. Access to member data is governed by Supabase row-level security, so one member's record cannot be read with another member's session. Passwords are salted hashes. No online service can promise perfect security. If we learn of a breach affecting your data we will tell you without undue delay and explain what happened and what we are doing about it.

13. Your rights and controls

See or correct your details: from Settings in the app, or by writing to us.
Export: ask us and we will send you the account data we hold in a readable format.
Delete your conversations: clear them in the app, or clear your browser storage. There is nothing on our side to delete.
Delete your account: write to us and the account and its profile record are removed. Payment records may be kept where the law requires.
Object or withdraw: you can stop using the service at any time, and ask us to stop any contact that is not needed to run your account.

We answer requests within 14 days. We may need to confirm that a request comes from the account holder before acting on it.

14. Children

The service is for adults and for law students aged 16 or over. We do not knowingly collect data from anyone younger. If you believe a child has created an account, tell us and we will remove it.

15. Legal framework

We operate from Pakistan and comply with the Prevention of Electronic Crimes Act, 2016 and other laws that apply to electronic systems and data in Pakistan. We follow the principles of Pakistan's proposed personal data protection legislation and of comparable international practice: collect the minimum, use it only for the stated purpose, keep it no longer than needed, secure it, and give you control. We will comply with any data protection law that comes into force and applies to us.

16. Changes to this policy

Material changes will be shown here with a new revision date and, where you have an account, notified in the app or by email. If a change would let us use your data in a way this policy does not already describe, we will ask before we do it.

17. Contact

FAI Productions (Muhammad Faiz, proprietor)
Satellite Town, Behari Colony
Bahawalpur 63100, Punjab, Pakistan
Email: support@failegal.site
WhatsApp: +92 301 5368421