Legal
Data Protection Policy
Last updated: October 25, 2026
1. Purpose
This policy outlines how ModulawAI Inc. (incorporated in Delaware, USA; principal place of business: 7 Peter Utulu Close, Anu Crescent, Badore, Ajah, Lagos, Nigeria; registered agent: Legalinc Corporate Services Inc., 131 Continental Dr, Suite 305, Newark, DE 19713) and its Nigerian subsidiary ModulawAI Nigeria Limited (RC-8401723) (together, “ModulawAI”) collect, handle, store, and protect personal and sensitive data. It ensures compliance with the Nigeria Data Protection Act 2023 (NDPA), the EU General Data Protection Regulation (GDPR), the UK GDPR and Data Protection Act 2018, applicable US state privacy laws, and industry best practices, while building trust with clients, users, and legal institutions.
Next review date: October 13, 2027. Acting Data Protection Officer: Founder (see section 17).
2. Scope
This policy applies to:
- All employees, contractors, and service providers of ModulawAI in all jurisdictions.
- All user data, legal documents, and platform interactions.
- All tools, systems, and subprocessors that process data on behalf of ModulawAI.
3. Data classification
| Classification | Examples | Sensitivity | Handling |
|---|---|---|---|
| Personal data | Email, name, login IP, device ID | High | Encrypted at rest; access-controlled |
| Sensitive legal data | Uploaded court judgments, case notes, client correspondence | Very high | Encrypted at rest and in transit; staff access only with user consent; never used for AI training |
| Privileged content | Attorney-client communications, draft legal advice, litigation strategy documents | Critical | Treated as confidential and legally privileged; no access by ModulawAI personnel without explicit consent; excluded from all analytics and AI training |
| Employee / contractor data | Names, contact details, contracts, payroll, performance records | High | Stored in HR systems; HR and senior management access only; retained per local employment law |
| Anonymous / aggregated data | Click events, heatmaps, aggregated usage statistics | Low | May be shared with analytics partners subject to consent |
4. Roles and responsibilities
| Role | Entity / person | Responsibility |
|---|---|---|
| Data controller | ModulawAI Inc. (US parent) | Determines purposes and means of processing; ultimate accountability |
| Group processor (Nigeria) | ModulawAI Nigeria Limited | Processes data under instruction from ModulawAI Inc. per intra-group agreement; administers and supports the Platform from Nigeria; local NDPC accountability |
| Data processors | AWS (hosting, our own MongoDB databases on EC2, S3, ElastiCache, CloudWatch, Bedrock, Textract), AI providers (AWS Bedrock, Fireworks AI, OpenRouter), LangSmith, voice and telephony providers (LiveKit self-hosted on AWS, Deepgram, ElevenLabs, Cartesia, Africa’s Talking), Paystack, Stripe, ZeptoMail, WhatsApp/Meta, Google (reCAPTCHA, Firebase), search and legal-data providers (Tavily, TinyFish, CourtListener, CanLII, EUR-Lex), analytics providers, full list in §11 | Process data on our behalf under written data-processing agreements |
| Acting DPO | Founder (engineering and product lead) | See section 17 for conflict acknowledgement |
| Independent legal reviewer | Chief Legal Officer (Mr. Oluwatobi Andrew Owoeye, LL.B, B.L) | Reviews data subject requests, subprocessor objections, and policy correspondence directed to dpo@modulaw.ai |
5. Lawful basis for processing
We collect and process data based on:
- User consent for optional analytics, marketing cookies, calendar integration, and AI processing of uploaded documents.
- Contractual necessity for account creation, service delivery, and billing.
- Legitimate interests for security monitoring, fraud prevention, and anonymized service improvement (subject to balancing test; see Privacy Policy section 6).
- Legal obligation for financial records, regulatory compliance, and data breach reporting.
6. Data collection and usage
| Data | Purpose | Basis |
|---|---|---|
| Email and password | User authentication | Contract |
| Court judgments (PDFs) | Legal research and case management | Contract / Consent |
| Chatbot queries | AI-driven legal assistance | Contract |
| Payment information | Subscription management (via Paystack and Stripe) | Contract; legal obligation |
| Usage logs | Security, error tracking | Legitimate interests |
| Analytics data | UX improvements (anonymized) | Consent |
7. Data storage and security
- The Platform is hosted on Amazon Web Services (AWS) in the United States (us-east-2, Ohio).
- User data stored in MongoDB databases that we run ourselves on AWS in the United States (us-east-2), encrypted at rest and reachable only from our private network, with role-based access control.
- Legal documents and files stored in Amazon S3 (AES-256 encryption at rest), served only through links that expire.
- Session state and rate-limit counters held in Amazon ElastiCache, reachable only from our backend. A citation graph built from public case law is stored in Neo4j.
- AI embeddings stored in our own MongoDB database, alongside the content they come from (see section 14).
- OCR on scanned documents performed by Amazon Textract; extracted text retained according to the document’s retention rules and not used by ModulawAI for AI model training.
- AI inference is routed to AWS Bedrock or Fireworks AI based on the task; text embeddings are created through OpenRouter, routed to Microsoft Azure’s zero-data-retention endpoint. Our AWS Bedrock account is set to zero data retention with model invocation logging off, Fireworks AI keeps no prompts or outputs by default, and under their terms for our account these providers do not use your content to train their models.
- Voice and call data flows through our own LiveKit server on AWS in South Africa (real-time relay), Deepgram (transcription, with model-improvement opt-out on every request), and ElevenLabs / Cartesia (synthesis). Call recordings and transcripts are stored in our own storage and inherit our retention rules.
- TLS 1.2+ encryption in transit for all data transfers.
- Encrypted backups of our database: a daily snapshot and continuous point-in-time recovery to Amazon S3, plus encrypted volume snapshots.
- Application logs mask email addresses and phone numbers and do not record request bodies or prompt text. Logs are monitored and retained for 90 days. AI run monitoring (LangSmith) receives metadata only in production, kept for 14 days.
8. Access controls
- Role-based access for all internal tools and systems.
- Passwords stored using bcrypt hashing.
- Access logs reviewed bi-monthly.
- Admin actions recorded and auditable.
- Staff access to user-uploaded legal documents is prohibited except for technical support with the user’s explicit consent, logged, and time-limited.
9. Data retention and deletion
| Data type | Retention period |
|---|---|
| Active user accounts | For as long as the account is open. After closure, as the user or customer instructs, subject to legal retention obligations |
| Chat history | Until deleted by the user, or as the account or customer instructions require |
| Uploaded documents and case files | Until deleted by the user or customer. Deleted items stay in the recycle bin for 30 days and are then permanently deleted |
| Payment and billing records | 7 years (legal and tax obligation) |
| Security and application logs | 90 days |
| AI run monitoring (LangSmith metadata) | 14 days |
| Employee and contractor data | Duration of engagement plus applicable statutory period (minimum 6 years) |
Users may request deletion of their data at any time by contacting dpo@modulaw.ai, subject to legal retention obligations.
10. Cross-border data transfers
We process personal data in the United States, where the Platform is hosted. ModulawAI Nigeria Limited administers and supports the Platform from Nigeria and may access data when needed. Live call audio and video are relayed through our own server on AWS in South Africa. We do not process personal data in the European Economic Area or the United Kingdom.
Data processed by ModulawAI may flow between ModulawAI Inc. (US) and ModulawAI Nigeria Limited. These intra-group transfers are made under an intra-group agreement, which we are updating so that it incorporates:
- For transfers affecting EU/EEA or UK data subjects, the European Commission’s Standard Contractual Clauses (Implementing Decision (EU) 2021/914), Module 3 (processor to processor), and the UK International Data Transfer Addendum.
- Safeguards that meet the cross-border transfer rules of the Nigeria Data Protection Act 2023 and the requirements of the Nigeria Data Protection Commission (NDPC) for international transfers of Nigerian personal data.
For our business customers, transfers of EU/EEA and UK personal data to ModulawAI rely on the Standard Contractual Clauses, Module 2 (controller to processor) or Module 3 (processor to processor), and the UK Addendum, as set out in our Data Processing Agreement. Data processed by our subprocessors (e.g. Amazon Web Services) may also be transferred internationally; we make those onward transfers only where a transfer mechanism recognised by data protection law is in place, such as the Standard Contractual Clauses and UK Addendum in the subprocessor’s data processing terms.
11. Third-party subprocessors
We engage the subprocessors below to deliver the Service. Each is bound by a written agreement containing confidentiality, security, and (where applicable) data-protection obligations equivalent to those in this policy. We notify customers at least 30 days before adding a new subprocessor that processes Personal Data on our behalf (see our DPA, §6).
The authoritative, continuously-maintained list, including a changelog of additions and removals, lives at modulaw.ai/subprocessors. The tables below mirror that page as of the “Last updated” date at the top of this policy.
Infrastructure & storage
| Provider | Purpose | Location |
|---|---|---|
| Amazon Web Services (AWS) | Primary hosting: application servers (EC2), databases (MongoDB that we run ourselves on EC2, encrypted and reachable only from our private network), file storage (Amazon S3), cache (Amazon ElastiCache), logs (Amazon CloudWatch), web app delivery, and hosting for the ModulawAI for Word add-in | United States (us-east-2, Ohio; us-east-1 for content delivery) |
| ModulawAI Nigeria Limited | Administration, engineering and support. Accesses service data only when needed to operate and support the Platform | Nigeria |
AI / inference providers
| Provider | Purpose | Location |
|---|---|---|
| AWS Bedrock (Amazon Web Services) | Hosted AI models, including Anthropic Claude, Amazon Nova and open-weight models (such as Qwen, Llama, Kimi and gpt-oss), and embeddings. Our account is set to zero data retention, with model invocation logging off | United States |
| Amazon Textract (Amazon Web Services) | Reading text from scanned documents (OCR) | United States |
| Fireworks AI | Open-weight AI models and image generation. Zero data retention by default for the models we use | United States |
| OpenRouter | Routes text-embedding requests (text-embedding-3-large) to Microsoft Azure’s zero-data-retention endpoint | United States |
| LangSmith (LangChain) | Monitoring of AI runs. In production, prompts and outputs are hidden: only metadata (ids, timings, errors) is sent, and traces are kept for 14 days | United States |
Each AI provider receives only the prompt and context needed to answer a request. Under their terms for our account, AWS Bedrock, Fireworks AI and the Azure embedding endpoint we reach through OpenRouter do not keep your prompts or outputs and do not use your content to train their models. Deepgram is called with its model-improvement opt-out on every request. Amazon Textract is covered by our AWS Organizations AI services opt-out, so AWS does not store or use the documents it reads to improve its services. ElevenLabs, Cartesia, TinyFish and Tavily process data under their own standard terms, and we send them only what their function needs. ModulawAI itself never uses your content to train AI models.
Voice and real-time communication
| Provider | Purpose | Location |
|---|---|---|
| LiveKit (self-hosted by ModulawAI on AWS) | Real-time relay of call audio and video for the AI voice agent and call features. Runs on our own server; no LiveKit-hosted service receives the media | South Africa (AWS af-south-1, Cape Town) |
| Deepgram | Speech-to-text transcription, with model-improvement opt-out on every request | United States |
| ElevenLabs | Text-to-speech voice synthesis for AI responses | United States |
| Cartesia | Text-to-speech fallback provider | United States |
| Africa’s Talking | SMS, phone calls and call recording. Recordings are copied to our own storage | Kenya / Nigeria |
Email, messaging, payments, security
| Provider | Purpose | Location |
|---|---|---|
| Paystack | Payment processing (NGN subscriptions, invoices, seat purchases) | Nigeria |
| Stripe | Payment processing (non-NGN subscriptions) | United States |
| ZeptoMail (Zoho) | Transactional email delivery (OTP codes, receipts, booking confirmations) | India / US |
| WhatsApp Business / Meta | OTP and booking notifications where the user opts in | United States |
| Google (reCAPTCHA, Firebase Cloud Messaging) | Bot protection on public forms; push notifications | United States |
Research, search and legal data sources
| Provider | Purpose | Location |
|---|---|---|
| CourtListener | US case law lookup and citation verification | US |
| CanLII | Canadian case law lookup | Canada |
| EUR-Lex | EU legislation lookup (public database; receives the search query only) | EU |
| TinyFish | Browser-based citation verification for jurisdictions without an official API (UK, Ghana, Kenya, South Africa) | US |
| Tavily | Web search augmentation for research queries | US |
Public legal databases (CourtListener, CanLII, EUR-Lex) receive only the search query you run, the same as any visitor to those sites. TinyFish and Tavily receive the citation or search query only, never the body of your documents. Please do not put client names or confidential facts in research queries.
Analytics and marketing (consent-gated)
| Provider | Purpose | Location |
|---|---|---|
| Google Analytics (GA4) | Website analytics (pseudonymous, consent only) | US |
| Microsoft Clarity | Behavioral analytics (masked) | US |
| Meta (Facebook Pixel) | Marketing attribution | US |
| TikTok Pixel | Marketing attribution | US |
| X / Twitter Ads | Marketing attribution | US |
| Apollo | Marketing attribution | US |
User-authorised integrations
The following are not subprocessors in the traditional sense; users (or workspace administrators) choose to connect their own accounts and we act on their authorised instructions. Data flows to and from these systems are governed by the third party’s own terms.
| Provider | Purpose |
|---|---|
| Google Workspace (Gmail, Calendar, Drive) | Email, calendar, document access on user authorisation |
| Microsoft 365 (Outlook, OneDrive, Teams Calendar, Word add-in) | Email, calendar, document access on user authorisation |
| Zoho (CRM, Mail, Bookings) | CRM / email / scheduling sync on user authorisation |
12. Employee and contractor data
ModulawAI processes personal data about its employees and contractors including names, contact details, employment contracts, payroll information, and performance records.
- Processed on the basis of contractual necessity and legal obligation.
- Accessible only to HR and senior management with a legitimate need.
- Retained for the duration of employment plus the applicable statutory period under Nigerian or US law (minimum 6 years).
- Employees and contractors have the same data rights as users (see section 13).
13. User rights
In line with the NDPA, the GDPR, the UK GDPR, and applicable US privacy law, data subjects have the right to:
- Access their personal data.
- Correct inaccurate or incomplete data.
- Request deletion (subject to legal retention obligations).
- Restrict processing, in some circumstances.
- Object to processing.
- Request data portability.
- Withdraw consent at any time.
- Lodge a complaint with the Nigeria Data Protection Commission (NDPC) at ndpc.gov.ng, the UK Information Commissioner’s Office (ICO) at ico.org.uk, or, in the EU/EEA, the supervisory authority in the country where they live or work, or where the alleged infringement took place.
Requests: dpo@modulaw.ai. We will respond within one month.
14. AI-specific data governance (embeddings)
ModulawAI stores AI embeddings (mathematical representations of text used to power semantic search and AI responses) in its own MongoDB database, which it runs on AWS in the United States. We do not use a separate vector database provider.
- Embeddings are derived from public legal materials and, to power search inside a workspace, from that workspace’s own content, such as document passages, saved memories and skills. Those embeddings may therefore reflect personal data contained in that content.
- Workspace embeddings are stored with the content they come from and are protected by the same workspace access controls.
- Embeddings are created by AWS Bedrock or, for text-embedding-3-large, through OpenRouter routed to Microsoft Azure’s zero-data-retention endpoint. They are never used to train AI models.
- Embeddings are mathematical vectors that cannot, in normal circumstances, be reverse-engineered to reconstruct the original text. We nonetheless treat them with the same protection as the source content.
15. Data protection impact assessments (DPIA)
ModulawAI conducts Data Protection Impact Assessments (DPIAs) for processing activities that are likely to result in high risk to individuals’ rights and freedoms. DPIAs are required under the NDPA and the GDPR for high-risk processing, which includes:
- Processing of sensitive legal data and privileged attorney-client communications.
- AI-powered processing of legal documents at scale.
- Any new feature involving systematic processing of personal data.
DPIAs are documented internally and reviewed annually or upon material changes to the relevant processing activity. The DPIA for AI processing of legal documents is in progress.
16. Data breach notification
If a data breach occurs:
- The breach will be assessed and contained immediately upon discovery.
- Where we are the controller, the relevant regulatory authority (the NDPC, the UK ICO or the competent EU supervisory authority) will be notified within 72 hours of our becoming aware where required, and affected users without undue delay where the breach is likely to result in a high risk to them.
- Where we process data for a business customer, we notify that customer without undue delay and no later than 48 hours after becoming aware, as set out in our Data Processing Agreement.
- A root cause analysis will be completed within 7 days.
- Remediation steps will be documented and implemented.
17. Data protection officer: conflict acknowledgement
ModulawAI’s Founder, who also leads engineering and product, currently serves as the acting Data Protection Officer. ModulawAI acknowledges that under the NDPA and GDPR the DPO should be functionally independent from operational decision-making, and that combining the DPO role with founder-level operational authority creates a potential conflict of interest.
Material requests, data subject rights exercises, and regulatory matters submitted to dpo@modulaw.ai are reviewed by our Chief Legal Officer, Mr. Oluwatobi Andrew Owoeye (LL.B, B.L; in active legal practice since 2014; profile at /about), who provides functionally independent legal assessment. This independent legal review provides a substantive mitigation of the Founder/DPO conflict pending the appointment of a dedicated DPO.
dpo@modulaw.ai is a shared mailbox with access limited to a defined set of authorised reviewers, currently the acting DPO (Founder) and the Chief Legal Officer. Access is logged and reviewed periodically. ModulawAI remains committed to appointing an independent, dedicated Data Protection Officer as operations scale.
18. Policy review
This policy is reviewed annually and updated following material changes to data architecture, legal requirements, or regulatory guidance.
19. Contact
Data Protection Officer (Acting)
Email: dpo@modulaw.ai
ModulawAI Inc.
7 Peter Utulu Close, Anu Crescent, Badore, Ajah, Lagos, Nigeria (Principal Office)
Registered Agent: Legalinc Corporate Services Inc., 131 Continental Dr, Suite 305, Newark, DE 19713, USA
ModulawAI Nigeria Limited (RC-8401723)