The short version

We do not sell personal information, and the website has no advertising or analytics trackers.
Each firm's records are kept apart from every other firm's.
Bahas sends your question and the legal passages it found to an AI provider that excludes them from model training.
Our providers operate outside Nepal, including in the United States.
You can ask us to show, correct or delete what we hold about you.

This summary helps you read the rest. The full text below is what applies.

This policy explains what personal information Okil collects, why, who it is shared with, and what you can ask us to do about it. "Okil", "we" and "us" mean OKIL AI Pvt. Ltd., based in Kathmandu, Nepal. Questions go to support@okil.ai.

Two roles

For your own account (your name, sign-in details and security records) we decide how the information is used. For the work a law firm puts into Okil, such as client records, cases and documents, the firm decides what goes in and why, and we handle it on the firm's behalf and under its settings. If you are a client of a firm and want to know what that firm holds about you, ask the firm first. We will help the firm answer.

What we collect

Account details: your name, email address, mobile number, username, profile photo, and a password that we store only in hashed form.
For advocates: a Bar Council licence number, enrolment year and an uploaded scan of the licence, which one of our operators reviews so that the licence can be marked verified.
Firm details: the firm's name, logo, tax details, members and their roles.
Work your firm records: client names, contact details, addresses and ID numbers, cases, hearings, tasks, documents, time entries, invoices, payments and the messages sent to clients.
If you are a client with a portal: your email address or mobile number, and the documents you upload.
Bahas: the questions you ask, your saved conversations, and the documents you ask it to analyse.
Security and device information: the IP address and browser or device details of your sign-ins, and records of security events such as new-device sign-ins and password or role changes.
Notifications and delivery: in-app notifications, reminders, and a record of whether an email or SMS was sent and delivered, and any consent a person gave to receive messages.
Enquiries: if you book a demo, your name, email, phone number, organisation, role, team size, preferred time and message.

We do not collect card details, because Okil has no card checkout. Subscriptions are paid by eSewa, Khalti or bank transfer outside the site, and we record the payment.

How we use it

To provide Okil: sign you in, keep each firm's information separate, and run the features your firm uses.
To send what you ask for or need: sign-in codes and links, invitations, reminders, daily summaries and billing notices, by app, email or SMS according to your settings.
To keep accounts and firms secure: detect new-device sign-ins, limit repeated failed sign-ins and keep an activity log.
To answer questions and demo requests.
To meet legal obligations.

We do not sell personal information. The website does not use third-party advertising or analytics trackers.

Cookies

We use only the cookies needed to keep you signed in and your session secure. We do not use advertising or analytics cookies. Your browser may also store simple preferences, such as the language you chose.

We use outside companies to run Okil. They handle information only to provide their service to us.

Hosting and network: Vercel (the website), Render (the application server and database) and Cloudflare (network and security).
File storage: Backblaze, for uploaded documents and images, which are kept in the United States.
Email and SMS: Resend sends our email, and Sparrow SMS sends text messages to Nepali mobile numbers.
AI for Bahas: when you use Bahas, your question and the legal passages retrieved for it are sent to an AI provider to write the answer. Uploaded documents are sent to an AI provider when you ask Bahas to analyse them. The providers we use are Groq, Google and Anthropic, depending on the feature.
Integrations your firm chooses to connect: Google Calendar, and Gmail for sending the firm's messages from its own address. We store the access we are given in an encrypted form, and you can disconnect at any time.
Browser push notifications, if you turn them on, are delivered through your browser's own push service.

The AI providers contractually exclude data sent through their business services from training their models, and may keep it briefly to detect abuse. We also share information when the law requires it, or to protect the rights, safety or security of people using Okil.

Information outside Nepal

Our providers operate outside Nepal, including in the United States. Your information may therefore be stored and processed in other countries. We choose providers with contractual protections for the data they handle, but the legal rules in those countries may differ from Nepal's.

How long we keep it

Account and firm information is kept while the account is active.
A firm's records are kept for as long as the firm uses Okil, so that cases, billing and history stay complete. When a member leaves a firm, their name stays on the work they did, and their access ends.
In-app notifications you have read are deleted after 90 days, and all notifications after 365 days.
Demo enquiries are kept for as long as we need to respond to them.
When you ask us to delete your account, we delete it unless we must keep information for legal reasons or because it forms part of a firm's records. The owner of a firm must first transfer ownership or delete the firm.

How we protect it

Connections to Okil are encrypted, and sign-in passwords are hashed.
Two-factor sign-in with an authenticator app is available to everyone and is required for our administrators.
Each firm's information is separated from every other firm's by access checks in the application. Within a firm, roles decide who sees which cases, and a case marked sensitive is hidden from everyone but the owner and that case's team.
Sign-in attempts are rate-limited and accounts lock after repeated failures. We email or text you when your account is signed in from a new device.
Documents are served through short-lived signed links.

No system is perfectly secure. If we learn of a breach that affects your information, we will tell the people and firms affected and the authorities as the law requires.

Your choices and rights

You can ask us to tell you what we hold about you, to correct it, to delete it, or to stop using it for a purpose. You can change how you are notified in your settings, and turn off two-factor or push notifications you no longer want. For information a firm holds about its clients, contact the firm. To make a request about information we are responsible for, write to us and we will reply. We may need to confirm who you are first.

We aim to handle personal information in line with Nepal's Privacy Act, 2075 (2018) and other laws that apply to us.

Children

Okil is for professionals and their clients. It is not intended for people under 18, and we do not knowingly collect their information.

Changes to this policy

We will update this page when our practices change and show the date at the top. If a change materially affects how we use your information, we will also tell you by email or in the app.

Contact

OKIL AI Pvt. Ltd., Kathmandu, Nepal. Email support@okil.ai.

Privacy policy