Privacy Policy

In one paragraph

Portable Lawyer publishes the text of national constitutions and gives you tools to search it and ask questions about it. You can read and search everything without an account. An account is only needed for the AI conversation features. This policy explains exactly what those features send where, so you can decide what to type.

Who we are

Portable Lawyer is operated by Nth Collective Limited, of [REGISTERED ADDRESS — TO BE SUPPLIED], registered under number [COMPANY REGISTRATION NUMBER — TO BE SUPPLIED]. For the purposes of data protection law, that entity is the controller of the personal data described here.

Questions about this policy, or any request under it, go to [CONTACT EMAIL — TO BE SUPPLIED].

Reading the law needs no account

Everything in the corpus is free and unauthenticated. Reading a country page, opening a provision, searching the text, and downloading the machine-readable corpus index all work without signing in, and none of them are tied to an identity. The public read endpoints are deliberately generous, because access to the text of the law should not depend on anyone letting you in.

Searching as a guest sends your search words to our public search API, which reads the corpus and returns matching passages. That endpoints only reads: it does not write your query to our database.

What we collect

If you create an account

• Your name, your email address and your password. The password is hashed with bcrypt (cost factor 12) before it is stored — we never store it in readable form and we cannot tell you what it is.

If you sign in

• An access token and your basic user record, in your own browser.These are kept in your browser's localStorage under the keys bill-of-law-token and bill-of-law-user, not in cookies. The token is sent to our API in the Authorizationheader so the API knows which account is asking. Clearing your browser's site data for this site removes both and signs you out.

Automatically, on every request

• Your IP address, transiently, to rate-limit abuse.Our API keys its request limits on the caller's address (IPv6 clients are bucketed by /64 so a single caller cannot dodge the counter). Those counters are held in the API process's memory and the code does not write IP addresses to the database.
• Aggregate usage measurements. Vercel Analytics and Vercel Speed Insights are loaded on every page. They are configured with no custom events and no identifying parameters — we only see aggregate page views and performance timings. Vercel documents both products as cookieless and as not building a cross-site profile of you.
• Standard server logs.Our hosting providers (Vercel for this site, Fly.io for the API) keep ordinary request logs, which necessarily include IP addresses and request paths. We have not configured a custom log retention period; those logs are governed by the providers' own policies.

We do not collect: your location, your contacts, your device identifiers, advertising IDs, or anything from other sites. There are no advertising or social-media trackers on this site.

Your questions and AI answers

When you ask a question while signed in, this happens:

1. Your question is stored as a message in the conversation you asked it in.
2. The question is run against the constitutional corpus, and the passages judged relevant are gathered.
3. Your question, the last ten messages of that conversation, and those passages are sent to OpenAI (model gpt-4o-mini) to generate the answer. The passages are the text of the law, which is public.
4. The answer comes back and is stored as a message in the conversation, so you can read it again later.

In other words, the words you type into the AI feature are processed by OpenAI as our service provider. Do not type anything into a question that you would not be willing to have a third-party processor handle — and remember that no AI conversation here is covered by lawyer–client privilege, because we are not your lawyers (see our disclaimer).

You can delete a conversation from the conversation list in the app, which deletes its messages with it. Conversations are private to your account: the API refuses to serve or modify a conversation that belongs to someone else.

Documents you upload

The document review feature accepts PDF, TXT and MD files. When you upload one:

• the file is held in memory; a PDF is written briefly to a temporary file in the server's temporary directory so its text can be extracted, and that temporary file is deleted immediately afterwards;
• the extracted text is truncated to its first 15,000 characters and sent to OpenAI together with the relevant constitutional passages, to produce the review;
• the document itself is not stored by us — no copy of your file or its full text is kept;
• what is stored is a message in your conversation recording that a document was uploaded, including the file name and any context you typed alongside it.

Because the extracted text is sent to OpenAI and the file name is stored, please do not upload documents containing information you are obliged to keep confidential, or that you are not entitled to share.

Who we share it with

We share personal data only with the service providers that make the product work:

• OpenAI — processes your questions, recent conversation messages, and the extracted text of any document you upload, in order to generate answers and document reviews.
• Vercel — hosts this website and provides the cookieless analytics and performance measurements described above.
• Fly.io — hosts the API that stores accounts, conversations and the constitutional corpus.

We do not sell your personal data, we do not rent it, and we do not share it with advertisers or data brokers. We may disclose data if the law compels us to, and we would tell you unless we were legally barred from doing so.

How long we keep it

Being precise here matters more than sounding tidy, so: the code contains no automatic deletion or expiry job for conversations or accounts. In practice that means:

• Conversations remain until you delete the conversation yourself or ask us to delete it. There is no fixed retention period enforced by the system.
• Uploaded documents are not retained at all — only the extracted text that was sent to OpenAI for that one review, and the file name stored in your conversation.
• Accounts remain until you ask us to close them. Self-service account deletion does not exist yet, so this is currently a manual request to [CONTACT EMAIL — TO BE SUPPLIED].
• Rate-limit counters and request logsare short-lived (counters live in the API process's memory); hosting logs follow our providers' policies.

This policy is currently silent on a fixed retention period, because we have not yet decided one. We would rather tell you that than name a number we do not enforce. Until that changes, treat your conversations as kept indefinitely unless you delete them.

Your choices and rights

• Read without an account. The entire corpus is available with no sign-in at all — nothing about you is collected for reading the law.
• Delete a conversation yourself, from the conversation list in the app.
• Ask us for a copy, a correction or a deletion of the personal data tied to your account by writing to [CONTACT EMAIL — TO BE SUPPLIED]. Depending on where you live, you may have statutory rights to access, correct, delete, restrict or object to our processing, and to complain to your local data protection authority; we will honour requests we receive.
• Ask us not to use OpenAI for your question. Because the AI features do not work without sending text to OpenAI, the honest version of this choice is simply not to use those features — search and reading do not involve OpenAI at all.

The legal framework we are subject to is [GOVERNING LAW — TO BE SUPPLIED]. If you would normally be entitled to a statutory contact point in your own country (for example a data protection representative), note that we have not published one yet.

Security

Passwords are bcrypt-hashed, traffic to the site and the API is encrypted in transit, and the API applies rate limits to every route, including tighter limits on authentication and on the OpenAI-backed features. No service can promise perfect security; if you become aware of a vulnerability, please tell us at [CONTACT EMAIL — TO BE SUPPLIED] rather than exploiting it.

Children

This service is not directed at children. If you are below the age at which you can consent to online services in your country, please do not create an account or use the AI features.

Changes to this policy

We will update this page as the product changes, and the date at the top shows when it last changed. If a change materially affects what happens to your data, we will say so clearly here rather than quietly editing a sentence.

Contact

Privacy questions, data requests, and security reports: [CONTACT EMAIL — TO BE SUPPLIED]. Postal and company details: Nth Collective Limited, [REGISTERED ADDRESS — TO BE SUPPLIED].