Privacy Policy

• Account data — name, email address, a hashed password, profile picture and sign-in provider (Google or Facebook) if you use them.
• Document content — the form fields and prompts you enter (names, addresses, amounts, dates and anything else you type) and the documents you generate or save. If you choose to enter an NID number or similar identifier in a document, it is stored as part of that document.
• Consultation data — bookings you make with lawyers, payment status and session details. We do not record video calls.
• Payment data — order IDs, transaction reference numbers, amounts, plan and payment status. We never receive your bKash or Nagad PIN.
• Visitor and technical data — see the next section.
• Communications — messages you send to our support email.

To run the site, prevent abuse and understand usage, our servers keep a first-party “visitor session” for each browser. This runs on our own servers and is independent of the optional third-party analytics described in section 4. A visitor session record contains:

• a random visitor ID stored in the dolil_visitor_id cookie (first-party, HttpOnly, one year);
• your account ID, if you are signed in;
• a SHA-256 hash of your IP address and, at present, the IP address itself;
• your browser user-agent, referrer, approximate country, region and city (derived from request headers), and device type, browser and operating system;
• an event log of pages viewed and actions taken (for example “document generated” or “consultation booked”).

The stored IP address is used for security and analytics and is visible only to super administrators, who see it in a masked form (the last part of the address is hidden). Rate limiting also uses your IP address.

We currently do not have an automatic deletion schedule for visitor sessions; see Data retention. You can ask us to delete them.

• To generate documents and provide the AI Writer.
• To facilitate lawyer consultations and process related payments.
• To manage your account, plan and document quota.
• To send transactional emails (verification, password reset, booking and payment notices).
• To secure the Platform, detect fraud and abuse, and enforce our Terms of Service.
• To measure usage and improve the product (first-party analytics always; third-party analytics only with your consent).
• To comply with legal obligations.

Essential first-party cookies and storage (always on):

• dolil_visitor_id — visitor session ID described above.
• dolil-ai-lang and local storage key dolil-ai-lang — your language preference.
• Sign-in session cookie — keeps you signed in.
• dolil-ai-consent (local storage) — remembers your analytics choice.

Optional third-party tools, loaded only if you click “Accept” in the consent banner (and kept off if you click “Decline” or have not chosen):

• Google Analytics 4 (Google) — traffic and usage measurement.
• Meta Pixel (Meta Platforms) — measures visits and conversions and may be used for ad measurement.
• PostHog — product analytics (page views; automatic click capture is disabled).

You can change your choice at any time with the “Cookie preferences” link in the footer. Declining does not affect your use of the Platform. These providers act under their own privacy policies once enabled.

When you generate a document or use the AI Writer, the form values, prompts and any text you upload for extraction are sent to AI providers that process them to produce the output:

• Anthropic (Claude) — privacy policy.
• OpenAI — privacy policy.

Anything you type into those fields, including personal details, may be included, so do not enter information you are not comfortable sending to these providers. We use their API products; each provider's own terms govern how it handles API data.

Paid plans and consultations are paid through bKash or Nagad, either through the gateway or by a transfer for which you submit the transaction ID for manual verification. We receive and store the transaction reference, amount, status and order ID. Gateway providers handle your wallet credentials under their own policies (bKash, Nagad).

We do not sell your personal data. It is shared with:

• The lawyer you book — your name and booking details so they can prepare.
• Infrastructure and service providers — hosting (Vercel), our managed PostgreSQL database provider, email delivery (SMTP provider), video calls (Jitsi Meet, meet.jit.si), Google or Facebook if you use them to sign in, and the payment providers above.
• AI providers — Anthropic and OpenAI, as described in section 5.
• Analytics providers — Google, Meta and PostHog, only if you accept analytics.
• Authorities — where required by law or to protect rights and prevent fraud.

Apart from the document trash described below, we have no automatic purge jobs today, so we keep data as follows:

• Account data and documents — kept until you delete them or ask us to delete your account.
• Deleted documents (trash) — a document you delete from your dashboard moves to a trash for 30 days, during which you can restore it, and is then permanently removed. You can also delete it permanently from the trash at any time. Copies in backups held by our database provider may remain until those backups expire (see below).
• Visitor sessions and event logs — kept until deletion on request.
• Payment and consultation records — kept as long as needed for accounting, dispute handling and legal obligations.
• Backups and provider logs — held by our hosting and database providers according to their own schedules.

To request deletion, email support@dolilai.com from your registered address.

• The site is served over HTTPS.
• Passwords are stored as salted hashes (bcrypt); we cannot read them.
• Database access is limited to our application and administrators; administrator access is role-based.
• Authorised administrators may open users’ documents only for support, abuse prevention and legal compliance, and each such access is logged.
• We use rate limiting, input validation and parameterized queries.
• We do not add separate field-level encryption to document content, so avoid entering identifiers such as NID numbers unless the document needs them.

No system is perfectly secure. If you think your account is compromised, contact support@dolilai.com immediately.

• Access and correction — ask for a copy of, or a correction to, your personal data.
• Deletion — delete documents yourself, or ask us to delete your account and related records (subject to legal retention needs).
• Analytics — accept, decline or change your choice via “Cookie preferences”.
• Portability — download your documents as PDF or DOCX.
• Download your data — from My details (Privacy & data) you can download your profile, documents, saved people, payment history, consultations and review requests as a JSON file.
• Delete your account — from the same page you can delete your account yourself. This erases your documents and versions, saved people, review requests, activity logs and waitlist entries, and removes your name, email, password and photo. Payment and consultation records are kept for accounting in anonymised form, no longer linked to your name or email. Admin accounts and accounts with an open consultation or pending payment must contact support instead.

Email support@dolilai.com from your registered address. We aim to respond within 30 days.

Our providers (including Vercel, Anthropic, OpenAI, Google, Meta, PostHog and Jitsi) may process data on servers outside Bangladesh, including in the United States and the European Union. By using the Platform you understand your data may be transferred there.

The Platform is not intended for people under 18. We do not knowingly collect data from minors; contact us if you believe a minor has registered.

We may update this policy. The “Last updated” date above shows the current version; we will make material changes visible on the Platform.

• Email: support@dolilai.com
• Phone: +880 1865-820568
• Location: Dhaka, Bangladesh