Privacy Policy

Last updated 1 October 2026

This is a draft template written for an early beta, not a document a lawyer has reviewed. It aims to describe current practice accurately rather than to make legal claims — it should be replaced with counsel-reviewed terms (and checked against any data-protection law that applies to you, such as Pakistan's Personal Data Protection framework) before a real launch.

What we collect

We don't use analytics scripts or ad trackers. Most visitors to this platform never create an account and we don't collect a persistent identity for them. The one exception is Property Vakils (verified lawyers listed in our directory): registering as a Vakil creates a real account (email and password) and we set a session cookie so you stay signed in between visits — see “Property Vakils accounts” below for what that involves specifically. We also set a session cookie for our own internal admin tool, which only staff operating this platform can sign into. Beyond those two cases, what we collect is tied to specific actions you take:

• Reports — if you report a scheme, listing, or Property Vakil, we store the detail text you write and, if you choose to provide it, a contact method, along with what the report is about and when it was submitted.
• Feedback — if you submit product feedback, we store the message, an optional contact method, and which page you were on when you submitted it.
• Waitlist signups — if you join the waitlist, we store your email and whatever optional name/city/interest you provide.
• Uploaded documents (“Analyze my property”) — files you upload (PDFs or images of property documents) are saved to disk and processed to extract fields such as plot number, scheme name, and dates. Extracted CNIC / ID numbers are recorded only as present-or-not, never the number itself.
• Basic server logs — like most web servers, requests may generate operational log lines (timestamps, error messages, request paths) used only for keeping the service running and debugging failures.

Property Vakils accounts

Registering as a Property Vakil is the one place on this platform that creates a real account. We store your email, a securely hashed password (we never store or can recover your actual password), and the professional/identity information the application asks for — including your CNIC number and uploaded verification documents (e.g. Bar Council certificate), which are only ever visible to you and to our internal verification team, never published or shown to other users. Once verified, the public fields you've chosen to make visible (name, professional details, and your email/phone only if you opt in) appear on your public directory profile; everything else stays private. We send account-lifecycle emails (application received, additional information requested, verified, rejected, suspended/unpublished, password reset) through Resend, a third-party email delivery service, when that integration is configured on this deployment.

How uploaded documents are processed

Text-based PDFs are read locally on our server — their content is not sent to any outside AI service. Image uploads (JPG, PNG, WEBP, GIF) are sent to Anthropic's Claude API for field extraction, because reading a photo of a document requires a vision-capable model we don't run ourselves. That means an uploaded image leaves our server and is processed by Anthropic under Anthropic's own privacy policy. If no AI key is configured on a given deployment, image extraction is simply unavailable rather than silently sent anywhere.

Storage and security

Reports, feedback, account, and extracted document data are stored in a SQLite-compatible database — depending on how this instance is deployed, that's either a single file on the server or a hosted database with our infrastructure provider (Turso). Uploaded document and photo files are stored on disk, never in the database itself and never served back publicly except a verified Vakil's own profile photo. Nothing here is encrypted at rest beyond what our infrastructure provider does by default today — this is a known gap for a beta product, and you should not upload documents containing information more sensitive than what's reasonably needed to check a property or verify a Property Vakil application (for example, avoid uploading a document if it contains information unrelated to that purpose). Access to the server and its files is limited to the people operating this platform. Where we use a hosted database provider, that provider maintains its own backups/durability for us; where we don't, this deployment currently has no separate backup process of its own, so durability depends entirely on the underlying server's disk.

Retention

We don't currently run automatic deletion on a fixed schedule. Reports and feedback are kept so we can act on them; uploaded documents and their extracted fields are kept so you can return to an analysis. If you'd like something you submitted deleted, contact us (see below) and we'll remove it.

Who can see what you submit

Reports and feedback are visible to the small team operating this platform through an internal admin view, not published publicly. We don't sell or share your submissions with third parties, other than the Anthropic API call described above for image extraction, and any hosting provider that necessarily has access to the server it runs on.

Your choices

Contact details on reports and feedback are optional — you can submit either without providing one. You can also ask us to delete anything you've submitted at any time.

Changes to this policy

As this beta evolves — for example, if we add encryption at rest, user accounts, or a different AI provider — we'll update this page and its date.

Contact

Questions, or a request to delete your data, can be sent through the feedback form.