Privacy Policy

1. Introduction

Xyra Systems (BD) (“we”, “us”, or “our”) operates Mamla.Guru (https://mamla.guru), a cloud-based legal case management platform for law firms in Bangladesh (“the Service”). This Privacy Policy explains how we collect, use, store, and protect the personal data you provide when using the Service.

By registering for or using Mamla.Guru, you agree to the collection and use of information in accordance with this policy. If you do not agree, please discontinue use of the Service.

2. Information We Collect

We collect the following categories of information:

• Account Information: Name, email address, phone number, bar council registration number, designation, and profile photograph provided during registration or profile setup.
• Firm Information: Firm name, address, contact details, and firm branding assets (logo) provided during onboarding or firm settings.
• Case and Legal Data: Case files, court proceeding records, client details, lawyer and judge information, activities, documents, evidence, and any other legal data entered into the platform by your firm.
• Billing and Payment Records: Subscription plan selections, invoice records, and payment transaction references. We do not store full card or mobile banking account numbers.
• Calendar Data: Calendar events, activity schedules, court proceeding dates, and RSVP responses stored within the platform.
• Google Calendar Integration (Optional): If you choose to connect your Google Calendar, we store encrypted OAuth access tokens and refresh tokens to manage calendar events on your behalf. We store only the tokens and your connected Google account email address. We do not read or import your existing Google Calendar events.
• Usage and Log Data: IP addresses, browser type, pages visited, and timestamped actions for security monitoring and service improvement.

3. How We Use Your Information

We use the collected information to:

• Provide, operate, and maintain the Mamla.Guru Service
• Process subscriptions and generate billing invoices
• Enforce multi-tenant data isolation (each law firm's data is kept strictly separate)
• Enable the AI-powered drafting, OCR text extraction, and calendar features
• Sync calendar events to your connected Google Calendar account on your behalf (only if you have enabled Google Calendar integration)
• Monitor for security incidents and prevent unauthorised access
• Respond to support requests and improve the Service
• Comply with applicable laws and regulations of Bangladesh

We do not use your legal case data to train machine learning models or share it with any third party for marketing or research purposes.

4. Data Sharing

We do not sell, rent, or trade your personal data. We share data only in the following limited circumstances:

• Google Calendar API: When you connect your Google Calendar, we transmit event data (title, date/time, description) to Google's servers on your behalf, solely to create, update, or delete calendar entries. This is governed by Google's Privacy Policy.
• AI Providers: When you use AI drafting or OCR features, document text or images may be sent to third-party AI model providers (e.g., Anthropic, OpenRouter) for processing. No personally identifiable firm or client metadata is transmitted beyond what is necessary for the request.
• Legal Obligations: We may disclose information if required by law, court order, or competent authority under the laws of Bangladesh.
• Service Continuity: In the event of a merger, acquisition, or sale of assets, user data may be transferred to a successor entity under equivalent privacy protections.

5. Data Storage and Security

All data is stored on servers located in Bangladesh or on infrastructure with equivalent data protection guarantees. We implement the following security measures:

• Encryption of sensitive data at rest (OAuth tokens, API keys)
• HTTPS/TLS encryption for all data in transit
• Row-level security (RLS) policies in the database to enforce tenant isolation
• Hashed password storage — plaintext passwords are never stored
• Role-based access controls within firms

Despite these measures, no internet transmission or electronic storage is 100% secure. We cannot guarantee absolute security but will notify affected users of any material data breach as required by applicable law.

6. Data Retention

We retain your data for as long as your account remains active. Upon account termination or cancellation of your subscription, we retain data for a further period of 12 months to allow for account recovery or dispute resolution, after which it is permanently deleted.

You may request immediate deletion of your data by contacting us at support@mamla.guru. Note that certain billing and invoice records may be retained longer to comply with financial record-keeping requirements under Bangladesh law.

7. Cookies

Mamla.Guru uses cookies and local storage only for session authentication and user preferences (such as language selection). We do not use tracking or advertising cookies. You may disable cookies in your browser settings, though this will prevent login and use of the Service.

8. Your Rights

You have the right to:

• Access the personal data we hold about you
• Request correction of inaccurate data
• Request deletion of your account and associated personal data
• Disconnect your Google Calendar integration at any time (this revokes our token access)
• Export your firm's case data in the formats available within the Service

To exercise any of these rights, contact us at support@mamla.guru.

9. Children's Privacy

Mamla.Guru is designed for professional use by registered legal practitioners and law firms. We do not knowingly collect personal data from individuals under the age of 18.

10. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated via email or a prominent notice within the platform. Continued use of the Service after such notice constitutes acceptance of the updated policy.

11. Contact Us

For questions, concerns, or requests regarding this Privacy Policy or your personal data, please contact: