Privacy Policy
Last updated: October 19, 2026
1. Who we are (data controller)
Avocapp ("we") is the data controller for the personal data collected through the Avocapp website and platform. Our offices: DMCC AI Centre, Uptown Tower Level 12, Dubai, UAE, and Technopark Tangier, T204, Morocco. You can reach us at any time at contact@avocapp.com. This policy explains how we handle personal data in line with the GDPR and with data protection laws applicable in the MENA region, including Moroccan Law 09-08 and the UAE and Saudi PDPL.
2. Data we collect
Account and firm data: full name, email address, phone number, password, firm name and size, address, city and country, and your professional card or advocate licence if you provide it. Case and client data: information about your clients and matters that your law firm enters into the platform (identities, contact details, case details, documents). Your firm remains responsible for this data; we process it only on its instructions, acting as a data processor. Usage and device data: pages visited, features used, device and browser type, IP address and timestamps, used to keep the service secure and operational. Payment data: the plan you choose and billing information; transactions are handled by our payment providers and we never store full card numbers. Identity verification data: when verification is triggered, identity documents are sent directly to our verification partner (see "Sub-processors").
3. Purposes and legal bases
We process your data to provide and administer the service (performance of a contract); to comply with anti-money-laundering and other legal obligations applicable to legal professions (legal obligation), including identity verification and record keeping; to keep the platform secure, prevent abuse and improve the product (legitimate interest in security and usage analysis); and, where required, on the basis of your consent, for example for optional communications. We do not use your data for advertising and we never sell it.
4. Sub-processors
We use carefully selected sub-processors bound by data processing agreements: Sumsub, for identity verification (London, UK; SOC 2 Type II and ISO 27001 certified) — identity documents and verification photos are sent directly to Sumsub over an encrypted connection and are never stored on Avocapp servers; cloud hosting providers (AWS, United Kingdom) that host the platform and store data on our behalf under strict data processing agreements; and payment providers for billing. An up-to-date list of our sub-processors is available on request.
5. Data retention
Account data is kept while your account is active, then deleted or anonymized within 30 days after closure, unless a legal obligation requires otherwise. Case and client data is kept for as long as your firm uses the service and is deleted after account closure, subject to retention periods imposed by law (notably anti-money-laundering rules). Usage logs kept for security are erased after 12 months.
6. Security
All data is encrypted at rest and in transit with AES-256, the banking standard, and backed up daily. Access to data is restricted to authorized staff under strict access controls. No system is perfectly secure: if a security incident affects your data, we will notify you and report it to the authorities as required by law.
7. International transfers
Your data is hosted on secure cloud infrastructure (AWS) in the United Kingdom. Where processing outside this infrastructure is necessary — for example to Sumsub in the United Kingdom — it is carried out under appropriate safeguards such as standard contractual clauses or an adequacy decision, in accordance with the GDPR.
8. Your rights
Under the GDPR you have the right to access, rectify, erase and port your data, and to restrict or object to its processing. To exercise these rights, write to us at contact@avocapp.com; we respond within 30 days. If you believe your data is being processed unlawfully, you have the right to lodge a complaint with a supervisory authority — in particular the authority of your country of residence in the European Union, the UAE Data Office, or the CNDP in Morocco.
9. Cookies and analytics
This website uses the Meta Pixel (Facebook), a small code snippet provided by Meta Platforms that measures the effectiveness of our advertising and how visitors use our pages. When you load a page, Meta sets cookies such as _fbp and _fbc on your browser and may receive your IP address, browser details, and the pages you visit — including a one-time signal when you complete a free-trial registration. Meta processes this data under its own privacy policy to give us aggregated, anonymized analytics and ad reporting. If you prefer not to be tracked, you can block or delete these cookies in your browser settings, or opt out of Meta's interest-based advertising at www.facebook.com/ads/preferences. A single functional cookie, avocapp-region, is also stored to remember your selected region; it contains no personal data and can be removed through your browser settings (your region preference will simply be reset).
10. Changes to this policy
We may update this policy from time to time. If we make a material change, we will let you know by email or through an in-app notice before it takes effect. The date of the last update appears at the top of this page.
11. Contact
For any question about this policy or to exercise your rights, contact us at contact@avocapp.com.