Privacy notice

This notice explains how OrdoMetric processes personal information. It is written for three groups of people: the people who work at a law firm that uses OrdoMetric (users), the people whose information appears in that firm's case files (clients, parties and other data subjects), and visitors to this website.

1. Who is responsible

OrdoMetric [verify legal entity name] provides case-management software to law firms. For the case files a firm keeps in OrdoMetric, the firm is the controller: it decides what to record, why and for how long, and it answers to its clients for it. OrdoMetric is the firm's processor: it stores and processes that information only to run the service the firm has configured, under the Data processing agreement.

Nepal's law does not yet distinguish controller from processor. OrdoMetric adopts these roles contractually, in the style of Article 28 of the GDPR, so that the firm's obligations flow down to us in writing [verify applicability of the Act's personal-information chapter to private bodies with a Nepali practitioner].

For user accounts (sign-in, sessions, security notifications) and for this website, OrdoMetric decides the purposes itself and is the responsible party.

2. What we process

Category	Examples	Source
Account data	Name, work email, phone number, multi-factor credentials (authenticator app or passkey), sign-in history, IP address, session identifiers	The user and the firm's administrators
Case-file data	Clients with their contact details and consent records; parties, counsel, witnesses and judges named on a case; notes, comments, documents and their extracted text; hearings, deadlines and stage history	Entered, uploaded or imported by the firm's users
Client messages	The stage of a case, its next steps and the firm's contact details, sent by email (and by SMS where a firm enables it); delivery status and replies	Generated when a user sends a client update
Audit and security logs	Who did what, when, from which address; document reads; sign-in and MFA events; AI calls	Generated by the service
Website data	Edge server logs (connection metadata) and error monitoring; no analytics or advertising cookies are set	Visiting this site

Case files routinely contain the categories of personal information that section 2 of the Individual Privacy Act, 2075 (2018) enumerates: criminal background, health, caste and ethnicity, religion, citizenship and identity documents, bank details and correspondence [verify s. 2 definition]. A firm using OrdoMetric processes them in the course of legal practice; OrdoMetric processes them only on the firm's behalf. Citizenship numbers are stored encrypted and masked in lists and exports, and criminal case types are treated as sensitive metadata.

3. Why we process it

• To provide the service to the firm: keeping its cases, court dates, documents and client updates, and showing each user only what the firm has allowed them to see.
• Security and accountability: authenticating users, detecting misuse, keeping the audit log the firm can export, and supporting the firm's own record-keeping duties.
• Communications the firm sends: delivering the client updates a user has chosen to send; their content is limited to the case stage, the next steps and the firm's contact details.
• Support and service notices: answering the firm's requests and telling its Owners about security incidents, sub-processor changes and changes to these documents.
• Legal obligations: responding to lawful requests and preserving evidence during an incident.

We do not use case-file data for advertising, do not sell it, do not build profiles from it and do not use it to train AI models.

4. Legal bases

For the firm's own clients, the basis is the client's informed consent captured by the firm (its engagement letter and the consent record kept on the client's file in OrdoMetric) together with the performance of the firm's mandate [verify with a Nepali practitioner].

For opposing parties, their counsel, witnesses, judges and other people named on a case, the basis is the necessity of the legal proceedings themselves, the public court record, or a legal obligation of the firm; these people do not consent and cannot be asked to [verify exception for information required by law or court]. OrdoMetric records this basis on every party record, keeps non-client data to the minimum (name, role, contact, counsel) and never uses it for messaging or analytics.

For users, the basis is the service agreement between the firm and OrdoMetric and, for security logs, our legitimate need to protect the service.

These statements are made under the Individual Privacy Act, 2075 [verify sections] and the Individual Privacy Regulation, 2077 [verify], and having regard to the confidentiality duty under the Nepal Bar Council Act, 2050 and the Legal Practitioners' Code of Conduct, 2051 [verify rule] and to privilege under the Evidence Act, 2031 [verify section]. Every statement on this page that carries a review marker is a draft until a Nepali practitioner confirms it [verify with a Nepali practitioner].

5. Where the information is kept

On the pilot, the database, documents and backups are hosted by Railway in Singapore (asia-southeast1) [verify Railway region list]. Cloudflare terminates TLS at its edge and caches only static assets, so request content is visible to it in transit. The off-site copy of the encrypted nightly database backup is stored in Cloudflare R2 object storage, whose location Cloudflare assigns automatically [verify R2 region auto placement]. Firms that require hosting in India can be placed, on request and once that profile is activated for them, on our Google Cloud profile in Mumbai (asia-south1), with backups and a second copy of documents in Delhi (asia-south2).

No provider offers a region in Nepal. The Act contains no express rule on transferring personal information abroad [verify]; hosting abroad is treated as a use of the information under the client's informed consent in the firm's engagement letter, not as a disclosure [verify with a Nepali practitioner]. The Data processing agreement names the regions contractually, and a change of region is notified to the firm's Owners at least 30 days in advance [verify DPA notice period].

6. Who else processes it

The providers that process firm data on OrdoMetric's behalf, with their purpose and region, are listed in the Sub-processor register, which this notice incorporates by reference. Additions are announced to firm Owners by email at least 30 days before a new provider processes firm data [verify DPA notice period].

Some processors are chosen by the firm rather than by OrdoMetric: a different AI provider, or the firm's own Dropbox or Google Drive account as the home of its documents. They are listed in the register in their own section, and a firm that selects one must name it in its own notice to its clients.

7. AI processing

The AI assistant is off by default. Only an Owner can enable it, after reading a sub-processor notice in Settings. When it is enabled:

• For the assistant, summaries, drafts and key-date extraction, OrdoMetric sends the platform's AI provider, Anthropic, in the United States, the text the asking user is allowed to read: passages of documents and notes returned by permission-checked tools, and the case facts the user can see. Anthropic's commercial terms exclude training on the firm's inputs. A zero-data-retention arrangement is requested in writing; until it is confirmed, the provider's standard API retention applies and is disclosed on the consent screen [verify zero-data-retention availability for the selected models].
• For OCR of scanned documents, the document file itself is uploaded once to Anthropic's Files API and referenced by an identifier that OrdoMetric records so that it can delete the file when the document is excluded or purged [verify Files API retention]. A firm that has selected another AI provider sends rendered page images to that provider instead.
• Document embeddings for search are computed by Google Cloud (Vertex AI) in Mumbai (asia-south1) by default; a firm may select another embedding provider, which its own notice then names.
• There is no automated removal of personal information from text before it is sent. The controls are: the firm-level switch, which only an Owner can turn on; exclusion of any case, note or client (a client's recorded refusal excludes all of that client's cases, and excluding something deletes the derived text, vectors and uploaded files already produced); tool results limited to what the asking user may read, with citizenship numbers stored encrypted and returned only when the user holds write access to that section of the case; a usage record that keeps only a short excerpt of each prompt, redacted after 90 days by default (configurable by the firm); and an audit entry for every call.
• The assistant can only read what the asking user can read; anything client-facing or state-changing it proposes is a draft that a person approves.
• A firm may select another provider (OpenAI, Azure OpenAI, AWS Bedrock or Google Vertex AI) for the assistant, OCR and, where offered, embeddings, optionally with its own API key. That provider then processes the firm's text and page images under its own terms and in the region the firm configures, and the firm's own notice must name it; with a firm-held key, the firm's own vendor agreement governs and OrdoMetric records only the provider and region.

The firm remains responsible for informing its clients, in its engagement letter, about electronic storage, processors and AI-assisted processing; OrdoMetric provides a suggested clause on request [verify with a Nepali practitioner].

8. The Claude connector

A firm may allow its users to reach their cases from Claude (claude.ai or Claude Code) through OrdoMetric's connector. In that case the user's questions and OrdoMetric's answers flow through the user's own Anthropic account, under that account's terms, outside OrdoMetric's processor chain and the Data processing agreement. The connector is off by default, an Owner enables it, excluded cases stay invisible to it, every response is watermarked with the case reference, and every tool call is logged.

9. Client messages

When a user sends a client update, the message contains the stage of the case, the next steps and the firm's contact details, and nothing else: never notes, never documents, never the details of other parties. SMS is off during the pilot; where a firm enables it later, messages default to a minimal form (firm name, case reference, "an update is available, call us") because handsets are shared and SMS is unencrypted.

10. How long we keep it

• Case files: as long as the firm's retention policy says. The default is 7 years from the closing of a case [verify against Nepali tax and Bar record-keeping expectations]; the firm can shorten or lengthen it per record class and place individual cases under legal hold.
• Deleted items: a deleted case, document, note or client can be restored for 30 days, after which it is purged together with its derived text, vectors and thumbnails.
• Audit log: 400 days by default as the security record; a firm may lengthen it in its retention policy.
• AI usage records: the excerpt of each prompt is redacted after 90 days by default (configurable by the firm); the metadata stays with the audit log.
• Client messages: per the firm's retention policy for client messages.
• Accounts: for the life of the firm's subscription; anonymized when the firm leaves.

When a firm ends its subscription it has a 30-day window to export everything (documents plus structured data). Then the firm's encryption key is destroyed, its rows are deleted and its user records anonymized. A deletion certificate states the date on which the last backup containing the firm's data ages out [verify Railway backup retention]. What this means for documents kept in a firm's own Dropbox or Google Drive is described in the Data processing agreement.

11. Your rights and how to exercise them

People whose information is in a case file may ask for access to it, for its correction and, where the law allows, for its deletion [verify sections]. Because the firm is the controller, please address the request to the firm, which answers it through its own channels. OrdoMetric gives the firm what it needs to answer: export of a client's or a case's records, correction of any record, and deletion or anonymization, and it assists the firm within the timelines of the Data processing agreement. If a request reaches OrdoMetric directly, we forward it to the firm without undue delay [verify service level] and do not answer on the firm's behalf.

Users can see and change their own profile, sessions and connected applications in Settings.

12. Security

How OrdoMetric protects information (per-firm encryption keys, row-level tenant isolation, mandatory multi-factor authentication for administrators, an exportable audit log, encrypted backups and no standing staff access) is described on the Security page. The controls are aligned with OWASP ASVS Level 2 and ISO 27001:2022; OrdoMetric does not claim certification.

If a personal-data breach affects a firm, OrdoMetric notifies that firm's Owners within 72 hours of becoming aware of it, with the scope known at that time and the actions taken, and supports the firm in informing its clients. No Nepali statute currently sets a deadline [verify]; 72 hours is our contractual commitment under the Data processing agreement.

13. This website

This site sets no analytics or advertising cookies. Cloudflare, which serves it, keeps connection metadata in its edge logs. Error and performance monitoring of the site uses Sentry (EU region) with the collection of personal information switched off and without cookies. Signed-in use of the application (a separate host) relies on strictly necessary session cookies only.

14. Changes and contact

Changes to this notice are versioned and dated in the header above; firm Owners are told of material changes at least 30 days before they take effect [verify DPA notice period]. Questions and privacy requests: hello@ordometric.hamropanchanga.com [verify contact email], OrdoMetric, Kathmandu, Nepal [verify legal entity and postal address].