This notice is also published in Bahasa Malaysia. If the two versions differ, the English version prevails.

Last Updated 23 September 2026

Who This Notice Is From

VYROX AI Sdn Bhd, Level 16, The Vertical Business Suite Tower A, Bangsar South, 59200 Kuala Lumpur. LawServa is a product of that company, and "we" in this notice means that company. Questions about this notice, and every request under the Act, go to Patrick on WhatsApp, +60 19-688 3338.

Two Roles, and Which One Applies to You

For this website, and for the account details of the people who sign in to LawServa, we are the data controller: we decide why and how that data is processed.

For everything a law firm keeps in LawServa about its own clients, matters and staff, the firm is the data controller and we are its data processor. We process that data to run the software for the firm, on the firm's instructions, and for no purpose of our own. If you are a client of a firm that uses LawServa, the firm's own privacy notice is the one that governs you, and your requests go to the firm.

This Website

There is no contact form, no newsletter sign up, no account, and no advertising or analytics tracker on lawserva.com. We do not set cookies for tracking, profiling or advertising.

This site stores nothing at all on your device. There is no cookie, no local storage and no saved preference of any kind, so there is nothing here for you to clear and nothing for us to read on a later visit.

The interactive demonstrations on this site run entirely in your browser. Everything you type into them stays there. Nothing from a demo is transmitted to us or to anybody else, and the data in them is invented.

Our web server keeps ordinary request logs, which include IP addresses, for security and diagnostics. They are not used to build a profile of you.

If you press a WhatsApp button, you leave this site and your message is carried by WhatsApp under its own terms and privacy policy, which we do not control. We keep the conversation so we can answer you and remember what was discussed.

What the Software Holds

About the people who sign in: name, email address, the firm and role they hold, the permissions they have been given, and a history of their sign-ins and of what they did, kept as an audit trail. The same applies to a firm's client who is invited to the client portal.

About a firm's clients and the other people on its files, whatever the firm records: names, identity card, passport and company registration numbers, addresses and contact details, photographs of identity documents, due diligence and screening records, the matters themselves, documents, letters and email sent and received through the firm's LawServa address, time records, bills, receipts and the client account. Some of this can be sensitive personal data under the Act, and a suspicious transaction report is held under the stricter rules of the anti money laundering legislation.

Why It Is Processed

To run the software for the firm: to store its records, show them to the people the firm has given access, compute what it is asked to compute, send the email it sends, keep the audit trail the profession requires, and answer the AI questions its people choose to ask. For the people who sign in, also to secure their account and to support the firm when it asks us to. We do not sell personal data, do not use it for marketing, and do not use a firm's data to train any model.

Who Receives It, and Where

Records are kept on the LawServa server, which also sends and receives the firm's LawServa email. The server is hosted by The Constant Company, LLC (Vultr) in a data centre in Singapore, which has the physical machine in its care. Firm records are therefore stored outside Malaysia.

AI features. When a person presses an AI control, or asks the assistant a question, the text that feature needs is sent to one AI model provider. The provider is chosen for the whole platform by a LawServa platform administrator, not by the firm, and one is live at a time. The providers the software can use are: Anthropic (Claude), United States, reached through LawServa's bridge; OpenAI (ChatGPT), United States, reached through LawServa's bridge; DeepSeek (DeepSeek), China, reached directly from the LawServa server, if enabled; Alibaba Cloud (Qwen), China, reached directly from the LawServa server, through its international endpoint, if enabled; Moonshot AI (Kimi), China, reached directly from the LawServa server, if enabled; Z.AI (GLM), China, reached directly from the LawServa server, if enabled. The four in China are used only if a platform administrator has put a key on file and made one of them live. Ask us which provider is live today and we will tell you.

Our bridge. For Claude and ChatGPT, the request travels from the LawServa server to a program we run on our own operator machine, which passes it to the provider's own tool and returns the answer. That machine therefore receives the text of each request in transit. It is not where firm records are kept, but the provider's own tool on it may keep a local record of the session.

Other recipients, only when the firm uses the feature: Billplz, a Malaysian payment gateway, if the firm asks a client to pay online; the Inland Revenue Board of Malaysia through MyInvois, when a person at the firm submits an e-Invoice; and whoever the firm itself emails from LawServa.

Our own people. A LawServa support engineer can open a firm's workspace in order to support it. We do not look at a firm's records for any other reason.

Transfers Outside Malaysia

Storing firm records on the LawServa server in Singapore is a transfer of the personal data in them outside Malaysia. So is sending text to an AI provider in the United States or in China. Section 129 of the Act, as amended in 2024, governs both. We make the storage transfer because the firm uses LawServa, and the AI transfer on the firm's instructions because the firm has AI switched on. We do not claim that any of those countries has been assessed as having a law substantially similar to the Act. A firm should satisfy itself that it has a basis under section 129 for these transfers, such as its client's consent. For the AI transfer, a firm that is not satisfied should switch the AI off, which it can do at any time.

Your Choices

AI is on for a firm until its subscription owner switches it off. The owner can switch it off for the whole practice, or feature by feature, on the AI Lawyers screen of the Owner Console. While it is off, nothing is sent to any AI provider for that firm, and every screen, register and figure still works. Online payment, the client portal and e-Invoice submission are each used only if the firm chooses to use them.

Nothing on this website requires you to give us personal data. A person who signs in to LawServa has to have a name and an email address on their account, because the software cannot give them a secure sign-in without them.

Retention

A law firm's own retention obligations under the Solicitors' Account Rules 1990 and the anti money laundering legislation run to at least six years. LawServa is built to honour that: there is deliberately no facility to delete a ledger entry, a receipt, an audit record or a filed document, and removal takes a document off the working file while keeping it.

An AI request is not kept as a record. LawServa deletes the assembled request, and any image sent with it, as soon as the answer is read, and clears any request left unfinished within minutes. What is kept is the result a person chose to use, and the questions and answers in the assistant's own history, in the firm's records. What a provider keeps of a request is governed by that provider's own terms, which we do not control.

If a firm ends its subscription, it can export everything at any time and at no charge. We return or delete what remains on the firm's written instruction, subject to anything we are separately required to keep.

Your Rights and How to Use Them

Under the Act you may ask for access to the personal data we hold about you and a copy of it, ask us to correct it if it is inaccurate, incomplete, misleading or out of date, withdraw a consent you gave, ask us to stop or limit processing that is causing you damage or distress, and ask for your data to be transmitted to another data controller.

If you are a client of a law firm that uses LawServa, make the request to the firm, because the firm is the data controller; we will help the firm answer it. If you are a person who signs in to LawServa, or you contacted us directly, message Patrick on +60 19-688 3338 in writing, say who you are and what you are asking for, and we will answer within twenty one days, as the Act requires, or tell you within that time why we cannot.

Security and Breach Notification

Every connection to LawServa is over HTTPS. The other measures protecting the software are described in the section on where the AI sends what it reads and the data handling section.

If a personal data breach affects a firm's data, we will tell the firm as soon as we know, not when we have finished investigating, so that the firm, as data controller, can notify the Commissioner within seventy two hours and the affected people within seven days, as the Act as amended requires. Where we are the data controller, we will make those notifications ourselves.

Changes

If this notice changes materially we will update the date at the top and tell existing firms directly rather than relying on you to re-read the page.