How we collect and use professional information, manage publicly sourced listings, process accounts and inquiries, and handle data and privacy requests.
Who we are; scope and contact
This Privacy Policy explains how ZSany LLC processes personal information associated with IranianLawyer.com, including public professional profiles, accounts, billing, attorney inquiry tools, and business communications. Independent attorneys may separately determine how they process information received directly from visitors. For privacy questions, access requests, or corrections, use our contact form. This Policy does not govern independent law firms' websites or legal services. Additional regional notices will be provided where required by law.
The information we collect
The categories below depend on how a person uses the Site:
- Professional listing data: first and last names in English and Farsi, firm name where provided, country, state, city, office address where provided, work telephone, mobile number, WhatsApp, email, professional website, Google Maps links, LinkedIn, Instagram, TikTok, X/Twitter, Facebook, YouTube and other public professional links, languages, services/practice areas, photographs, and English/Farsi biographies.
- Account and verification data: login email, account identifiers, password hashes or authentication-related records managed by the website system, activation/reset events, profile claim status, account authorization confirmations, verification decisions, edit histories and account support communications.
- Payment and subscriptions: plan, geographic selection, subscription and renewal dates, invoices, transaction IDs, payment status, billing contact information, tax data and limited card metadata supplied by Stripe; full card details are normally processed by Stripe rather than stored by us.
- Visitor inquiries: information a visitor enters into an optional contact form, including contact details, selected lawyer, message content, delivery metadata, and related support information, to the extent the form actually collects or stores these details.
- Website usage and device information: IP address, browser/device information, approximate location inferred from IP, visited pages, referrer, timestamps, security and event logs, cookies, tags and identifiers produced by website tools.
- Business correspondence: emails about listing invitations, consent/approval, corrections, opt-outs, support, account administration, and sponsorship inquiries.
We do not ask visitors to provide sensitive legal-case material through the general Directory. If users nevertheless submit it, we may need to process it to transmit, secure, investigate, or remove the submission.
Sources and professional profiles created before claiming
We obtain information directly from attorneys, their authorized representatives, customers and visitors; from their public professional websites; from law firm and bar/regulator websites; and from other publicly accessible business directories and professional sources. We may create and publish an unclaimed professional profile before the listed attorney activates an account or affirmatively approves the profile, where legally permissible. An unclaimed listing does not mean that the attorney supplied the information or endorses the Site.
Public accessibility is not a blanket exemption from privacy, copyright, or professional advertising laws. We evaluate lawful bases and applicable restrictions, and we provide a channel for corrections, objections, claims, and removal requests. Where feasible, we encourage attorney approval before publishing a new or expanded profile, particularly where local law or sensitivity warrants it.
Public visibility and search-engine indexing
Professional profiles may display sponsored advertising labels or free-listing indicators. These indicate advertising status, not independently verified credentials or professional quality. See the packages page for current offerings.
Removing information from our Site cannot guarantee removal of existing third-party caches or reproductions. Please do not submit home addresses, personal cellphone numbers you do not wish made public, private family information, confidential client content, or documents containing sensitive details for publication.
Account activation, email access and verification
Professional accounts may be created directly by a lawyer or an authorized representative, or by our team using a professional email obtained from a law-firm website, another professional source, or the lawyer. A password-reset or activation email allows the person with access to the associated inbox to set a password and access the client panel. We process the email address, account identifiers, activation/reset events, and information reasonably necessary to investigate unauthorized access or disputed control of a listing.
A blue checkmark indicates that a profile-management account has been activated and that someone with access to the associated account can manage the listing, potentially including the lawyer or a person acting for the lawyer's firm. The badge does not independently verify the lawyer's identity, authorization of every account user, professional licensing, qualifications, language fluency, or quality. The profile owner or authorized representative may request corrections or report unauthorized access through the contact form.
Edits, approval and monitoring
Some attorney profiles are publicly visible before they are claimed. New-account edits may be placed into a pending review queue, whereas updates to established published accounts may be displayed without advance manual review. We process submitted changes, associated account records, and reasonably necessary support or dispute information to administer profile editing, resolve reported inaccuracies, and protect the Directory.
We may investigate, correct, remove, or revert disputed content, but do not independently authenticate or continuously monitor every update. Some system and security logs are retained for limited periods described under How long we retain information.
Purposes for using information
We process information to build, display and maintain the Directory; enable lawyer searches and profile claims; administer accounts and verification checks; publish authorized profile updates; deliver communications to attorneys chosen by visitors; provide paid sponsored listings and related marketing services; process invoices and subscriptions; handle inquiries, corrections and disputes; detect fraud and abuse; measure and improve performance; secure the Site; send permitted invitations, newsletters and promotional messages; fulfill legal obligations; and investigate or respond to lawful requests.
We do not use visitor inquiry messages to provide legal advice. The existence of a selected practice area or attorney inquiry is not evidence that any particular individual has a medical, legal, financial, immigration, or other sensitive status.
Legal bases where European/UK rules apply
Where the EU GDPR or UK GDPR applies, our legal basis depends on the processing: contractual necessity for accepted accounts, orders and services; legitimate interests for accurate, limited business directory information, customer support, security and fraud prevention, after balancing individual rights; legal obligations for applicable tax, regulatory and records requirements; and consent for processing requiring it, such as relevant nonessential tracking or some direct marketing. Other bases apply only when lawful and appropriate.
Individuals may object to processing based on legitimate interests or withdraw consent where applicable. A claim of legitimate interests requires a contextual assessment and does not itself authorize publication of all publicly found information or any special-category information. We will assess any legal obligations regarding ethnic-origin data and avoid collecting or inferring it unless lawful and necessary.
Google Analytics, Meta Pixel and reCAPTCHA
We use Google Analytics to understand Site usage, Meta Pixel for advertising and campaign measurement, and Google reCAPTCHA to help prevent automated abuse. These technologies may process IP addresses, device and browser information, page/event identifiers, approximate location, cookie identifiers, and other technical signals, depending on the tool and visitor settings. Google and Meta may process certain information independently under their applicable terms.
Where legally required, our cookie/privacy controls request consent before optional tracking or provide an effective opt-out. We do not intentionally provide passwords, confidential legal-inquiry contents, or sensitive case details to advertising pixels. Users should not submit such information through ordinary Site forms. For questions or available privacy preferences, use the contact form. The exact technical operation of vendor tools is governed by our deployed settings and their services.
Cookies, choices, tracking signals and Do Not Track
Cookies and similar technologies support sign-in, account security, abuse prevention, analytics, and advertising. Essential technologies may be used where necessary to operate the Site. Optional analytics and advertising technologies are subject to the applicable cookie-consent or privacy preference mechanisms.
Visitors may adjust choices through the Site's available privacy controls and browser settings. Where applicable privacy law requires recognition of an opt-out preference signal, including Global Privacy Control, we honor that signal for the relevant data use. A browser's general “Do Not Track” setting is not necessarily equivalent to a legally recognized opt-out signal. For assistance with advertising-related choices, use the contact form.
Stripe payment processing and billing
Stripe processes payment transactions under its own relevant terms and privacy documentation and may act in its own role for certain fraud, payment, or compliance purposes. We receive information needed to manage sponsorship orders, annual renewals, payments, cancellations, fraud and disputes, financial reporting, and applicable tax duties. We do not need to store full payment-card numbers in our own Directory database to provide these services.
Inquiry tools and attorney communications
When a listed attorney enables a Site contact form, a visitor may submit contact details and a message intended for that selected professional. We may process the message and delivery information to route the inquiry, support delivery, prevent abuse, and resolve an issue. Copies of inquiries held in Site-controlled systems are ordinarily erased or de-identified within 90 days after receipt, subject to the limited exceptions described in Section 17.
Receiving attorneys may independently retain communications according to their own privacy policies and professional obligations. Our deletion schedule does not control information received and stored by those independent attorneys or through third-party links such as WhatsApp. Do not submit confidential, privileged, medical, immigration, financial, or other sensitive case details through a general Directory form; first confirm a suitable communication channel with the selected attorney.
AI-assisted drafting and outreach
We use AI-assisted tools for limited operational tasks such as preparing or revising attorney profile descriptions, organizing publicly accessible business information, and drafting professional outreach. An AI-generated draft may contain inaccuracies and is not an independent determination of bar standing, identity, eligibility, language fluency, or suitability to represent a client.
Information provided to AI service providers is limited to what is reasonably necessary for these business purposes, subject to their applicable contractual and privacy safeguards. We do not intentionally use confidential visitor legal-case submissions to train or generate marketing content. If materially different AI processing is introduced, we will update relevant notices and obtain any legally required consent.
Marketing emails and professional invitations
We may contact professionals at their lawfully collected business addresses to invite them to review or claim a listing and to learn about optional advertising. Promotional email includes the legally required sender details and a practical way to unsubscribe. We maintain limited suppression and consent records for as long as reasonably necessary to honor opt-outs and demonstrate compliance; these suppression records may remain beyond 90 days to avoid contacting someone again.
U.S. and Canadian outreach is conducted according to the applicable rules, including U.S. CAN-SPAM and Canada's CASL where applicable. A publicly available or firm-domain email address does not, by itself, authorize unrestricted promotional emailing. Messages required for active subscriptions, accounts, security, or billing are distinct from optional marketing messages.
Who may receive information
We disclose information as appropriate to the public through published professional profiles; to the attorney selected by a visitor for a contact-form inquiry; and to providers that help us operate the Site, including Stripe for subscription payments, Google for analytics and reCAPTCHA security features, Meta for advertising measurement, and providers of hosting, email delivery, website infrastructure, backup, IT security, and customer support. We may also disclose limited information to professional advisers, regulators, or authorities where lawfully justified, or in a lawful business transaction subject to applicable safeguards.
Service providers and third-party platforms may process data in different legal roles depending on the service and applicable law. We limit vendor disclosures to information appropriate for the relevant service and use applicable contractual and technical controls. For questions about specific processing, use the contact form.
Sale, sharing and targeted advertising
Some privacy laws define the sale or sharing of personal information broadly, even when no money is exchanged. Where applicable, we provide required notices and opt-out rights. We do not assume that every analytics or advertising disclosure is exempt, and we do not knowingly sell children's personal information. You may exercise applicable advertising-related rights through our contact form or available site privacy controls. We honor valid requests and legally required opt-out signals.
How long we retain information
We keep personal information only as long as reasonably necessary for the purposes described in this Policy, including providing active listings, protecting accounts, fulfilling subscriptions, respecting communication choices, resolving disputes, and meeting legal obligations. We use different retention periods for different categories; 90 days is our general maximum for ordinary deleted profile data and routine operational records, not a universal retention period. We may act sooner when a valid legal request or other applicable rule requires it.
| Information category | Ordinary retention period |
|---|---|
| Active public professional profiles and related accounts | For as long as the profile or account remains active and the processing is lawful and necessary; subject to correction, objection, and removal rights. |
| Deleted profiles and nonessential account information | Remove from public display when an approved removal takes effect. Residual soft-deleted records are ordinarily erased or irreversibly de-identified within 90 days after approved removal or account closure, unless a shorter legal deadline or a specific lawful retention exception applies. |
| Site-controlled copies of attorney inquiry forms | Ordinarily erased or de-identified within 90 days after receipt. Records necessary for an unresolved delivery issue, security incident, dispute, or legal obligation may be retained for that limited purpose. |
| Routine website, authentication, and security logs | Ordinarily up to 90 days after collection; relevant records may be isolated and retained longer for a specific incident, suspected abuse, or legal requirement. |
| Ordinary recoverable system backups | Generally maintained on a rolling cycle of no longer than 90 days. A restored backup will be reviewed so that previously deleted records are not unintentionally republished or treated as active again. |
| Necessary profile-change, claim, and account-activation records | While the account is active and, when reasonably necessary to resolve ownership, accuracy, or authorization disputes, ordinarily up to one year after closure. Ordinary account content follows the 90-day deletion schedule. Records involved in an active claim, investigation, or legal hold may be retained longer. |
| Subscription consent, cancellation confirmations, and material billing dispute records | During the applicable subscription and ordinarily up to five years after its end where reasonably necessary to substantiate authorization, refunds, and payment history; longer only when legally required or connected to an unresolved claim. Records also needed for tax or accounting follow the applicable financial retention period. |
| Invoices, transaction records, and material accounting or tax documentation | Generally retained for a seven-year internal period measured from the relevant financial year-end or final transaction, with any longer period required by applicable law, audit, unresolved claim, or lawful preservation obligation. This policy is designed to encompass Washington's general five-year state-tax recordkeeping rule, but some records may require different periods. |
| Marketing unsubscribe and suppression information | Minimum information necessary to honor an opt-out and avoid renewed marketing, for as long as necessary for that purpose and applicable compliance requirements. This can extend beyond 90 days. |
| Security incidents, fraud investigations, legal claims, litigation holds, and regulatory matters | Only while a documented investigation, preservation obligation, legal claim, or applicable law justifies retention, followed by secure deletion or de-identification when no longer necessary. |
When a profile is removed from the Site, information may temporarily remain in restricted backup or archival systems under the schedule above, and limited information may remain in legally required financial records or incident evidence. Records retained under an exception are not kept as an active public listing. We periodically review these exceptions and limit access where appropriate.
Deleting a profile does not remove separate copies already received by the selected attorney or independently indexed, cached, or collected by search engines and other third parties. Where appropriate, we can assist with correcting information we control, but we cannot guarantee deletion from systems operated by others.
Your privacy rights still apply: the stated retention periods do not delay an action required sooner by applicable law or override a valid deletion or objection right. Where a request is refused or a portion of information must be retained, we will explain the relevant grounds when required.
Security and incident response
We use reasonable technical, administrative, and organizational safeguards suited to the information processed, including authentication controls, restricted administrative access, appropriate service-provider measures, and procedures for handling credible incidents. Safeguards cannot guarantee absolute security.
Individuals should safeguard their login credentials and promptly report unauthorized access through the contact form. We investigate security incidents and provide notifications to affected individuals or regulators when required by applicable law.
Your access, correction, deletion and objection rights
Depending on your location and applicable law, you may have rights to learn about, access, correct, delete, receive a portable copy of, limit or object to processing of, or withdraw consent concerning personal information. You may also have the right to opt out of qualifying targeted advertising, sales or sharing, and to appeal certain denied requests. Rights are subject to lawful identity verification, exceptions, and response deadlines.
Send requests through the contact form and identify the relevant listing or account. We may ask for information reasonably necessary to verify your identity or authority without requesting unnecessary sensitive details. We will explain applicable exceptions and appeals where required. We also accept professional profile correction and unclaimed-listing objections and will review them consistently with applicable law.
U.S. state-specific privacy notices
California and other U.S. states provide privacy rights to qualifying residents when statutory applicability thresholds and conditions are met. These rights may include access, deletion, correction, information about disclosures, opt-out of defined sale/sharing or targeted advertising, protection against retaliation for rights requests, and additional controls over sensitive information where applicable.
We will assess statutory coverage using our actual revenue, data processing, advertising, and operating practices rather than assuming every state privacy law applies merely because the Directory is accessible in that state. Where a privacy law applies, we will provide any required notice-at-collection, required categories and retention information, opt-out links, accessible request channels, and appeal mechanisms.
Canada: privacy and electronic communications
Where applicable, the federal Personal Information Protection and Electronic Documents Act (PIPEDA) and relevant provincial privacy laws may govern our handling of Canadian personal information. Professional business contact data exceptions and publicly available information provisions are limited; their applicability depends on context and purpose. Canadian individuals may contact us to seek access, correction, or information about our privacy practices, subject to applicable law.
Canadian commercial electronic messages are sent only on a legally valid basis and with required identification and unsubscribe processes under CASL. An address collected from another directory is not, by itself, proof of marketing consent.
EU/UK and international transfers
The Site is operated from the United States and may be accessed from other countries. Information may be hosted, accessed, or processed in the United States and locations where relevant service providers operate. If our actual operations fall within the EU GDPR or UK GDPR, eligible individuals may have additional rights and we will apply legally required transfer safeguards, notices, legal bases, and any applicable representative arrangements.
The Site's availability worldwide does not alone establish that every country’s privacy regime applies, but we consider active targeting, monitoring, payment services, and location-specific processing where relevant. Public professional listings are inherently accessible internationally. Requests may be directed through the contact form.
Children and sensitive information
The Directory is intended for adults seeking or advertising professional legal services, not for children. We do not knowingly solicit personal information from children through professional account registration. If we become aware that personal information was collected from a child without the required legal basis or permission, we will address it appropriately.
We discourage sensitive legal facts, medical details, identity documents, and financial information in visitor inquiry forms. Information that reveals or implies ethnic origin, legal disputes, or other sensitive attributes requires special care where relevant privacy laws apply.
Third-party websites, WhatsApp and social links
Clicking a listed attorney's WhatsApp, law firm website, social-media page, map, or other external destination may transfer information to that provider and subject you to its privacy terms. ZSany is not responsible for independent attorney intake or third-party practices. Review the destination's privacy notice before sharing sensitive information.
Changes, policy date and contact
We may update this Policy to reflect changes in our services, data practices, laws, or vendors. The revision date above identifies the current version. We provide additional notice or seek consent for material changes where required. Information is not retained indefinitely merely because it previously appeared on a public profile; the retention schedule describes ordinary periods and lawful exceptions. Submit privacy, correction, account, marketing, or deletion requests to ZSany LLC through our contact form. Additional legally required contact or representative information will be provided where applicable.