Trust and security
Law Enforcement and Legal Requests Policy
How we respond to requests from the police, courts and government bodies, what we require before disclosing anything, and when we tell the user.
- Version
- v1.0
- Effective
- Contents
- 8 sections · 54 clauses
- Document ref.
- WGN-LEGAL-LAW-REQUESTS-V1.0
The PDF is a watermarked controlled copy. If it differs from this page, this page governs.
At a glance
A plain-language summary. The numbered clauses below are what legally applies.
- We require lawful process. A request on letterhead is not enough.
- We disclose the minimum the request actually requires, never a whole account by default.
- We tell the user, unless the law forbids it or a child is at risk.
- We refuse or narrow requests that are overbroad, and we say so in writing.
- Child safety and imminent danger are the exceptions where we act immediately.
1. Scope and principles
- 1.1
This policy governs how we respond to requests for user data or content from law enforcement, courts, regulators and government bodies.
- 1.2
It applies to requests from Nepal and from any other jurisdiction.
- 1.3
We comply with valid legal process and we do not comply with anything less.
- 1.4
We disclose the minimum data the request actually requires.
- 1.5
We treat user data as the user's, held by us, and we act accordingly when somebody asks for it.
- 1.6
We publish this policy so that users know what protects them and requesters know what is required.
2. What we require
- 2.1
A request must be in writing, on official letterhead, and signed by an authorised officer.
- 2.2
A request must identify the legal authority under which it is made.
- 2.3
A request must identify the account, content or record sought with specificity — a URL, a username, or an account identifier.
- 2.4
A request must state the period to which it relates.
- 2.5
A request must state the offence or matter under investigation.
- 2.6
A request for the content of communications, or for stored files, requires a court order or warrant.
- 2.7
A request from outside Nepal is ordinarily processed through mutual legal assistance, unless it independently satisfies Nepali law.
- 2.8
Requests should be sent to legal@lacspace.com with "Law enforcement request" in the subject line.
3. What we will not accept
- 3.1
A verbal or telephone request, except in the emergency circumstances below.
- 3.2
A request from a personal email address or an unverifiable sender.
- 3.3
A request that does not identify its legal basis.
- 3.4
A request for "all data" on an account without specificity as to what is sought and why.
- 3.5
A request for bulk data across multiple users without individualised justification.
- 3.6
A request to monitor an account prospectively without a court order.
- 3.7
A request to remove lawful content on the basis that it is unwelcome rather than unlawful.
Why this is here
Requests to remove criticism are common and are refused. Content is removed because it breaches our policies or the law, not because a body would prefer it were not there.
4. What we may disclose
- 4.1
Basic subscriber information — display name, email address, account creation date — on production of valid process.
- 4.2
Connection records — IP addresses and timestamps — where held and where the process covers them.
- 4.3
Content and uploaded files, only on a court order or warrant.
- 4.4
We do not hold payment records, identity documents, dates of birth or telephone numbers, so we cannot disclose them.
- 4.5
We do not hold private messages between users, because the Service has none.
- 4.6
Server logs containing IP addresses are retained for ninety days, so records older than that ordinarily no longer exist.
- 4.7
We disclose what exists. We do not create, reconstruct or infer records to satisfy a request.
5. Telling the user
- 5.1
We notify the affected user of a request before disclosing, so that they may seek their own advice or challenge it.
- 5.2
We do not notify where a court has ordered non-disclosure.
- 5.3
We do not notify where notification is prohibited by law.
- 5.4
We do not notify where the matter concerns child safety.
- 5.5
We do not notify where we reasonably believe notification would create a risk of serious harm, or of destruction of evidence.
- 5.6
Where notification is deferred by an order, we notify once the order expires.
- 5.7
We give reasonable time before disclosing, where the circumstances allow it.
6. Emergencies
- 6.1
Where there is a credible risk of death or serious physical harm to a person, we may disclose the minimum data necessary without waiting for formal process.
- 6.2
An emergency request must state the nature of the emergency and why disclosure will help.
- 6.3
We require follow-up formal process within five working days.
- 6.4
We record every emergency disclosure and review it afterwards.
- 6.5
We disclose only what is necessary to address the immediate risk.
- 6.6
Misuse of the emergency route results in future requests from that source being processed only through formal channels.
7. Preservation
- 7.1
We accept a request to preserve specified records pending formal process.
- 7.2
A preservation request must identify the account and the records with specificity.
- 7.3
We preserve for ninety days, extendable once by a further ninety on request.
- 7.4
Preservation is not disclosure. Preserved records are not provided until valid process is produced.
- 7.5
Preserved records are access-restricted and logged.
- 7.6
Where no process follows, preserved records are released back into the ordinary retention cycle.
8. Challenging and reporting
- 8.1
We narrow or refuse requests that are overbroad, vague or unsupported, and we say so in writing with reasons.
- 8.2
We may seek to have a request modified or set aside where it appears unlawful.
- 8.3
We do not charge for responding to a request.
- 8.4
We keep a record of every request, our response, and the data disclosed, for five years.
- 8.5
We intend to publish periodic transparency figures on the number and type of requests received and how many were complied with in full, in part, or refused.
- 8.6
Nothing in this policy waives any right of ours or of a user.
- 8.7
This policy is not legal advice to any requester or user.
Version history
Every change to this document is recorded here, so amendments can be inspected rather than taken on trust.
v1.0 ·
- Initial publication.
- Published the specific requirements for a valid request and the categories that will be refused.
- Committed to notifying the affected user by default, with defined exceptions.
- Noted the categories of data we deliberately do not hold and therefore cannot disclose.