Privacy Policy

1. Personal Data We Collect

We collect different categories of personal data depending on how you interact with the Platform, as set out below.

1.1 Firm Users (Lawyers and Staff)

Required at sign-up: full name, email address, password (managed by our authentication provider), and phone number (verified by OTP). We also assign a role and a firm ID to your account, and hold your firm's name, owner email, and firm phone number. Optional profile fields: Bar Council enrollment number, bio, city, state, consultation fee, years of experience, job title, languages spoken, practice areas, profile photo, and WhatsApp number.

1.2 Clients (Entered by a Firm)

Where a Firm registers a client or case on the Platform, we collect: name, email, phone number, address, case facts and description, transcripts of client statements, case number and CNR (court) number, hearing dates, uploaded documents, invoices, billing rate, preferred language, and a case-tracking PIN used to authenticate the client in the case portal.

1.3 Prospective Clients (Public Intake)

Where you submit an inquiry through a Firm's public intake link, we collect: name, email, phone number, a description of your case, urgency, financial impact, your answers to the Firm's custom intake questions, preferred language, and uploaded documents (evidence).

1.4 Marketplace Visitors

When you use our public marketplace to find a lawyer, we collect: name, phone number, email, city, state, practice area, case description, urgency, and preferred contact method. If you open our AI chat assistant, an anonymous session identifier is also generated.

1.5 Payment Data

When a Firm is set up for billing, we (and our payment processor) collect customer name, email, and contact number to create a payment-gateway customer profile, and invoices carry customer name, state code, and GSTIN where applicable. We do not collect or store card numbers, bank account details, or other card/bank credentials — these are handled directly by our payment gateway.

1.6 System and Technical Data

We automatically generate: activity logs (user ID, user name/email, action taken, and timestamp); rate-limit records, which include the IP address of public intake visitors and a hashed visitor identifier for voice submissions; and a deletion log recording the ID of the user who performed a deletion. We also use analytics and advertising tags on our public-facing pages.

2. How We Collect Personal Data

2.1 Directly From You

Most personal data is collected directly from you: when you create an account, complete or update your profile, submit a marketplace or public intake inquiry, communicate with us or with a Firm through the Platform, or make a payment.

2.2 Automatically

Certain data is generated automatically as you use the Platform, including activity logs, rate-limit and abuse-prevention records (including IP address), a record of deletion actions, and analytics/advertising data collected through tags on our public pages.

2.3 From Third-Party Sources

• Google sign-in: if you register or sign in with Google, we receive your name and email address from your Google account; we then separately collect and OTP-verify your phone number.
• Court data providers: for court tracking, we submit a case's CNR number to a public eCourts data provider and receive case and hearing details in return.
• Public legal research sources: we retrieve publicly available judgments and legal authorities from public legal databases to support AI-assisted research; this is public legal material and not personal data about Platform users.
• Marketplace directory listings: a lawyer's public marketplace profile may initially be created by a platform administrator or through a data-migration process, and later claimed by the lawyer. We are working to strengthen how the source and basis for creating an unclaimed listing is documented.
• Client data entered by a Firm: a Firm may add a client's or lead's personal data to the Platform on the client's behalf, without the client submitting a form directly. We are working to strengthen how a Firm's basis for entering that data is documented.

2.4 Through Uploaded Documents

Documents are collected through four upload channels: a Firm's internal case/document storage; the public intake vault, where prospective clients upload evidence (up to three files per submission); case-tracker uploads, where clients upload documents a Firm has requested; and document uploads made by lawyers for contract or quick analysis. Every uploaded file is scanned for malware before it can be viewed, and view links expire shortly after being issued. Uploaded documents may also be read by our AI features to provide the service.

3. Purpose of Processing

We process personal data strictly for legal-operations purposes — including case management, AI-assisted drafting, billing, and communication — and we do not sell, rent, or trade your personal data to third parties. The table below sets out the specific purpose for each category of data.

• Firm user name, email, phone, and password – To create and secure your account, verify identity (e.g., phone verification for Google sign-in), send system communications, and assign account roles and permissions
• Optional lawyer/firm profile fields (bar number, bio, practice areas, fee, photo, etc.) – To build and display the public lawyer/firm profile on the marketplace and to match prospective clients to the right lawyer
• Client and lead name, email, and phone number – To contact the client, administer the case, send case updates, and authenticate the client within the case-tracking portal
• Case facts, descriptions, transcripts, and uploaded documents – To deliver the legal service itself: case management, AI-assisted summarization and scoring, drafting, and contract review
• Payment and invoice data – To process subscription and credit billing, generate GST-compliant invoices, and reconcile transactions
• Activity logs and rate-limit records (including IP address) – To maintain an audit trail of account actions and to prevent abuse and duplicate submissions
• Marketplace visitor details (name, contact info, case description, urgency) – To route the inquiry to the lawyer or firm selected by the visitor

4. AI Processing

The Platform uses artificial intelligence — including Google Gemini (via Google Cloud Vertex AI), OpenAI, and Anthropic — to provide legal drafting, summarisation, and analysis functions. Your case data and uploaded documents may be processed solely to deliver these functions, through each provider's paid commercial API and pursuant to contractual terms that prohibit such providers from using your data to train public or general-purpose AI models. Each such provider acts as a Data Processor and processes personal data only on our documented instructions and for the purposes stated in this Policy.

5. Cross-Border Data Transfer and International Data Processing

• Database (Cloud Firestore): Production data is stored in the United States (us-central1, Iowa); a separate development environment stores data in India (asia-south1, Mumbai).
• Document and file storage (Cloud Storage): Uploaded documents, avatars, and other files are stored in the United States (us-central1).
• Backend processing (Cloud Functions and malware scanning): All server-side processing runs in the United States (us-central1).
• Database backups: Firestore backups are stored in the same United States region as the database (us-central1).
• Authentication: Account credentials are managed by Firebase Authentication, hosted by Google; the specific storage location is Google-managed and not separately selectable by us.
• Web application hosting: The Platform is served through Google's global content delivery network, which may route and cache content through servers in multiple countries.
• AI processing (Vertex AI / Gemini): AI-assisted features are processed through a global endpoint with no fixed or guaranteed country of processing.
• Email delivery: System emails are sent via Google Workspace/Gmail SMTP, with a fallback provider (Namecheap Private Email SMTP) used for certain sender domains; these providers may process data outside your country of residence.
• Practical effect: As a result, your personal data — including data entered by Indian Firms and clients — is primarily transferred to and stored in the United States, with AI processing occurring through a global infrastructure that is not confined to a single country.

6. Sharing of Personal Data with Processors and Third Parties

We share limited personal data with the following trusted service providers, strictly for the operational purposes indicated, and under contractual obligations of confidentiality and data protection consistent with Section 8(2) of the DPDP Act:

• Firebase (Google Cloud): hosting, database, authentication, and storage
• Google Gemini / Vertex AI, OpenAI, Anthropic: AI-powered drafting, summarisation, and analysis
• Razorpay: secure payment and billing processing
• We may also disclose personal data where required by law, regulation, or a valid order of a court or government authority.

7. Data Retention

• Case records – Retained up to 3 years from case creation, for cases marked Closed or Rejected; basis/trigger: automated purge process (active or protected cases are excluded)
• Leads (not converted to a case) – Retained 30 days from last activity on the lead; basis/trigger: automated purge process
• Marketplace inquiries – Retained as long as reasonably needed to serve their purpose; basis/trigger: deleted when the associated firm-side lead is purged
• Firm and user account profiles – Retained for the life of the account, plus a period necessary for legal, accounting, or dispute-resolution purposes; basis/trigger: retained until deletion is requested or required
• Client records, invoices, and transaction history – Retained for the life of the associated account and as required by applicable financial, tax, and recordkeeping law; basis/trigger: retained until deletion is requested or required
• System and activity logs – Retained for a minimum of 1 year; basis/trigger: retained for security, audit, and troubleshooting purposes
• AI-generated chats, analyses, and drafts – Retained for the life of the case, lead, or other record they are associated with; basis/trigger: tied to the retention of the parent record
• Uploaded documents and files – Retained for the life of the case, lead, or other record they are associated with; basis/trigger: tied to the retention of the parent record

8. Data Security Safeguards

In accordance with Section 8(5) of the DPDP Act, we implement appropriate technical and organisational measures, including encryption in transit and at rest, access controls, authentication mechanisms, and regular security review, to protect personal data against unauthorised access, disclosure, alteration, or loss.

9. Intimation of Personal Data Breach

In the event of a personal data breach, we shall, in accordance with Section 8(6) of the DPDP Act, intimate the Data Protection Board of India and the affected Data Principals in the manner and within the time prescribed under the Act and the rules made thereunder.

10. Children's Data

The Platform is not intended for use by individuals below the age of 18 years. We do not knowingly collect personal data of children within the meaning of Section 9 of the DPDP Act. Where we become aware that a child's personal data has been processed without verifiable parental or lawful guardian consent, we shall promptly delete such data.

11. Rights of the Data Principal

As a Data Principal, you are entitled to the following rights under Chapter III of the DPDP Act:

• Right to Access Information: to obtain a summary of the personal data being processed and the processing activities undertaken
• Right to Correction and Updating: to have inaccurate or incomplete personal data corrected or updated
• Right to Erasure: to request deletion of your account and personal data that is no longer necessary for the purpose for which it was processed
• Right to Grievance Redressal: to have any grievance addressed in the manner set out in Clause 12
• Right to Nominate: to nominate another individual to exercise your rights in the event of death or incapacity

These rights may be exercised by writing to us at the contact details set out in Clause 15, and shall be given effect within the timelines prescribed under the DPDP Act.

12. Grievance Redressal

In accordance with Section 13 of the DPDP Act, any grievance relating to the processing of your personal data may be addressed to our Grievance Officer:

We shall endeavour to respond to and resolve grievances within the time period prescribed under applicable law.

13. Amendments to this Policy

We may update this Policy from time to time to reflect changes in our practices or applicable law. Material changes will be notified to you through the Platform or via the contact information provided by you, and the “Last Updated” date at the head of this Policy will be revised accordingly.

14. Governing Law and Jurisdiction

This Policy shall be governed by the laws of India, including the Digital Personal Data Protection Act, 2023. The courts at Dhanbad, Jharkhand shall have exclusive jurisdiction over any dispute arising out of or in connection with this Policy.

15. Contact Information