Privacy Policy

2. What data we collect

2.1 Information you provide directly

• Account information: your full name and email address, provided when you sign up for an account.
• Documents you upload for analysis (FIRs, contracts, judgments, etc.) — see Section 5 below.
• Queries and conversations you have with our AI features.

2.2 Information collected automatically

• Page-view events (which pages you visit, when, in what sequence).
• Anonymous session identifiers stored locally in your browser.
• Browser type, operating system, approximate country (derived from IP address by our hosting provider).
• How you reached us — the campaign parameters in the link you clicked (utm_source, utm_medium, utm_campaign and the like), the page that linked to us, and the first page you landed on. The first such record of a visit is kept in your own browser's local storage and attached to your account if you later sign up, so that we can tell which channel brought you. It is stored by us and shared with no advertising network or analytics provider, and we set no advertising or cross-site tracking cookies.
• AI-feature usage events (which feature was invoked, token volume — for billing and capacity planning).

We do not collect government IDs, payment card details, biometric data, or sensitive personal data of children. If you are under 18, please do not use this service without the consent of a parent or guardian.

3. Why we collect it (purposes)

• To provide the service — authentication, session management, AI features.
• To improve the service — aggregated usage analytics, error monitoring, capacity planning.
• To send product updates and new-feature announcements — only if you have given separate, explicit consent at signup. You may withdraw at any time (see Section 8).
• To provide in-app personalised content — only if you have given separate, explicit consent at signup. You may withdraw at any time.
• To meet legal obligations — including responding to lawful requests from courts or regulatory authorities.

4. Lawful basis (DPDP Section 7)

We process your personal data on the basis of your consent, freely given at signup, with separate opt-ins for product updates and personalisation. We do not bundle these consents with the signup itself; refusal of marketing consent does not prevent you from using the service.

5. How long we keep your data

• Account data (name, email): until you request deletion or close your account.
• Uploaded documents: when you are signed in, a document you attach in Document Intelligence is saved to your own document repository — the original file, kept in your account so you can open it again later — along with the text extracted from it. It is private to your account: it is reachable only through your own signed-in session, it is never served over a public or shareable link, and no other user and no member of our staff can open it. Delete it yourself at any time from My Library → Repository, or delete your account to remove all of it. It is never added to any training dataset. If you are not signed in, nothing is saved: the document is processed in memory and discarded.
• Reports and analyses: what Advokacy generates for you while signed in — case briefs, analyses, chronologies, drafts and saved research — is stored in your account and listed in My Library, so your work is still there when you come back. Same isolation: only your signed-in session can read it, and you can delete any item, or all of it, yourself.
• AI conversations: not stored on our servers beyond the duration of your active session, except where an answer is saved to your own library as above.
• Analytics events (page views, AI usage records): retained for up to 24 months for trend analysis, then aggregated and anonymised.
• Audit logs (security events): retained for up to 12 months.

6. Who we share data with (Data Processors)

We do not sell your personal data to anyone. We share strictly limited data with the following Data Processors who help us operate the service:

• Anthropic, PBC — provides the underlying Claude AI model that processes your queries. Your prompts are sent to Anthropic for inference. Anthropic's policy is to not train its models on data submitted via its API. Anthropic's privacy policy.
• Indian Kanoon (when you use the Legal Research feature) — public legal database; we forward your query but do not share your identity.
• Resend (Plateless, Inc.) — delivers the account email we send you: sign-up confirmation and password-reset links. It receives your email address and the contents of that message, and nothing else. Resend's privacy policy.
• Google LLC (only if you choose Sign in with Google) — verifies your identity and tells us your name, email address and profile picture. If you sign in with a password instead, Google receives nothing. Google's privacy policy.
• Our hosting provider — runs the server this site is served from. Your account database and your uploaded documents live on that server, under our control; the provider does not process them for any purpose of its own.

Our user database and this website are no longer operated by Supabase Inc. or Netlify, Inc., which earlier versions of this policy named: both were replaced by the self-hosted database and server described above, and neither holds any Advokacy data.

Some of these providers may store data outside India. We rely on their respective contractual safeguards and standard practices for international data transfer.

7. How we secure your data

• All traffic between your browser and our servers is encrypted in transit (HTTPS/TLS).
• Every read and write of your documents, files and library items is scoped to your user id in the query itself — there is no code path that fetches one by its identifier alone. You can only read your own data; admin staff can access aggregated metrics and your account record, not the contents of your repository or your library.
• Files in your repository are never exposed at a URL. Opening one sends the bytes inside an authenticated response to your own browser, so a file has no address that works without your session — nothing that can be copied out, forwarded, or left working after you sign out.
• API keys are stored in our hosting provider's encrypted environment-variable store, never exposed to browsers.
• We do not currently use cookies for tracking. Session IDs are stored in your browser's localStorage and are not transmitted to third parties.

8. Your rights under the DPDP Act

You have the right to:

• Access — get a copy of the personal data we hold about you.
• Correct — fix inaccurate or incomplete data.
• Erase — request deletion of your account and all associated personal data.
• Withdraw consent — for marketing or personalisation, at any time, without affecting your ability to use the service.
• Grievance redressal — raise a complaint about how we handle your data.
• Nominate — designate another person to exercise your rights in case of death or incapacity.

To exercise any of these rights, email pssr.legal@gmail.com. We will respond within 30 days.

If you are not satisfied with our response, you have the right to escalate to the Data Protection Board of India.

9. Changes to this policy

We may update this Privacy Policy from time to time. Material changes will be notified to registered users by email at least 14 days before they take effect. Continued use of the service after the effective date constitutes acceptance of the revised policy.

10. Contact

For privacy queries, data subject requests, or grievances:

• Email: pssr.legal@gmail.com
• Subject line: "DPDP Request — <your full name>"

This privacy policy is provided as a starting point and reflects current best understanding of the DPDP Act, 2023. It is recommended you have it reviewed by qualified counsel before relying on it for production traffic.