1. Introduction
Nyayabodh ("we", "our", "the Platform") is committed to protecting the privacy of all users. This Privacy Policy describes how we collect, use, store, and share your personal data in compliance with the Digital Personal Data Protection Act, 2023 (DPDPA) and the Information Technology Act, 2000 (IT Act).
2. Data Fiduciary Information
Data Fiduciary: Nslawgic Technologies
Grievance Officer: As required under Section 13 of DPDPA 2023, we publish the business contact of our designated Grievance Officer:
Loading...
Response Time: We will acknowledge your grievance within 48 hours and resolve it within 30 days as mandated by the DPDPA.
3. Data We Collect
3.1 Information You Provide
- Registration Data: Full name, email address, phone number, city, state, preferred language, and role (Client/Lawyer).
- Advocate enrolment details: the State Bar Council enrolment number an advocate declares, years of experience, and practice areas. We do not collect identity documents.
- Case Information: Case descriptions, legal categories, court details, hearing dates, uploaded documents.
- AI Interactions: Legal questions submitted to the AI assistant, generated drafts, and consultation queries.
- Payment Data: Transaction records processed via Razorpay (we do not store card numbers).
3.2 Automatically Collected Data
- IP address, browser type, device information
- Usage analytics (pages visited, features used, session duration)
- Cookies for authentication and session management
4. Purpose of Data Processing
We process your data for the following lawful purposes under Section 4 of the DPDPA:
- Service Delivery: Connecting clients with advocates, managing consultations, tracking cases.
- AI-Powered Features: Generating legal information (not legal advice), document drafting, case similarity analysis, and cost estimation.
- Advocate enrolment review: recording the State Bar Council enrolment number an advocate declares, and a reviewer's acceptance or refusal of it. We do not check it against a Bar Council roll; no queryable public register exists.
- Legal Obligations: Compliance with court orders, regulatory requests, and IT Act provisions.
- Platform Improvement: Analytics to improve user experience (only with consent).
5. Consent
Under Section 6 of the DPDPA, we obtain your free, specific, informed, unconditional, and unambiguous consent before processing personal data. You may:
- Grant or deny consent at registration and at any time thereafter
- Withdraw consent for non-essential processing via your profile settings
- Essential cookies (authentication, security) do not require consent as they are necessary for platform functionality
6. Your Rights Under DPDPA
As a Data Principal, you have the following rights:
- Right to Access (Section 11): Request a summary of your personal data and processing activities.
- Right to Correction (Section 12): Request correction of inaccurate or incomplete data.
- Right to Erasure (Section 12): Request deletion of your personal data when it is no longer necessary.
- Right to Grievance Redressal (Section 13): Lodge complaints with our Grievance Officer or the Data Protection Board of India.
- Right to Nominate (Section 14): Nominate another person to exercise your rights in case of death or incapacity.
To exercise any of these rights, use the Data Requests section under Settings → Privacy, or write to the Grievance Officer published in section 2 above.
7. Data Retention
- Account Data: Retained for the lifetime of the account plus 3 years after deletion (as required by Limitation Act provisions).
- AI Interaction Logs: Retained for 90 days, then anonymized for model improvement.
- Payment Records: Retained for 8 years as per GST and Income Tax Act requirements.
- Case Documents: Retained per applicable court rules and Limitation Act timelines.
8. Data Security
We implement reasonable security safeguards as required under Section 8 of the DPDPA:
- Encryption in transit for all traffic between you and the Platform
- Encryption at rest, as provided by our managed cloud database and object storage
- Role-based access controls with principle of least privilege
9. Third-Party Data Processors
We describe processors by the category of processing rather than by vendor, because which vendor serves a category is a deployment setting and several of these features run entirely on our own infrastructure by default. Where an external processor is engaged it is engaged under a data processing agreement, and the screen that uses it names it before you submit anything to it.
- Payment processing: A PCI-DSS compliant payment gateway. Card and UPI credentials are entered on the gateway's own checkout and never reach us; we receive the transaction reference, amount and status.
- Infrastructure hosting: Application servers, the database and uploaded documents are held by our cloud hosting provider. Ask the Grievance Officer for the provider and hosting region in force for your account.
- AI legal information: Questions you put to the AI assistant, and the statutory text retrieved to answer them, may be processed by an external language-model provider. The AI screen states whether your question leaves the platform before you send it.
- Translation: Text you ask us to translate may be sent to an external translation service. The translation screen states whether your text leaves the platform before you submit it.
We do not sell personal data to third parties. Where a processor for any of these categories operates outside India, the transfer is governed by our agreement with that processor and by Section 16 of the DPDPA as and when the Central Government notifies restrictions.
10. Children's Data
Nyayabodh does not knowingly collect data from individuals under 18 years of age. If we learn that we have collected a child's data, we will promptly delete it in compliance with Section 9 of the DPDPA.
11. Changes to This Policy
We will post the revised policy here with a new effective date. Where a change materially affects how we use your personal data, we will ask for your consent again before it applies to you, and you can withdraw any consent at any time from your privacy settings.
12. Contact
For privacy-related inquiries, write to the Grievance Officer published in section 2 above.
For unresolved complaints, you may approach the Data Protection Board of India as established under Section 18 of the DPDPA.