Privacy Policy

1. Introduction

NyayaSetu Technologies Pvt. Ltd. ("NyayaSetu", "we", "us", "our") is committed to protecting your personal data. This Privacy Policy explains what information we collect, how we use it, and your rights under the Digital Personal Data Protection Act, 2023 ("DPDP Act") and applicable Indian law.

2. Data We Collect

• Account data: name, email address, phone number, and password (hashed).
• Profile data: for professionals: Bar Council enrolment number, practice areas, qualifications, and identity documents.
• Transaction data: payment details processed via Razorpay (we do not store card numbers).
• Usage data: pages visited, search queries, device type, IP address, and browser information collected via cookies and server logs.
• Communications: messages exchanged with professionals through the Platform, support tickets, and review content.
• Documents: files you upload for AI analysis or document drafting, stored encrypted on AWS S3.

3. How We Use Your Data

• To create and manage your account and provide Platform services.
• To process payments and issue invoices.
• To match you with suitable legal professionals.
• To send transactional notifications (OTP, appointment reminders, order updates).
• To improve Platform features and personalise your experience.
• To comply with legal obligations, including KYC and anti-fraud requirements.
• To send marketing communications, only with your explicit consent, which you may withdraw at any time.

4. Legal Basis for Processing

We process your data on the following bases: (a) performance of a contract with you; (b) compliance with a legal obligation; (c) your explicit consent; and (d) our legitimate interests, provided they are not overridden by your rights.

5. Data Sharing

We share your data only as necessary:

• With professionals: your name, contact details, and case information when you engage a professional.
• Payment processors: Razorpay, for transaction processing under their privacy policy.
• Cloud providers: AWS (storage), for hosting encrypted documents.
• AI services: Anthropic (Claude API), for document analysis; no personally identifiable information is retained by Anthropic beyond the session.
• Regulatory authorities: when required by law, court order, or government directive.

We do not sell your personal data to third parties.

6. Data Retention

We retain your personal data for as long as your account is active or as required by applicable law (e.g., financial records for 7 years under the Companies Act, 2013). You may request deletion of your account and data subject to legal retention requirements.

7. Cookies

We use essential cookies for authentication and session management and analytics cookies to understand usage patterns. You may control cookies through your browser settings; disabling essential cookies may affect Platform functionality.

8. Data Security

We implement industry-standard safeguards including TLS encryption in transit, AES-256 encryption at rest for sensitive documents, bcrypt password hashing, and regular security audits. However, no system is completely secure and we cannot guarantee absolute security.

9. Your Rights

Under the DPDP Act and applicable law, you have the right to:

• Access and obtain a copy of your personal data.
• Correct inaccurate or incomplete data.
• Erase your data (subject to legal retention obligations).
• Withdraw consent for marketing communications at any time.
• Nominate a person to exercise your rights in the event of your death or incapacity.

To exercise these rights, email privacy@nyayasetu.in.

10. Children's Privacy

The Platform is not directed at persons under 18 years of age. We do not knowingly collect personal data from minors. If you believe a minor has provided us with data, please contact us immediately.

11. Changes to this Policy

We may update this Privacy Policy periodically. We will notify you of material changes via email or a prominent notice on the Platform. Your continued use after the effective date constitutes acceptance.

12. Grievance Officer

In accordance with the Information Technology Act, 2000 and DPDP Act, 2023, our Grievance Officer is: