Privacy Policy

This policy describes how VakeelMitra ("VakeelMitra", "we", "us") collects, uses, and protects personal data when a law firm or independent advocate ("Organisation", "you") uses the VakeelMitra platform, and when an Organisation's own clients use the Client Portal to view their case status.

For data an Organisation enters about its own clients (names, contact details, matter information), that Organisation acts as the Data Fiduciary under India's Digital Personal Data Protection Act, 2023 ("DPDP Act"), and VakeelMitra acts as a Data Processor on the Organisation's behalf. For an Organisation's own account data (the firm's admin details, billing information, usage of the platform), VakeelMitra acts as the Data Fiduciary.

• Account data: name, email, phone, Bar Council enrollment details, password (stored hashed, never in plain text).
• Client and matter data entered by an Organisation: client names, phone/email, PAN (stored only as a one-way cryptographic hash, never in plain readable form), case details, court dates, and documents uploaded to the platform.
• Client Portal data: a client's own profile details and consent record, when they sign in to check their case status.
• Usage data: login activity, audit logs of actions taken in the platform, and device/session information, kept for security and accountability.
• AI interaction data: questions asked to the AI Assistant and the documents referenced to answer them, processed as described in Section 5.

We process personal data only for the purposes an Organisation uses the platform for: managing legal matters, clients, hearings, documents, and communications; providing the Client Portal to an Organisation's own clients; billing and account administration; and maintaining the security, integrity, and auditability of the platform.

An Organisation's clients provide consent to have their basic details processed when they sign in to the Client Portal, and can review what was consented to from their own profile. An Organisation itself is responsible for obtaining appropriate consent from its own clients before entering their personal data into VakeelMitra, in line with the Organisation's own obligations as a Data Fiduciary under the DPDP Act.

By default, VakeelMitra's AI features (AI Assistant, Research, Drafting, Contract Review, Chronology, Case Preparation) run on VakeelMitra's built-in AI service, which operates inside VakeelMitra's own cloud account in the AWS India Region (Amazon Bedrock). Content sent to it is not used to train AI models. An Organisation may optionally connect its own third-party AI provider key (Google Gemini, Anthropic Claude, or Sarvam AI) for these same features; doing so requires the Organisation's explicit, recorded consent, and is clearly disclosed to the Organisation before it takes effect (see Admin → Sub-processors & Data Flow inside the app for the exact, current wording). When a third-party provider is used, the question text and a small number of relevant document excerpts for that one request are sent to that provider — never the Organisation's full document library, and never without that Organisation's own prior opt-in.

Platform data is stored on Amazon Web Services in the India Region (Mumbai / Hyderabad), in infrastructure operated for VakeelMitra. [Sample wording — confirm the hosting region and data-residency claims with counsel before publishing.] Backups and encryption-at-rest are applied in line with VakeelMitra's security practices.

We retain personal data for as long as an Organisation's account is active, plus any additional period required by applicable law, a Legal Hold placed by the Organisation on specific records, or the Organisation's own configured retention policy. When an Organisation closes its account, data is deleted following a grace period (to allow the Organisation to reconsider), except where a legal obligation or an active Legal Hold requires it to be kept longer.

As a data principal, you have the right to:

• Request a summary of the personal data we (or, for client data, the relevant Organisation) hold about you.
• Request correction or completion of inaccurate or incomplete personal data.
• Request erasure of personal data that is no longer necessary for the purpose it was collected for.
• Withdraw consent at any time, where processing is based on consent.
• Nominate another individual to exercise these rights on your behalf in the event of death or incapacity.
• Lodge a grievance with the relevant Grievance Officer (Section 10) before approaching the Data Protection Board of India.

For data about a specific matter or client, these requests should generally be directed to the Organisation (law firm) that entered the data, since they are the Data Fiduciary for that data.

Each Organisation's data is isolated at the database level (row-level security plus a separate schema per Organisation), passwords are never stored in plain text, sensitive identifiers like PAN are stored only as one-way hashes, uploaded files are scanned for malware, and administrative actions are recorded in an audit log. [Sample — expand with your actual ISO/compliance certifications, if any, before publishing.]

[Sample placeholder — the DPDP Act requires a designated Grievance Officer with published contact details. Insert VakeelMitra's actual appointed Grievance Officer's name, email, and postal address here before this policy is published for real users.]

Each Organisation using VakeelMitra can separately designate its own Grievance Officer for data it controls, from Admin → Data Protection inside the platform.

VakeelMitra is a business tool for legal practitioners and is not directed at, or knowingly used to collect data from, children.

We may update this policy from time to time. Material changes will be reflected in the "Last updated" date above, and for changes to how AI providers process data, a fresh consent will be required before the change takes effect for that Organisation.

A verified advocate may choose to be listed in the Lawyers Directory in the Client Portal. Listing is optional, free and entirely the advocate's decision; it happens only after the advocate reads and agrees to the Lawyers Directory terms and ticks a consent box.

What is shown. Only the details Rule 36 of the Bar Council of India Rules allows an advocate to publish: name, firm, address, city, the telephone number and email the advocate chooses, enrolment number and date, State Bar Council, bar association, qualifications and areas of practice.

To whom. Only people signed in to the VakeelMitra Client Portal, and only after they acknowledge a disclaimer. The directory is not public and is not indexed by search engines. Separately, a client always sees the contact details of the advocates assigned to their own matters at a firm they already instruct.

Consent record and withdrawal. We keep an append-only record of each decision to agree, decline or withdraw — which terms version, when, from which device and network address, and the details shown at that moment. An advocate can update their details or remove their listing at any time from their profile; removal takes effect immediately. A listing is hidden automatically if the advocate's bar verification lapses, their firm's account is not active, or the terms change until they agree again.

VakeelMitra does not rank, rate, recommend, match or refer advocates, and does not collect or pass on enquiries or client details through the directory.

[Sample placeholder — insert VakeelMitra's actual registered business name, address, and a real contact email before publishing.]