Privacy Policy

This policy explains how Vidyadhari AI ("we", "us", "our"), which owns and operates LegalOpine and this website (legalopine.in), collects, uses, stores and protects personal data. It is published under the Information Technology Act, 2000, the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, and the Digital Personal Data Protection Act, 2023 ("DPDP Act").

• For enquiry, account and billing data (people who write to us through this website, the advocates, staff and clients who sign in to LegalOpine, and the firms that subscribe), we decide why and how the data is used. We are the Data Fiduciary. • For matter data (the documents a firm or its clients upload, the text read from them, and the particulars, findings and opinions prepared in LegalOpine), the subscribing law firm decides why the data is processed. The firm is the Data Fiduciary and we act as its Data Processor, only on its instructions. Questions about matter data should first go to the firm handling the matter.

• Enquiries through this website: this website's pages are static and do not collect profile data. When you send an enquiry through its form, the details you type in (your name, email, phone number if you give one, your chambers or firm, role, state of practice, the opinions you write and your message) pass through a form handler hosted on Cloudflare, which checks that the request is genuine and emails it to our enquiry inbox. The form handler does not keep a copy. • Account data: name, email address, phone number, role, password (stored only as a one-way hash), and sign-in records such as time and IP address. • Firm data: firm name, Bar Council enrolment number, GSTIN, address, plan and billing details. • Matter data: uploaded files (title deeds, revenue records, contracts, pleadings, corporate records and similar), text extracted from them by OCR, and the particulars, parties, findings and opinions recorded against them. These often contain personal data of third parties, such as names, addresses, family relationships and property details. • Usage data: counts of matters, documents and pages processed, used to apply plan limits, and security logs. We do not ask for, and firms should not upload, more personal data than the matter needs.

• To reply to your enquiry, arrange a demonstration and set up early access for your firm. • To provide LegalOpine: sign-in, document reading (OCR), classification, risk checks, timelines and opinion drafting. • To keep each firm's data separate and secure, prevent misuse and investigate incidents. • To apply subscription limits, bill and provide support. • To meet legal obligations, such as tax records and lawful requests from authorities. We do not sell personal data, use it for advertising, or use matter data to train artificial-intelligence models.

OCR, document classification and rule-based risk checks run on our own servers. A firm may choose to enable features that send text to an external AI provider to help draft opinions. This happens only after the firm has opted in, and then only the minimum text needed is sent, under contracts that forbid the provider from keeping it or training on it. Before text is sent, names, identity numbers, contact details and addresses are replaced with placeholders, and restored only when the answer returns. Machine output is a starting point for the advocate's review. It is never a legal decision.

This website and LegalOpine work without tracking cookies, advertising pixels or cross-site tracking. LegalOpine uses only the essential cookies needed to keep you signed in and to protect your session. This website loads fonts from Google Fonts and icons from Cloudflare; as with any web request, those services receive your IP address when your browser fetches the files. Its enquiry form uses Cloudflare Turnstile, a security check that tells people apart from automated spam; it does not use advertising cookies or track you across sites.

• Within a firm: people the firm has given access. A client with a portal login sees only their own matters. • Service providers who host, store, secure or bill for LegalOpine, and Cloudflare, which serves this website and handles its enquiry form. Each is bound by a contract to protect the data and use it only to serve us. • Authorities, when Indian law requires it. LegalOpine staff do not open a firm's matter data, except when the firm grants time-limited support access or the law requires it.

Our application servers are in India. Where a service provider stores data outside India, we do so only as the DPDP Act and the rules made under it permit. This website is served through Cloudflare's network, which serves each visitor from the location nearest to them. We keep enquiries while we are in discussion with you or your firm, and for as long as your firm remains our customer. We keep account data while the account is active and for as long as the law requires afterwards. Matter data is kept for as long as the subscribing firm keeps it in LegalOpine. When a firm deletes a matter or ends its subscription, the data is deleted after the retention period stated in its subscription, except where the law requires us to keep it. Only the latest two OCR versions of each file are kept.

Each firm's data is kept apart by row-level security in the database. All traffic is encrypted in transit. Passwords are hashed. Stored files can only be reached through LegalOpine, and access is logged. No system is perfectly secure. If a personal data breach occurs, we will inform the affected firms, and the Data Protection Board of India where required.

Under the DPDP Act you may ask for: • a summary of the personal data processed about you; • correction, completion or erasure of that data; • grievance redressal; and • a nominee to exercise these rights for you. Where we process data on the basis of consent, you may withdraw it. Requests about matter data are passed to, and decided by, the firm concerned. We may need to verify your identity before acting on a request.

LegalOpine is for advocates, their staff and their clients, and is not meant for anyone under 18. Where a matter involves a minor's personal data, the firm is responsible for any consent from a parent or guardian that the law requires.

To raise a privacy question or grievance, write to privacy@legalopine.in, addressed to the Grievance Officer, Vidyadhari AI. We acknowledge grievances within 48 hours and aim to resolve them within 30 days. If you are not satisfied, you may approach the Data Protection Board of India. Our Grievance Redressal page explains the process.

We will post any change to this policy here and update the date above. We will notify subscribing firms of material changes before they take effect.