Privacy Policy

1. Who we are and what this covers

LawyerService ("LawyerService", "we", "us") operates the lawyerservice.com website, the practice-management application for advocates, and the client portal. This policy explains how we handle personal data of website visitors, advocates and law firms ("lawyers"), and their clients who use the portal ("clients"). It is written to align with the Digital Personal Data Protection Act, 2023 ("DPDP Act") and the Information Technology Act, 2000.

2. Two roles, explained honestly

Two kinds of personal data live on LawyerService, and our role differs for each:

• Your account data. For the data you give us to create and run your own account (name, email, phone, enrolment number, billing details), we act as the data fiduciary and decide how it is processed under this policy.
• Case and client data entered by lawyers. When a lawyer records case details, party names, documents or invoices, that lawyer is the data fiduciary for the people described in those records. We process that data only on the lawyer's instructions, to provide the service. Lawyers are responsible for having the right to record that information, in line with their professional obligations.

3. What we collect

• Account and profile data: name, email address, mobile number, password (stored only as a secure hash by our authentication provider), and for lawyers: bar enrolment details, practice details, chamber address and profile photo.
• Verification data: one-time codes sent to your email and phone during signup, and the verified status of each.
• Workspace content: cases, parties, hearings, notes, tasks, drafts, messages, invoices, expenses, timesheets and uploaded documents. Clients see only what their lawyer shares to their portal.
• Payment data: subscription status and invoice history. Card and bank details are handled by our payment provider and never stored on our servers.
• Usage and device data: log records such as sign-in times, IP address and browser type, used for security and troubleshooting.

4. What we use it for

• Providing the workspace: storing your cases, syncing updates to the client portal, sending hearing reminders and notifications you have asked for.
• Verifying accounts and keeping them secure.
• Billing and subscription management.
• Support, and service emails such as invoices, reminders and security notices.
• Improving the product using aggregate, de-identified usage patterns.

We do not sell personal data, and we do not use your case data for advertising or to train AI models.

5. Where your data lives

All data at rest (database, uploaded files, backups) is stored on Google Cloud infrastructure in Indian regions (Mumbai, asia-south1). AI processing for Ask AI runs on Vertex AI in the Mumbai region. Keeping data in India is a design commitment of this product, not an option we toggle.

6. AI features and consent

Ask AI answers questions from a case's uploaded documents. It runs only when two consents are both in place: a global AI consent you switch on in Settings, and a per-case consent on each specific case. Until then, no document is read or indexed by AI. If you withdraw either consent, AI reading and answering for that scope stops immediately. AI answers are generated from your documents and can be wrong; they are an aid, not legal advice, and the advocate remains responsible for verifying them.

7. Service providers we rely on

We use a small set of processors to run the service, under contracts that limit them to processing on our instructions:

• Google Cloud / Firebase (hosting, database, file storage, authentication, AI processing), Indian regions.
• SendGrid (delivery of transactional emails such as invites, invoices and reminders). Message content transits SendGrid's delivery network.
• Twilio (SMS reminders and phone verification codes). Message content transits Twilio's delivery network.
• eCourts data provider (case-status lookup). When you use the eCourts refresh, the case number or CNR you enter is sent to the lookup service to fetch the public court record. No other case content is sent.
• Payment provider (subscription payments). They handle your card or UPI details under their own policy.

8. When we share data

Only in three situations: with the processors above so the service works; when a law, court order or government authority lawfully requires it; or if you ask us to. Within the product, sharing follows your choices: a client sees a case only after their lawyer invites them, and only the hearings, documents and updates the lawyer marks as shared.

9. Security

• Encryption in transit (TLS) and at rest.
• Per-lawyer data isolation enforced by database security rules: one lawyer's workspace is not readable by another's account, and client portal accounts can read only the cases explicitly granted to them.
• Email and phone verification before an account becomes active.
• Access to production systems is restricted and logged.

10. Retention and deletion

Your data stays as long as your account is active. If you cancel, your workspace remains exportable for 90 days, after which it is scheduled for deletion from live systems, with backups expiring on their own cycle within a further 90 days. We may retain the minimum records needed for tax and legal compliance (for example, invoices we issued to you). You can request earlier deletion at any time.

11. Your rights

Under the DPDP Act you can ask us, for data where we are the fiduciary, to:

• Access a summary of the personal data we hold about you.
• Correct inaccurate or incomplete data.
• Erase your data, subject to legal retention requirements.
• Nominate a person to exercise your rights if you are unable to.
• Have your grievance heard and redressed.

For personal data inside a lawyer's case records, please contact that lawyer first, since they are the fiduciary for it; we will support them in honouring your request. To exercise any right with us, email support@lawyerservice.com. We respond within the timelines the DPDP Act prescribes.

12. Grievance redressal

Complaints and grievances about data handling go to our Grievance Officer at support@lawyerservice.com (subject line "Grievance"). We acknowledge within 48 hours and aim to resolve within 15 days. If you are not satisfied with our response, you may approach the Data Protection Board of India.

13. Children

LawyerService is not directed at children. Lawyer accounts require you to be an adult entitled to practise; client portal accounts are created on a lawyer's invitation. We do not knowingly process children's data except where it appears inside a lawyer's case records under the lawyer's responsibility.

14. Changes to this policy

If we change this policy in a way that matters, we will notify you by email or an in-app notice before the change takes effect, and update the date at the top of this page.

15. Contact

LawyerService · support@lawyerservice.com. We usually reply within one business day.