01Who we are
This policy is published by Vakil.ai Private Limited ("Vakil AI", "we", "us"), a company incorporated in India (CIN: [CIN]) with its registered office at [Registered office address].
Vakil AI is a technology company, not a law firm. We build software that gives general legal information. For the personal data you share with us, we are the data fiduciary under the Digital Personal Data Protection Act, 2023 ("DPDP Act") — meaning we decide why and how it is processed, and we are responsible for it.
This policy also follows the Information Technology Act, 2000 and the rules made under it, including the IT (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 and the IT (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021, to the extent they apply.
02What we collect
We only collect what we need to run Vakil. That falls into six groups:
- Account data — your name, email address, a securely hashed version of your password (we never store your actual password), and whether you are an advocate.
- What you tell us — descriptions of your situation and the messages you type into chat. These can include sensitive details about you or others, so please share only what is needed.
- Documents you upload — notices, agreements, letters and anything else you choose to share.
- Enquiry-form data — if you contact us about using Vakil on your platform: your name, work email, company and message.
- Technical and usage data — IP address, approximate location worked out from your IP address (city or region, not your precise location), device and browser type, and log-in and activity logs.
- Cookies — small files that keep you signed in. See section 11.
03Why we use it
We use each kind of data only for a specific purpose. Under the DPDP Act, we rely either on your consent or on a legitimate use permitted by section 7.
| Purpose | Data used | Legal basis |
|---|---|---|
| Create and run your account | Name, email, password hash, advocate status | Consent |
| Answer your questions and prepare your readiness pack | Situation descriptions, chat messages, uploaded documents | Consent |
| Reply to platform enquiries | Name, work email, company, message | Consent (you send it to us voluntarily) |
| Keep the service secure and prevent misuse | IP address, device and browser data, activity logs | Legitimate uses (s.7) and consent |
| Fix bugs and improve how Vakil works | Usage and technical data, in aggregate where possible | Consent |
| Meet legal obligations and respond to lawful requests | Any data we are legally required to keep or disclose | Legitimate uses (s.7) — compliance with law, court orders |
We will ask for fresh consent before using your data for any new purpose.
04How AI processes your information
Vakil uses artificial intelligence. When you describe a situation or upload a document, that input is processed by AI models — including models run by third-party model providers acting as our processors — to generate legal information for you.
- Second check. Answers are reviewed by a second AI system that checks for errors and unsafe content before you see them. This reduces mistakes; it does not remove them.
- No training on your data. We do not use your personal data to train third-party AI models, and our contracts with model providers do not permit them to do so.
- Human review is limited. A person at Vakil looks at your content only where needed for safety (for example, investigating misuse), to help you when you ask for support, or with your consent.
06Where your data is stored
We aim to store your data in India wherever practical. Some of our processors — for example, certain AI model providers and infrastructure services — may process data outside India.
Section 16 of the DPDP Act allows this, except to countries the Central Government restricts by notification. We will not transfer personal data to any restricted country, and we require every processor to protect your data to the standard set out in this policy.
07How long we keep it
- We keep your account data, chats and documents for as long as your account is active.
- When you delete your account or withdraw consent, or once the purpose is served, we delete your data or anonymise it so it can no longer identify you — unless the law requires us to keep it longer.
- Security and activity logs are kept for a limited period — long enough to investigate problems and meet legal requirements — and then deleted.
- Enquiry-form messages are kept for as long as needed to follow up on the enquiry.
08How we protect it
We take reasonable security safeguards, including:
- encryption of data in transit (HTTPS) and at rest;
- access controls, so only people who need data to do their job can reach it;
- logging of access to personal data; and
- regular review of our security practices and of our processors.
No system is perfectly secure. If a personal data breach happens, we will inform the Data Protection Board of India and affected users as the DPDP Act and Rules require, and report to CERT-In where applicable.
09Your rights
Under the DPDP Act, you have the right to:
- Access — get a summary of the personal data we hold about you and how we use it;
- Correction, completion and updating — fix anything inaccurate or incomplete;
- Erasure — ask us to delete your data when it is no longer needed;
- Grievance redressal — complain to us and get a response;
- Nominate — name another person to exercise your rights if you die or become unable to;
- Withdraw consent — as easily as you gave it. This does not affect processing already done, but we may no longer be able to provide parts of the service.
How to use your rights
Email [privacy@vakil.ai] from the address linked to your account (so we can confirm it is you). We will acknowledge your request promptly and respond within the time required by the DPDP Rules — and in any case within 30 days.
10Children
Vakil is not meant for anyone under 18. We do not have a process to obtain verifiable consent from parents or guardians, so we do not knowingly collect children's personal data. If you believe a child has given us their data, please email [privacy@vakil.ai] and we will delete it.
12Changes to this policy
We may update this policy as Vakil grows or the law changes. We will change the "Last updated" date above and, for significant changes, tell you by email or in the app before they take effect. Where a change needs your consent, we will ask for it.
13Grievance Officer and contact
If you have a question or complaint about your personal data, contact our Grievance Officer:
- Name: [Grievance Officer name]
- Email: [grievance@vakil.ai]
- Address: Vakil.ai Private Limited, [Registered office address]
We will acknowledge your complaint within 24 hours and aim to resolve it within the time set by law. If you are not satisfied with our response, you have the right to complain to the Data Protection Board of India.