Privacy Policy

3.1 Account and Registration Data

• Full name, professional designation (Advocate, Associate, Partner, Counsel)
• Email address, mobile number
• Bar Council registration number or enrolment certificate details
• Law firm name, office address, state of practice
• Password (stored in hashed, salted format)

3.2 Usage and Technical Data

• IP address, browser type, operating system, device identifiers
• Pages visited, features used, session duration, clickstream data
• API call logs, query timestamps, feature interaction data
• Error logs and crash reports for platform improvement

3.3 User-Uploaded Content

• Legal documents, contracts, briefs, pleadings, or any files uploaded for AI analysis
• Queries, prompts, and instructions submitted to the AI engine
• AI-generated outputs and any annotations or edits made by the user

3.4 Payment Data

• Billing name, GST number (for business accounts)
• Payment method details are processed by our third-party payment gateway (Razorpay) and are not stored on Yugality's servers

3.5 Communications Data

• Emails or messages sent to our support team
• Feedback, survey responses, and testimonials (with consent)

• Account creation and user authentication: Consent under DPDP Act 2023
• Providing contracted SaaS services (AI legal research, drafting, review): Contractual necessity
• Processing payments and invoicing: Contractual necessity / Legal obligation
• Platform security, fraud prevention, abuse detection: Legitimate use
• Improving AI model accuracy via anonymised, aggregated analytics: Legitimate use
• Sending product updates, feature announcements (opt-in): Consent
• Compliance with court orders or regulatory directives: Legal obligation

We do not sell, rent, or trade your personal data. We may share data only in the following limited circumstances:

• Sub-processors: AI model API providers and cloud infrastructure providers operating under contractual confidentiality and data processing obligations. A current list of sub-processors is available upon written request.
• Legal compliance: Where required by a court order, statutory authority, or law enforcement agency acting under lawful authority.
• Business transfers: In the event of a merger, acquisition, or restructuring, subject to the acquiring entity assuming equivalent data protection obligations.

Under the DPDP Act 2023, you have the following rights:

• Right to access: Request a summary of personal data we hold about you.
• Right to correction: Request correction of inaccurate or incomplete personal data.
• Right to erasure: Request deletion of your personal data, subject to legitimate retention requirements.
• Right to grievance redressal: Lodge a complaint with our Grievance Officer (see Document 11).
• Right to withdraw consent: Withdraw consent at any time; withdrawal does not affect lawfulness of prior processing.
• Right to nominate: Nominate another individual to exercise rights on your behalf in the event of incapacity or death.

8. Data Retention

• Account data: Retained for the duration of the subscription and 3 years thereafter for compliance purposes.
• User-uploaded documents and AI outputs: Retained for the active subscription period; permanently deleted within 30 days of account termination unless legally required otherwise.
• Payment records: Retained for 8 years as required under the Income Tax Act, 1961.
• Server logs: Retained for 180 days.