Privacy Policy

Data Fiduciary: Abhay Tripathi, operating NyayaVeda AI at www.nyayaveda.co.in

Grievance Officer: Abhay Tripathi  |  support@nyayaveda.co.in |  NyayaVeda AI, Lucknow, Uttar Pradesh — 226001, India

General contact: support@nyayaveda.co.in

• Account data: Email address (via Firebase Authentication)
• Query data: Legal research queries you submit (max 5,000 characters), stored to provide history feature
• Voice input (optional): If you use the microphone in the web app to dictate a query, your speech is converted to text by your browser's own built-in speech recognition — provided and processed by your browser vendor (for example, Google, for Chrome), not by NyayaVeda AI; only the resulting text reaches us. If you use voice transcription through our API, your audio is sent to Google Cloud Speech-to-Text for transcription (see Section 4).
• Payment data: Transaction ID and amount — processed exclusively by Razorpay. We do not store card numbers, CVVs, or bank account details.
• Usage analytics: Query count, model tier used, response time — anonymised, not linked to identity
• Usage and billing records: For every request you make, on every plan including Free, we record the credits charged and the model cost of that request, together with the time and the feature used. Unlike the anonymised usage analytics above, this is tied to your account; we use it to enforce your plan's daily credit allowance and spend limit, to show you your own usage, and for billing and abuse prevention.
• Documents you upload: PDFs/images are processed in memory and in short-lived temporary files on our servers, and are permanently deleted immediately after analysis.
• Device/log data: IP address, browser type (server logs, retained 7 days for security)

We do NOT collect: Aadhaar numbers, PAN, financial account details, biometric data, health data, or political opinions. We do not knowingly collect data from children under 18.

We do not use your data for advertising, profiling, or selling to third parties — ever.

We use the following sub-processors to run the service. Where a sub-processor receives your query text or document text for AI inference, it is used for that purpose only — never for training their models:

• Google Cloud — runs our application servers and cache (Mumbai region); Google LLC also provides AI inference (Gemini models, via Vertex AI) under a Data Processing Addendum — your query text is used for inference only, never for training.
• Amazon Web Services — stores your account details, query history, payment records and audit logs (Mumbai region), and hosts the Anthropic models we use for AI inference under a Data Processing Addendum — your query text is used for inference only, never for training.
• Anthropic — provider of the AI models Amazon Web Services hosts for us (above); engaged on the same inference-only, no-training basis.
• Google Cloud Speech-to-Text — transcribes your audio only if you use voice transcription through our API; the web app's microphone instead uses your browser's own speech recognition (see Section 2).
• Firebase / Google Identity Platform — authentication only
• Razorpay — payment processing only
• Amazon SES — sends transactional email (receipts, service and security notices) only

Where your data is stored and processed. Your account details, query history and payment records are stored on servers in India, and the application that handles your request runs on servers in India too. To generate an answer, the text of your question and the legal sources retrieved for it — and, for document or voice features, the text or audio you submit — are sent to the AI providers named above, which may process it outside India, including in the United States. Section 16 of the Digital Personal Data Protection Act, 2023 permits transfers of personal data outside India except to countries the Central Government restricts by notification, and we will not transfer personal data to a restricted country.

We do not sell, rent, or share your personal data with any other third party. We may disclose data to law enforcement if required by a valid court order or statutory obligation under Indian law.

• Query history: retained until you delete it or close your account
• Uploaded documents: permanently deleted immediately after analysis — zero retention
• Payment records: retained for 7 years (Income Tax Act 1961 + GST requirements)
• Account data: deleted within 30 days of account deletion request
• Security logs (IP, access logs): deleted after 7 days
• Anonymised usage analytics: retained indefinitely (no personal data link)
• Usage and billing records (credits charged, model cost, time, feature used): kept with the request they describe — see Query history above — for as long as your account is active

• Right of Access (§11): Request a copy of personal data we hold about you
• Right of Correction (§12): Request correction of inaccurate or incomplete personal data
• Right of Erasure (§12): Request deletion of personal data (subject to legal retention obligations)
• Right to Withdraw Consent (§6): Withdraw consent at any time — this will result in account termination as data processing is necessary for the service
• Right to Grievance Redressal (§13): Lodge a complaint with our Grievance Officer (see Section 1)
• Right to Nominate (§14): Nominate an individual to exercise your rights in the event of death or incapacity
• Right to complain to Data Protection Board: If your grievance is not resolved within 30 days, you may approach the Data Protection Board of India

To exercise any right, email support@nyayaveda.co.in with subject: "Data Request — [Right Type] — [Your Name]". We will acknowledge within 72 hours and respond within 30 days.

NyayaVeda AI is a professional legal research platform intended exclusively for individuals aged 18 and above — specifically advocates, law students under professional supervision, and legal researchers.

We do not knowingly collect personal data from children under 18. If you believe a minor has provided us data without parental consent, contact support@nyayaveda.co.in immediately and we will delete it within 72 hours.

• Data in transit: TLS 1.3 encryption on all connections
• Data at rest: encrypted database storage (AES-256)
• Hosting and storage region: India — application servers and cache run from Mumbai (Google Cloud); database, audit logs, file storage and payment records are stored in Mumbai (Amazon Web Services). AI inference may run outside India — see Section 4.
• Authentication: Firebase Identity Platform with short-lived, automatically-rotated access tokens
• API keys: stored as HMAC-SHA256 hashes — never in plaintext
• Access controls: role-based, principle of least privilege
• Security audits: conducted bi-annually (last completed August 2026)

In the event of a personal data breach that is likely to result in risk to your rights and freedoms, we will:

• Notify affected Data Principals by email within 72 hours of becoming aware
• Report to the Data Protection Board of India as required under DPDP Act 2023
• Take immediate steps to contain and remediate the breach

Cookies (strictly necessary only — no consent banner required):

• nyv-session — a session-presence flag (a value only, no personal data) that lets us route you to sign-in when your session ends. SameSite=Strict, Secure; short-lived and cleared when you sign out.

No advertising, tracking, or third-party analytics cookies. No Google Analytics, Facebook Pixel, or similar trackers.

Browser Storage:

• localStorage: Your sign-in session (managed by Firebase Authentication so you stay signed in across visits), plus your theme preference, jurisdiction preference, and notification settings
• sessionStorage: Session fingerprint for security, client-side rate-guard counters
• Clear all local data — including your sign-in session — from Dashboard → Settings → Privacy → Clear Local Cache, or by signing out

Server-side Caching:

• Rate limiting counters (sliding window, auto-expires per request window)
• Query queue tracking (expires after 90 seconds)
• Answer cache, up to 7 days: so that an identical question is not answered twice, we keep the answer to it in our in-memory cache, looked up by a hash of the question text and kept apart by plan and by organisation. An answer can restate details you wrote in your question.
• Similar-question cache, up to 7 days: a second tier, stored in our database, recognises a question similar to an earlier one. An answer is served from it only to the user who asked the earlier question.

CDN / HTTP Caching:

• Static assets (JS/CSS/fonts): immutable cache, 365 days (content-hashed filenames)
• HTML pages: no-cache, must-revalidate
• API responses: never cached on CDN (Cache-Control: private, no-store)

NyayaVeda AI uses automated processing to generate legal research results. This is a research assistance tool — outputs do not constitute binding decisions affecting your legal rights. All outputs require human review and independent verification before reliance.

Rate limiting and fraud detection are automated. If you believe an automated decision has incorrectly restricted your account, contact support@nyayaveda.co.in.

NyayaVeda AI may update this Privacy Policy at any time. An update takes effect as soon as it is published on this page with its new “Last updated” date above; your continued use of the service after that date constitutes acceptance of the revised policy. Where an update changes the purposes for which we process your personal data, we will also tell you by email or in the app, and seek your consent where the law requires it, before relying on it. The current version is always available at www.nyayaveda.co.in/legal/privacy.

Prices, plans and usage limits are governed by our Terms of Service, which NyayaVeda AI may also change at any time.

Grievance Officer: Abhay Tripathi
Email: support@nyayaveda.co.in
Address: NyayaVeda AI, Lucknow, Uttar Pradesh — 226001, India
Response time: Acknowledge within 72 hours · Resolve within 30 days (DPDP Act 2023 §13)

If your grievance is unresolved within 30 days, you may escalate to the Data Protection Board of India.