Privacy Policy

Data Fiduciary: Abhay Tripathi, operating NyayaVeda AI at www.nyayaveda.co.in

Grievance Officer: Abhay Tripathi  |  grievance@nyayaveda.co.in |  NyayaVeda AI, Lucknow, Uttar Pradesh — 226001, India

General contact: support@nyayaveda.co.in

• Account data: Email address (via Firebase Authentication)
• Query data: Legal research queries you submit (max 5,000 characters), stored to provide history feature
• Payment data: Transaction ID and amount — processed exclusively by Razorpay. We do not store card numbers, CVVs, or bank account details.
• Usage analytics: Query count, model tier used, response time — anonymised, not linked to identity
• Documents you upload: PDFs/images processed in-memory and permanently deleted immediately after analysis. Never stored on disk.
• Device/log data: IP address, browser type (server logs, retained 7 days for security)

We do NOT collect: Aadhaar numbers, PAN, financial account details, biometric data, health data, or political opinions. We do not knowingly collect data from children under 18.

We do not use your data for advertising, profiling, or selling to third parties — ever.

Your query text is sent to the following sub-processors for AI inference only — not for training their models:

• Google LLC (cloud AI inference) — India region (Mumbai). Governed by the applicable Data Processing Addendum.
• Amazon Web Services (cloud AI inference) — India region (Mumbai). Governed by the applicable Data Processing Addendum.
• Firebase / Google Identity Platform — authentication only
• Razorpay — payment processing only

All data is processed within India (Mumbai region). We do not transfer personal data outside India except where required by applicable law.

We do not sell, rent, or share your personal data with any other third party. We may disclose data to law enforcement if required by a valid court order or statutory obligation under Indian law.

• Query history: retained until you delete it or close your account
• Uploaded documents: permanently deleted immediately after analysis — zero retention
• Payment records: retained for 7 years (Income Tax Act 1961 + GST requirements)
• Account data: deleted within 30 days of account deletion request
• Security logs (IP, access logs): deleted after 7 days
• Anonymised usage analytics: retained indefinitely (no personal data link)

• Right of Access (§11): Request a copy of personal data we hold about you
• Right of Correction (§12): Request correction of inaccurate or incomplete personal data
• Right of Erasure (§12): Request deletion of personal data (subject to legal retention obligations)
• Right to Withdraw Consent (§6): Withdraw consent at any time — this will result in account termination as data processing is necessary for the service
• Right to Grievance Redressal (§13): Lodge a complaint with our Grievance Officer (see Section 1)
• Right to Nominate (§14): Nominate an individual to exercise your rights in the event of death or incapacity
• Right to complain to Data Protection Board: If your grievance is not resolved within 30 days, you may approach the Data Protection Board of India

To exercise any right, email grievance@nyayaveda.co.in with subject: "Data Request — [Right Type] — [Your Name]". We will acknowledge within 72 hours and respond within 30 days.

NyayaVeda AI is a professional legal research platform intended exclusively for individuals aged 18 and above — specifically advocates, law students under professional supervision, and legal researchers.

We do not knowingly collect personal data from children under 18. If you believe a minor has provided us data without parental consent, contact grievance@nyayaveda.co.in immediately and we will delete it within 72 hours.

• Data in transit: TLS 1.3 encryption on all connections
• Data at rest: encrypted database storage (AES-256)
• Deployment region: India (Mumbai)
• Authentication: Firebase Identity Platform with session-scoped tokens
• API keys: stored as HMAC-SHA256 hashes — never in plaintext
• Access controls: role-based, principle of least privilege
• Security audits: conducted bi-annually (last completed August 2026)

In the event of a personal data breach that is likely to result in risk to your rights and freedoms, we will:

• Notify affected Data Principals by email within 72 hours of becoming aware
• Report to the Data Protection Board of India as required under DPDP Act 2023
• Take immediate steps to contain and remediate the breach

Cookies (strictly necessary only — no consent banner required):

• Firebase auth session token — SameSite=Strict, Secure; session-scoped (cleared on browser close)
• nyv_plan — Current subscription plan for rate-limit headers (session-scoped)

No advertising, tracking, or third-party analytics cookies. No Google Analytics, Facebook Pixel, or similar trackers.

Browser Storage:

• localStorage: Theme preference, notification settings — no personal data
• sessionStorage: Session fingerprint for security, client-side rate-guard counters
• Clear all local data: Dashboard → Settings → Privacy → Clear Local Cache

Server-side Caching (in-memory cache — no PII):

• Rate limiting counters (sliding window, auto-expires per request window)
• Query queue tracking (expires after 90 seconds)
• Anonymised query hash cache for identical queries (24h TTL)

CDN / HTTP Caching:

• Static assets (JS/CSS/fonts): immutable cache, 365 days (content-hashed filenames)
• HTML pages: no-cache, must-revalidate
• API responses: never cached on CDN (Cache-Control: private, no-store)

NyayaVeda AI uses automated processing to generate legal research results. This is a research assistance tool — outputs do not constitute binding decisions affecting your legal rights. All outputs require human review and independent verification before reliance.

Rate limiting and fraud detection are automated. If you believe an automated decision has incorrectly restricted your account, contact support@nyayaveda.co.in.

Material changes to this Privacy Policy will be communicated by email at least 14 days before taking effect. Continued use after the effective date constitutes acceptance. The current version is always available at www.nyayaveda.co.in/legal/privacy.

Grievance Officer: Abhay Tripathi
Email: grievance@nyayaveda.co.in
Address: NyayaVeda AI, Lucknow, Uttar Pradesh — 226001, India
Response time: Acknowledge within 72 hours · Resolve within 30 days (DPDP Act 2023 §13)

If your grievance is unresolved within 30 days, you may escalate to the Data Protection Board of India.