Welcome to KanoonHQ (operated by KanoonHQ Legal Tech Private Limited, hereinafter referred to as the "Company", "we", or "us"). As a Data Fiduciary under the Digital Personal Data Protection (DPDP) Act, 2023 (India), we are committed to safeguarding the digital personal data of our users ("Data Principals" or "you"). This privacy notice explains the categories of data we process, how we secure it, and the rights you hold in relation to your personal data.
1. Notice of Data Processing
Under Section 5 of the DPDP Act, 2023, this notice is provided to explain the categories of digital personal data we collect, the purposes for which we process it, the manner in which you can exercise your rights, and the redressal mechanism for grievances. Consent requested by us is free, specific, informed, unconditional, and unambiguous, given through a clear affirmative action.
2. Digital Personal Data We Collect
We only collect digital personal data that is strictly necessary for supplying our legal workspace services. This includes:
| Category | Data Elements Collected |
|---|---|
| Identity & Contact | Phone number, full name, email address, WhatsApp number. |
| Professional Details | Advocate details, license numbers (optional), role designation (advocate/litigant). |
| Legal Cases & Documents | Case numbers, filing history, court orders, OCR transcripts, uploaded legal PDFs and images. |
| Billing & Payments | Razorpay transaction IDs, subscriptions, billing history. (We do not store credit card credentials). |
| Technical Metadata | IP address, browser user-agent, device identifier, audit log telemetry, and push notification tokens. |
3. Purposes and Legal Basis of Processing
We process your digital personal data under the legal basis of your explicit consent (DPDP Act §6) and legitimate uses (DPDP Act §7) for the following purposes:
- Identity Verification: Using secure SMS/WhatsApp OTPs to authenticate your account and prevent unauthorized access.
- AI Analysis: Extracting, OCRing, and summarizing uploaded legal documents and court orders through LLM interfaces.
- Case Tracking: Automatically scraping public judicial causelists and status endpoints from eCourts on your behalf.
- Notifications & Reminders: Dispatching real-time hearing reminders and case status alerts via WhatsApp, SMS, or Push.
- Security Operations: Maintaining cryptographic session logs, enforcing security rate limits, and keeping security audit trails to prevent fraud.
4. Third-Party Disclosures & Cross-Border Transfers
To run the application, we disclose certain digital data to service providers (Data Processors) under strict data protection agreements.
Our Service Providers:
- 🖥️ Amazon Web Services (AWS): Application servers, background workers, local embeddings, cross-encoder reranking, and scheduled jobs. Location: AWS Mumbai (ap-south-1), India.
- 🌐 Supabase Cloud: Relational database hosting, authentication and document storage. Location: AWS Mumbai (ap-south-1), India.
- ✉️ MSG91: Authentication OTP SMS and WhatsApp notification delivery. Location: India.
- 💳 Razorpay: Payment processing infrastructure and billing gateway. Location: India.
- 🤖 Google (Gemini): Primary LLM endpoints for case analysis, legal Q&A and drafting. Location: outside India (cross-border).
- 🤖 Sarvam AI: Indic-language drafting and translation, and speech-to-text for meeting recordings and dictation. Location: Indian provider.
- 🤖 Anthropic (Claude): Nyaya AI’s Deep Research mode, which reads your question and any linked case context to research and cite authorities. Requests currently reach Anthropic through OpenRouter. Location: United States (cross-border).
- 🤖 OpenRouter: Fallback LLM endpoint used when the primary provider is unavailable, and currently the route by which Deep Research requests reach Anthropic. Location: United States (cross-border).
- 🤖 TypeSafe (Jev): Small classification checks on the legal text Nyaya AI retrieves; it generates no text. It receives the search query behind an answer, which is derived from your question and, in Deep Research, from any linked case context, together with the public statute or judgment excerpt being checked. For claim-support checks it receives one sentence stating what a provision says, with personal identifiers such as phone, Aadhaar, PAN, email and account numbers removed, alongside that provision’s text. It never receives your uploaded case documents. Location: United States (cross-border).
- 🔎 NVIDIA NIM: Re-ranking of search results, used only when our own re-ranking service is unavailable. It receives your search query and candidate legal text, and generates no answers. Location: United States (cross-border).
- 🎙️ Groq: Fallback speech-to-text for meeting recordings and dictation, used when the primary transcription provider is unavailable. Location: United States (cross-border).
- ⚖️ Indian Kanoon: Judgment lookup and citation verification. We send only the name of the case that you or Nyaya AI cite, never your case documents or your question. Location: India.
- ⚡ Upstash Redis: Caching, rate-limiting, background job queue and OTP storage. Location: managed cloud.
- 🔎 Qdrant: Vector search. Two separate indexes: the public legal corpus (Acts and judgments), and a private index for your uploaded case documents which stores the document text alongside its embeddings. Location: managed cloud — see the note below.
- 🐞 Sentry: Crash and error reporting, configured to exclude stack-frame local variables. Location: outside India (cross-border).
- 📈 PostHog: Product analytics; session recordings mask all text and inputs by default. Location: outside India (cross-border).
- 📧 Resend: Transactional email (invitations, notifications). Location: outside India (cross-border).
- 📲 Expo Push: Mobile push-notification delivery for hearing alerts.
Cross-border transfers: Your case records, documents and account data are stored in India. Some processing nonetheless happens outside India, as marked above — principally AI inference, plus error reporting, analytics and email. We transfer only the minimum data needed for each purpose, under TLS encryption and the providers’ data-protection terms, and only to jurisdictions not restricted by the Central Government under Section 16 of the DPDP Act 2023. We do not sell personal data or share it for third-party advertising.
5. Data Processing Agreement & Cross-Border Disclosure
Where KanoonHQ Legal Tech Private Limited acts as a Data Fiduciary and engages third-party Data Processors, we do so only under written contracts that require each processor to:
- Process personal data only on documented instructions from us.
- Maintain appropriate technical and organisational security measures, including TLS in transit and encryption at rest.
- Notify us without undue delay upon becoming aware of any personal data breach.
- Delete or return all personal data to us at the end of the processing relationship, except where retention is required by law.
Some Data Processors (notably AI inference, error reporting, analytics, and email providers) operate outside India. We transfer only the minimum data necessary for the specific purpose, under the provider's data-protection terms and standard contractual safeguards, and only to jurisdictions not restricted by the Central Government under Section 16 of the DPDP Act, 2023. A list of processors, their roles, and locations is set out in Section 4.
6. Data Retention Policy
Under Section 8(7) of the DPDP Act, we delete personal data once the purpose for which it was collected is no longer served, or when you withdraw your consent. Our retention schedules are as follows:
- Uploaded Documents & PDFs: Retained in your workspace for the lifetime of your account or until you delete them. You can delete any document at any time from the Documents section; all user data is permanently removed when you delete your account.
- Meeting Recordings: Audio recordings are automatically deleted 30 days after upload. You can extend this by up to 90 additional days (3 extensions of 30 days each). Transcripts, summaries, and action items are retained for the lifetime of your account. You will be notified before automatic deletion and can download recordings at any time.
- Case Data & Analytics: Retained for the duration of your active account subscription, or until deleted by you.
- Inbound Push Tokens: Auto-purged after 90 days of inactivity.
- Billing Audit Logs: Maintained for a minimum of 7 years as required by Indian tax and corporate laws.
7. Rights of Data Principals
Under Chapter III of the DPDP Act, 2023, you possess the following statutory rights regarding your personal data:
Right to Access & Portability
You can request a summary of your personal data processed by us and download a complete structural export of your digital records via our settings panel.
Right to Correction & Erasure
You have the right to correct, complete, or request permanent deletion (erasure) of all your personal data stored within our workspace.
Right to Nominate
You have the right to nominate any other individual to exercise your data principal rights in the event of your death or incapacity.
Right to Grievance Redressal
You have the right to file a grievance with our Grievance Officer, and, if unresolved, raise it with the Data Protection Board of India.
8. Grievance Redressal Mechanism
If you have any questions, concerns, or wish to report a security incident or exercise your rights, please contact our designated Grievance Officer:
Grievance Officer
Name
Rajesh Kumar
Designation
Head of Data Compliance
Email Address
Office Address
KanoonHQ Legal Tech, HSR Layout, Sector 6, Bangalore, India
9. Withdrawal of Consent & Account Deletion
You may withdraw your consent for data processing at any time with the same ease as it was given. Upon receipt of consent withdrawal, we will cease processing your personal data immediately unless required by law.
To delete your account and withdraw all consent, you can click on the "Delete Account" option inside the settings panel of either the mobile or web application. This initiates an automated script that erases all your digital records from our servers, storage buckets, and caches within 48 hours.