Privacy Policy
Ley Legal is a legal research assistant for advocates practising in India. This page describes what personal data the service collects, why, who it is shared with, and how long it is kept. It is written to match what the software actually does.
1. Who is responsible
the operator of Ley Legal is the Data Fiduciary for the purposes of the Digital Personal Data Protection Act, 2023. Questions and requests under this policy go to the contact address published on this site.
2. What is collected
When you create an account
- Your name, as you enter it.
- Your email address, used to identify your account.
- Your WhatsApp number, which is required and is verified by a one-time code sent to it. The number is not stored until that code is confirmed.
- A password, stored only as an Argon2 hash. The password itself is never stored and cannot be recovered from what is stored - if you forget it, it is replaced, not retrieved.
If you choose to verify as an advocate
- Your Bar Council enrolment number and state. The enrolment number is encrypted at rest. A separate keyed hash of it is stored so that the same enrolment cannot be registered twice; that hash cannot be reversed to recover the number.
When you use the service
- Your questions and the answers given, so that a conversation has continuity and you can return to earlier research.
- WhatsApp messages exchanged with the bot, including delivery status.
- Usage records - which searches were run and how many credits they cost.
The service does not collect your contacts, your location, your device identifiers, or anything from other apps. There is no advertising and no third-party analytics or tracking script on this site.
3. Why
- To provide the service - answering legal research questions is the purpose you signed up for.
- To verify your number, which is how one account is kept distinct from another across the website and WhatsApp.
- To operate credits and billing, where you have purchased credits.
- To keep the service secure - detecting abuse, rate-limiting sign-in attempts, and preventing one account from being used to reach another's data.
Your questions are not used to train any machine-learning model.
4. Who your data reaches
The service is built on third parties who process data on its behalf. Each one receives only what it needs to do its job.
| Processor | What it receives | Why |
|---|---|---|
| Supabase (PostgreSQL) | All stored account and conversation data | Database hosting |
| Meta / WhatsApp | Your number and message content | Delivering the WhatsApp conversation |
| OpenAI | The text of your question and retrieved legal source material | Composing the answer |
| Indian Kanoon | Your search terms | Retrieving judgments |
| eCourts data provider | The CNR number you ask about | Case status lookups |
| Razorpay | Payment details, handled by them and not stored here | Buying credits |
Your data is not sold, rented, or shared with anyone for their own purposes. It is disclosed otherwise only where the law requires it.
Where your data is stored. The database is hosted in the Asia Pacific (Sydney) region, and the AI and case-law providers above process data outside India. By using the service you accept that your data is transferred and stored outside India for these purposes.
5. How long it is kept
A sweep runs automatically every night at 03:00 IST and deletes the following:
| Data | Kept for |
|---|---|
| Search history | 180 days |
| WhatsApp message log | 90 days |
| Webhook delivery records | 7 days |
| Expired sign-in sessions and one-time codes | 2 days after expiry |
Your account itself, and the credit ledger, are kept until you ask for deletion. The ledger is retained while the account exists because it is the record of what you paid for and what you spent.
6. Your rights
Under the DPDP Act, 2023 you may ask to access the personal data held about you, correct anything inaccurate, withdraw consent, erase your data, and nominate someone to exercise these rights if you are unable to. Write to the contact address published on this site and you will get a response within 30 days.
7. Deleting your data
To delete your account and the personal data associated with it, email the contact address published on this site from the address on the account, or send DELETE MY DATA to the bot from your registered WhatsApp number.
Your account, profile, chat history, search history and message log are then erased within 30 days. Records that must be kept for a legal or tax obligation - a payment receipt, for instance - are retained only for as long as that obligation lasts, and are not used for anything else.
8. Security
- Passwords are stored as Argon2 hashes and are never recoverable.
- Bar Council enrolment numbers are encrypted at rest.
- Sign-in sessions are held in cookies that page scripts cannot read.
- Every WhatsApp webhook is signature-verified before it is acted on.
- Traffic to this site is served over HTTPS only.
No system is perfectly secure. If a breach affects your personal data, you and the Data Protection Board of India will be notified as the DPDP Act requires.
9. Children
The service is for practising advocates and is not directed at anyone under 18. Accounts are not knowingly created for children.
10. Accuracy of answers
Ley Legal is a research aid, not legal advice, and does not create an advocate-client relationship. Citations are checked against the database before they are shown, but you remain responsible for verifying any authority before relying on it in practice.
11. Changes
If this policy changes materially, the date at the top changes and you will be told through the service before the change takes effect.