Nyaya Saathi AI Open App →
Nyaya Saathi AI
🔒 Security & Privacy Commitment

Your Legal Data Belongs
to You — Always

We built Nyaya Saathi on a simple principle: a legal AI platform should be the last place your clients’ confidences could ever leak. Here is exactly how we deliver on that promise.

✓No server-side case storage
✓No AI training on your data
✓DPDP 2023 compliant
✓BCI Rule 7 aligned
✓Razorpay PCI DSS Level 1
Our Commitment

Three Promises That Cannot Be Broken

These are not policy statements — they are enforced by how the system is built.

💬
Your conversations are never stored on our servers

Every AI message you send is processed in real-time and the response is returned to your browser. We do not write your query or the AI’s reply to any database. Your chat history lives only in your browser — not on our infrastructure. A breach of our servers cannot expose your legal conversations, because they are never there.

📁
Your clients’ data stays in your browser

Case files, client names, matter details, notes, and drafted documents are stored in your browser’s local storage — on your device. We have no access to this data. If you choose cloud backup, it goes directly to your own Google Drive or OneDrive. Our servers never see or hold your clients’ information.

🧠
Your data is never used to train AI

Nyaya Saathi uses Anthropic’s Claude API under commercial terms that explicitly prohibit using API inputs or outputs for model training. We do not use your legal questions, case facts, or documents to improve any AI system — ours or Anthropic’s. This is a contractual guarantee, not just a policy preference.

How It Works

Where Your Data Actually Goes

A transparent look at every data flow when you use Nyaya Saathi.

🗺️ Data Flow Architecture
💻
Your Browser
Case data lives here only
⟶
☁️
Nyaya Saathi
Function
Auth check + rate limit
⟶
🤖
Anthropic
Claude API
Processed & discarded
⟶
💬
Response
to Browser
Saved in your localStorage
What we write to our servers after each AI call:
Message count (+1) · Timestamp · Plan type — nothing else
📌 Your query and AI response are never written to our database — not even temporarily.
📌 Case files, client names, and drafted documents never leave your device unless you opt into your own Drive/OneDrive.
📌 For citation research, only search keywords are sent to Indian Kanoon — no personal data.
📌 Payments are handled entirely by Razorpay (PCI DSS Level 1). We never see card or UPI details.
Technical Safeguards

Security Controls in Place Today

Every control listed here is live — not planned.

✓
Firebase Auth on every API call
Every server function verifies your identity before acting. No unauthenticated access to any personal data.
✓
Server-side usage counting
Your message count is incremented by the server, not sent from your browser. Prevents manipulation of plan limits.
✓
Rate limiting — 4-second guard
The AI endpoint rejects requests arriving within 4 seconds of each other from the same user. Prevents scripted abuse.
✓
Per-plan AI token limits
Free and paid plans have strictly enforced token limits set server-side. Prevents cost abuse.
✓
Per-user Firestore isolation
Security rules enforce that each user can only read and write their own account document — not any other user’s.
✓
Razorpay signature verification
Every payment is validated with a timing-safe HMAC check before activating any plan upgrade.
✓
30-minute idle session timeout
Both advocate and corporate apps automatically sign you out after 30 minutes of inactivity — protecting shared-device scenarios.
✓
AI audit log (metadata only)
Each AI call records a timestamp, feature used, and model — never the content. Available to you under DPDP access rights.
✓
TLS / HTTPS everywhere
All data between your browser and our servers is encrypted in transit. All Firebase data is encrypted at rest by Google Cloud.
✓
Admin access strictly isolated
Admin functions verify a specific admin UID from a server environment variable. No user can elevate themselves to admin.
✓
Intake form spam protection
Client intake submissions are rate-limited to 3 per mobile number per 24 hours, preventing flooding of advocate inboxes.
✓
Security log retention — 1 year
Access and transaction logs are retained for a minimum of one year as required under the DPDP Rules 2025 baseline security standards.
Legal Compliance

DPDPA 2023 & DPDP Rules 2025

India’s Digital Personal Data Protection law and its 2025 Rules are the governing framework for how we handle your personal data.

⚖️
Digital Personal Data Protection Act, 2023
DPDP Rules 2025 notified 13 November 2025 · Full obligations phase through May 2027 · We operate ahead of each deadline
Phase 1 — Complete
Done as of November 2025
  • Grievance Officer designated
  • DPBI breach notification procedure
  • Cross-border transfer disclosures
  • Children’s verifiable consent mechanism
  • Security log retention commitment
  • 48-hour prior notice before erasure
Phase 2 — November 2026
Monitoring
  • Consent Manager registration (if applicable)
  • Cross-border transfer safeguard updates as MeitY whitelist is notified
Phase 3 — May 2027
Planned
  • Full Notice & Consent mechanism in-app
  • “My Data” self-service export & deletion portal
  • Automated data retention enforcement
  • Operational breach notification runbook
Why our architecture helps: The DPDPA defines “personal data” to include data about legal proceedings. Because your case facts and legal conversations are stored only in your browser and never reach our servers, our server-side exposure under DPDP is limited to account metadata (name, email, plan) — not your legal work.
For Legal Professionals

Supporting Your Professional Obligations

How Nyaya Saathi is aligned with the Bar Council of India Rules on client confidentiality.

🏛️
Bar Council of India Rule 7, Chapter II, Part VI

The BCI Rules require advocates to maintain strict confidentiality of all client communications. Nyaya Saathi is designed as a drafting and research aid, not a repository of client confidences. We have implemented the following to support your compliance:

  • No server-side case storage — your clients’ matters never leave your device
  • Anthropic commercial API — your queries are not used for training; processed and discarded
  • In-app BCI notice — every AI chat session displays a reminder of your professional obligations
  • Best practice guidance — avoid including client names in research queries; use initials or “my client”
Notice displayed in every AI session: “Processed by Claude (Anthropic API) · Not used for AI training · Your case data stays in your browser only · Avoid including client names in research queries (BCI Rule 7)”
Your Rights

What You Can Always Ask Us to Do

Under the DPDPA 2023, you have the following rights as a Data Principal. Contact us at any time to exercise them.

📄
Access

Request a copy of the personal data we hold about you on our servers (name, email, plan, usage counts).

✏️
Correction

Request correction of any inaccurate personal data we hold about you.

🗑️
Erasure

Request deletion of your account and all associated data. We comply within 30 days except where law requires retention (e.g., tax records).

🚫
Withdraw Consent

Withdraw your consent to data processing at any time. This may affect your ability to use the service.

👥
Nominate

Nominate another person to exercise your data rights in the event of death or incapacity.

📥
Export My Data

Download a JSON file of everything we hold about you on our servers — directly from the Settings panel in the app.

Transparency

Who Else Touches Your Data

We use a small number of carefully chosen third-party services. Here is exactly what each one receives.

Service Location What They Receive Safeguard
Firebase / Google Cloud
Authentication & account data		 US / Global Name, email, plan status, message count Google SCCs · ISO 27001 · SOC 2
Anthropic Claude API
AI query processing		 United States Your chat message + recent context (processed & discarded, not stored) Commercial API terms — no training use
Razorpay
Payment processing		 India Email, payment amount — card/UPI handled entirely by Razorpay PCI DSS Level 1 — highest certification
Indian Kanoon API
Case law retrieval		 India Search keywords only — no personal or client data India-based; no cross-border transfer
Netlify
Hosting & serverless functions		 United States Server access logs (IP address, user agent — standard web hosting) SOC 2 Type II certified
Resend
Transactional email		 European Union Name, email, receipt data for payment confirmations GDPR compliant · EU data residency
Supabase
Intake forms & operational data		 United States Client intake form submissions (name, phone, matter type — submitted voluntarily by prospective clients to advocates) SOC 2 Type II · GDPR compliant DPA

We do not share your data with advertisers, data brokers, or any other parties. We never sell data.

Contact

Questions or Concerns?

Grievance Officer — Uniqe Corporation

If you have a question about this page, wish to exercise a DPDP right, or have a concern about how your data is handled, contact us directly. We will acknowledge your grievance within 48 hours and resolve it within 30 days.
If not resolved to your satisfaction, you may escalate to the Data Protection Board of India (DPBI), established under the DPDPA 2023.

info@legalaidai.in www.legalaidai.in Response within 48 hours · Resolution within 30 days

This page was last reviewed: June 2026 · Full Privacy Policy · Advocate Studio