Privacy Notice

This Privacy Notice is issued by JurixAI in its capacity as a Data Fiduciary under the Digital Personal Data Protection Act, 2023 ("DPDP Act"). It describes the personal data we collect, the purposes for which we process it, and the manner in which you — as a Data Principal — may exercise your rights.

§1. Data Fiduciary

JurixAI (operated by JurixAI Technologies Pvt. Ltd.) is the Data Fiduciary responsible for the processing of your personal data on this platform.

§2. Personal Data We Collect

We collect the following categories of personal data, each for a specified purpose:

§3. Purpose of Processing

Your personal data is processed for the following itemized purposes. Where consent is required, it is obtained at the time of collection:

• Essential Processing: Core service delivery — authentication, authorization, and platform functionality. Cannot be withdrawn while using the service.
• Case Management: Storing, organizing, and retrieving your legal cases, documents, and related metadata.
• AI Analysis: Processing your queries and documents through AI models to provide legal research, drafting assistance, and citation analysis. Your data is NOT used to train public AI models. Legal queries and documents remain private to your workspace.
• Communication: Sending service notifications, hearing reminders, and deadline alerts.
• Storage: Secure storage of uploaded documents and generated outputs in encrypted vaults.
• Analytics (anonymized): Aggregated, de-identified usage statistics to improve platform performance. No individual identification is possible.
• Third-Party Services: Sharing data with external legal databases and services you explicitly connect (e.g., court filing portals).
• Cookies — Functional: Session management and preference storage essential for platform operation.
• Cookies — Analytics: Understanding platform usage patterns to improve the user experience.

§4. Your Rights as Data Principal

Under the DPDP Act, 2023, you have the following rights:

• Right to Access: Obtain a summary of your personal data and processing activities. Navigate to Settings > Privacy > Export Data.
• Right to Correction: Request correction of inaccurate or misleading personal data. Use Settings > Privacy or contact the DPO at dpo@jurixai.com.
• Right to Erasure: Request deletion of your personal data. Navigate to Settings > Privacy > Delete Account. A 30-day cooling-off period applies before permanent deletion.
• Right to Data Portability: Export all your data in machine-readable JSON format via Settings > Privacy > Export Data.
• Right to Withdraw Consent: Withdraw consent for any non-essential processing purpose via Settings > Privacy by toggling individual purposes off.
• Right to Nominate: Nominate another person to exercise your rights in the event of your death or incapacity, as provided under DPDP §14.

§5. Consent Withdrawal

You may withdraw consent for any non-essential processing purpose at any time through Settings > Privacy. Each purpose listed in §3 above can be independently toggled.

Essential Processing (authentication, core service delivery) cannot be withdrawn while maintaining an active account, as it constitutes the fundamental basis for providing the service.

Consequences of withdrawal: Withdrawing consent for a specific purpose will disable features reliant on that processing. For example, withdrawing AI Analysis consent will disable research and drafting features. Withdrawal does not affect the lawfulness of processing performed prior to withdrawal.

§6. Cross-Border Data Transfers

The primary data storage and processing occurs in asia-south1 (Mumbai) for DPDP data-residency compliance. However, certain processing sub-tasks involve cross-border transfers:

• Embedding generation: Text embeddings are computed in us-central1 (Iowa, USA) via Google Vertex AI. Only anonymized text chunks are transmitted — no PII is included.
• OCR processing: Document OCR is performed in asia-southeast1 (Singapore) via Google Cloud Vision. PII is scrubbed from metadata before transmission.

All cross-border transfers are governed by Standard Contractual Clauses (SCCs) and are limited to jurisdictions not restricted by the Central Government under DPDP §16. For full details, see /api/v1/privacy/cross-border-transfers.

§7. Data Retention

Personal data is retained only as long as necessary for the specified purpose:

• Active cases: Retained for the duration of use plus 10 years (limitation period for legal proceedings).
• Closed cases: 7 years from closure date.
• Chat/research history: 90 days (configurable by user).
• Audit logs: 7 years (regulatory compliance).

Upon expiry of retention periods or account deletion (after the 30-day cooling-off), data is permanently and irreversibly erased. For the complete retention schedule, see /api/v1/privacy/retention-policy.

§8. Complaint to the Data Protection Board

If your grievance is not resolved by our Grievance Officer within 30 days, you may file a complaint with the Data Protection Board of India under DPDP §17:

§9. Children's Data

JurixAI is designed exclusively for legal professionals aged 18 and above. We do not knowingly collect personal data from minors. If a minor requires access to the platform (e.g., law students under 18), verifiable parental or guardian consent is required in accordance with DPDP §9. If we become aware that data has been collected from a minor without valid consent, we will delete it promptly.

§10. Grievance Officer & Data Protection Officer

For any queries, concerns, or requests regarding your personal data:

§11. Updates to This Notice

We may update this Privacy Notice to reflect changes in our processing activities, legal obligations under the DPDP Act, 2023, or directions issued by the Data Protection Board of India. Material changes will be communicated via email and an in-app notification at least 14 days before they take effect. The "Last Updated" date above reflects the most recent revision.