Privacy Policy

AdvocEasy is a legal workflow platform for Indian advocates. We are a Data Fiduciary under the Digital Personal Data Protection Act, 2023.

For any privacy questions or requests, contact support@advoceasy.in.

• Name, mobile number, email (account registration)
• Google account name, email address, and basic profile information (only if you sign in with Google)
• Bar Council number, court preferences (professional profile)
• Case details, client information, hearing dates (case management)
• Legal documents you upload (PDF, DOCX, stored encrypted)
• WhatsApp contact numbers (only if you enable WhatsApp reminders)
• AI feature usage counts (for quota tracking)
• A record of the consents you give and withdraw, with the date and the version of this policy in force at the time

AdvocEasy holds two kinds of personal data, and our role differs between them.

• Your account data — your name, contact details, Bar Council number, and preferences. AdvocEasy is the Data Fiduciary for this data and this policy governs it.
• Client Data — personal data belonging to your clients, opposing parties, or other third parties that you enter into AdvocEasy. You are the Data Fiduciary for that Client Data under the Digital Personal Data Protection Act, 2023, and you are responsible for having a lawful basis to process it. AdvocEasy acts solely as a Data Processor for Client Data: we process it only as necessary to provide the case management, drafting, and notification features you ask for, and for no other purpose.

We do not contact your clients, and we do not use Client Data to market to anyone.

Client Data and account data may and will be processed by different sub-processors, solely to deliver AdvocEasy’s features. No Client Data is sold or exposed by AdvocEasy.

• Database, authentication, and file storage services — hold account data, case records, client records, and uploaded documents. These records are stored within India.
• AI processing services — support AI summaries, contract review, legal research drafting, and document generation. They receive the document text, case inputs, and prompts for the AI action you request and return the generated output (see sections 5 and 7).
• Legal research services — receive only the search text you type for a Legal Research lookup. No case records, client records, or uploaded documents are sent.
• Transactional email services — receive your email address and the content of the emails we send you.
• Meta API — planned for WhatsApp notification delivery. Not yet in use; this entry will be updated with what is shared before any WhatsApp message is sent.
• Google — sign-in and, if you choose to connect it, Google Calendar sync for hearing dates (see section 6).
• Cloud infrastructure services — host the services that fetch court cause lists and case status from public court websites within India.
• Technical request-processing services — support case-status lookups and receive only the technical inputs required to complete the request. They receive no case, client, or account data.
• Website hosting and delivery services — receive connection metadata such as your IP address. Your case data is not stored by these services.

Your case records, client records, and uploaded documents are stored within India.

When you start an AI action, the document text, case inputs, and prompts for that action are sent to servers in the United States. It happens only when you start an AI action yourself, and only after you have given AI processing consent, which you can withdraw at any time.

If you sign in with Google or connect Google Calendar, AdvocEasy accesses and uses Google user data as described below.

• What we access: your Google account name, email address, and basic profile information when you sign in with Google. If you separately choose to connect Google Calendar in Settings, we additionally request permission to create, update, and delete events on your calendar.
• How we use it: account information is used only to create and identify your AdvocEasy account. Calendar access is used only to add, update, and remove hearing date events that you save in AdvocEasy. We do not read, collect, or store your other calendar events.
• How we store it: the Google authorization token required for calendar sync is stored encrypted in our database, is accessible only to our server-side systems, and is never exposed to your browser or written to logs.
• What we share: we do not share, sell, or transfer Google user data to any third party. Google user data is never sent to our AI provider, is never used for advertising, and is never used to train AI models. No human reads this data except with your explicit consent, or where necessary for security purposes or to comply with applicable law.
• Deletion: disconnecting Google Calendar in Settings immediately deletes the stored authorization token. Deleting your account removes all stored Google user data.

AdvocEasy’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

AI features are always user initiated: no document or case content is sent to our AI provider unless you request an AI action on it. Before your first AI action we ask for your consent separately from your account consent, and you can withdraw it at any time in Settings under Data & Privacy. Withdrawing it stops all AI features until you consent again.

Content you submit to an AI feature is processed by an AI processing service. AdvocEasy does not use your data or documents to train any AI models of its own, and the service is configured so that submissions are not used to train third-party models either. AI output is a draft: it may be incomplete or incorrect, and you are responsible for reviewing it before you rely on it, file it, or send it. Google user data is never shared with our AI processing service.

• Access: Request a copy of your data
• Correction: Update incorrect data via Settings
• Erasure: Request account and data deletion
• Withdraw consent: Withdraw AI processing consent or WhatsApp notification consent at any time in Settings. Withdrawing your core account consent deactivates your account.
• Grievance: Email support@advoceasy.in and we will respond within 30 days

Data is retained while your account is active, except where stated below.

• Case records, client records, and hearing dates: retained while your account is active. Closed cases are retained for 2 years after closure.
• Documents you upload: retained while your account is active, or until you delete them.
• AI drafts and generated summaries: retained while your account is active, or until you delete them.
• AI usage records: 6 months.
• Audit logs: 1 year.
• Consent records: retained for the life of the account, as the record of what you agreed to and when, and deleted when the account is deleted.
• Google Calendar authorization tokens: deleted immediately when you disconnect Google Calendar or delete your account.

When you request account deletion, your account is deactivated immediately and enters a 30-day grace period in which you can cancel the request. After 30 days a scheduled job permanently deletes your account, your case and client records, your tasks and hearing dates, your consent records, and the files you uploaded. You may request earlier deletion by emailing support@advoceasy.in.

The AdvocEasy application does not currently set cookies. Your login session is held in your browser’s local storage by our authentication provider and is cleared when you log out. We run no analytics, advertising, or tracking scripts in the application.

The application also keeps a small amount of information in your browser’s local storage purely so the app works as expected — for example an unsaved checklist template draft, and the time you last ran a manual cause-list sync. This stays in your browser, is never sent to us as a cookie, and is cleared when you clear the site’s data.

Our marketing website at advoceasy.in is a separate site. It uses one essential first-party cookie to remember your cookie choices for one year. This cookie is always on because the cookie notice cannot remember your choice without it. Any cookie strictly required for login, load balancing, security, or core functionality would also be classed as Essential and would not be used for tracking.

On the marketing website, functional cookies are optional and may be used to remember preferences such as language, court, or practice settings. Analytics and marketing cookies are not currently in use. If analytics is introduced later, it will remain off unless you opt in. We do not currently use advertising cookies.

You can accept or reject optional cookies in the first-visit notice and change your choice at any time using Cookie preferences in the website footer.

Data is encrypted at rest (AES-256) and in transit (TLS 1.2+). Access is controlled by row-level security policies.