Privacy Policy

What we collect

Everything below is data VidhiSar's own servers store to run the product — nothing is sold, and nothing is shared with advertisers.

• Account details — Business name, phone number, email, password (hashed, never stored in readable form) — To create and secure your login
• Your conversations — Every message you send the Legal Q&A assistant, and its replies — To answer your question and to let you scroll back through your own chat history
• Documents you generate — The NDAs, notices, policies and other PDFs you draft, and the answers you typed to create them — So "My Documents" can show and re-download anything you've generated — we do not read these for any other purpose
• Contracts you scan — The text of any contract you upload or paste for review — To run the risk analysis and save it to your Contract Vault if you choose to
• Billing information — Which plan you're on, payment status, and transaction references from our payment processor — To meter your plan and keep your subscription accurate. We never see or store your card/UPI details — Cashfree handles that directly
• Usage data — Which features you use and how often (e.g. questions asked this month) — To enforce plan limits and to know what's actually useful so we build more of it
• Technical data — IP address, browser type, timestamps of requests — Security (rate-limiting abuse, fraud prevention) and debugging outages

Why we collect it

We collect only what the product needs to function, and nothing is used for a purpose you weren't told about: We do not use your chats or documents to train third-party AI models beyond what's needed to generate the single response you asked for, and we do not sell or rent your data to anyone.

• To provide the service — answering your legal questions, generating your documents, running contract scans, tracking your compliance deadlines.
• To meter and bill your plan — knowing your usage this month, and processing payments for upgrades.
• To provide support — if you escalate to a human lawyer through the product, or contact us for help, we look at the relevant conversation to help you.
• To keep the service secure — detecting abuse, rate-limiting, preventing fraud.

Who can see it

• You, always, from inside your own account.
• The VidhiSar team, through the Partner Console — a single admin-controlled account used strictly for support (e.g. an escalation you raised) and account administration, never browsed casually.
• Service providers we rely on to run VidhiSar, strictly to perform that function on our behalf: Vercel (hosting, Mumbai region), Turso (database hosting), the model providers that produce an answer or read a contract (Groq, Google Gemini, xAI), Cashfree (payment processing), Google (Sign-In, if you use it), our transactional email provider (account and OTP emails only), and a web-search provider when a question needs a current source. None of them may use your data for their own purposes, and we do not license your content to anyone to train a model on it. Every one of them is listed, with what it does and where, on our trust page.
• Legal authorities, only if we're legally compelled to disclose something (e.g. a valid court order) — we don't share data with law enforcement voluntarily.

How long we keep it

We keep your account data and generated documents for as long as your account is active, so "My Documents" and your compliance history stay useful. If you delete your account, your personal data, chat history, and documents are permanently removed from our active systems (see Deleting your account below). Billing records are retained longer where Indian tax/accounting law requires it.

Your rights under the DPDP Act, 2023

As a Data Principal under India's Digital Personal Data Protection Act, you have the right to:

• Access a summary of the personal data we hold about you.
• Correct or update inaccurate or incomplete data — most of this you can already do yourself from your Profile page.
• Erase your personal data once it's no longer needed for the purpose it was collected for.
• Withdraw consent at any time, as easily as you gave it — you can delete your account from your Profile page whenever you choose.
• Register a grievance with our Grievance Officer (below) if you believe we've mishandled your data, and if unresolved, with the Data Protection Board of India.

How we protect it

• Passwords are hashed (bcrypt) — we cannot see or recover your actual password, ever.
• All traffic between your browser and our servers is encrypted (HTTPS/TLS).
• Access to the admin console is restricted to a single designated account, separately from any customer account.
• Payment details are handled entirely by Cashfree — VidhiSar's own systems never receive or store your card/UPI credentials.

Deleting your account

You can request full deletion of your account, chat history, and generated documents from your Profile page, or by emailing our Grievance Officer below. We'll confirm once it's done — this is a hard delete from our active database, not a deactivation.

Contact & Grievance Officer

Questions about this policy, or a request relating to your data, go to our Grievance Officer at infovidhisar@gmail.com. This policy may be updated as the product changes — material changes will be reflected here with an updated "Last updated" date.