LawMuse
← LawMuse

Privacy Policy

Effective date: 25 October 2026 · Version: 2026-10-25

This Privacy Policy explains how [LEGAL ENTITY NAME] ("we", "us", "our") collects, uses, stores and shares personal data when you use the LawMuse app and services (the "Service"). It is issued in accordance with the Digital Personal Data Protection Act, 2023 (the "DPDP Act"), the Information Technology Act, 2000 and the rules under them.

1. Our role

1.1 Your account data. For information about you as a user (such as your name, email and phone), we are the Data Fiduciary.

1.2 Your case and client data. For personal data contained in the cases, client records, documents, notes and drafts you upload or create ("Your Content"), you (or your firm) are the Data Fiduciary, because you decide why and how it is processed for your professional work. We process that data on your behalf as your Data Processor, only to provide the Service to you.

1.3 If you are a client or other person whose data an advocate has stored in the Service, please contact that advocate to exercise your rights. We will assist them.

2. What we collect

  • (a) Account data: name, email address, mobile number, bar enrollment number, password (stored only as a one-way hash), and the version and date of the Terms you accepted. We confirm your email address and mobile number with one-time codes when you sign up (and when you change your number), and you can sign in with a code sent to either. Your email address and mobile number are stored encrypted. If you set an MPIN or fingerprint unlock on your phone, we keep only a one-way hash of the MPIN and of a random key your phone holds; your fingerprint or face data never leaves your phone.
  • (b) Your Content: case details, parties, client details, documents and their extracted text, notes, drafts, reminders, and the questions you ask the AI features.
  • (c) Collaboration data: who you invite, their role and access.
  • (d) Subscription and payment data: plan, period, amounts, and payment reference numbers from our payment gateway. We do not receive your full card, UPI or bank details.
  • (e) Technical data: IP address, device and app information, request identifiers, timestamps and security logs.
  • (f) Records of AI processing: for each AI request we record metadata such as time, user, case, purpose and which document excerpts were used. We do not store the prompt or the answer in these records.
  • (g) Directory listing (advocates who choose to be listed): the details you enter (name, enrolment number, State Bar Council and year, qualifications, areas of practice, courts, languages, office address, and the phone and email you want clients to use), and the Bar Council ID card or enrolment certificate you upload so that our team can check your enrolment. The proof is seen only by our verification team and is stored encrypted.
  • (h) Messages between a client and an advocate in the app (about a case, or an enquiry through the directory): text, voice notes, photos and documents. They are stored encrypted. Photos are stripped of location and camera details when received. If the advocate turns a client's voice note into a written statement, the voice note is transcribed on our own servers (it is not sent to any speech service), and the statement the advocate approves becomes part of the case file.

We do not collect:

  • Biometric data. Fingerprint or face unlock is handled entirely by your device.
  • Voice recordings, other than voice notes you choose to send in a chat or an enquiry (section 2(h)). Voice dictation is performed by your device's speech service. With "On-device only" enabled, audio does not leave your phone. If you turn that option off, your device's speech provider (for example, Google) processes the audio under its own terms. We receive only the resulting text.

3. How we use personal data

We use personal data to:

  • (a) create and secure your account, including sign-in, password reset and fraud prevention;
  • (b) provide the Service, including storing, searching and processing Your Content, running AI features you request, collaboration, reminders and notifications;
  • (c) manage plans, usage limits and payments;
  • (d) provide support and respond to grievances;
  • (e) comply with law, including the directions of CERT-In and lawful requests from authorities.

We do not sell personal data, use Your Content for advertising, or use Your Content to train AI models.

4. Ai processing

4.1 By default, AI features that use your case data (questions about a case, drafting, case research) run on language models hosted on servers operated by us or on our behalf [at LOCATION]. To answer a question or write a draft, the relevant parts of Your Content are sent to the model as part of the request.

4.2 Optional cloud AI. Where we make it available, a workspace owner may choose a cloud AI engine operated by a third party (for example, a model hosted by NVIDIA). Case data of that workspace is then sent to that provider, which may process it outside India. We use this only after the workspace owner gives explicit consent in the app, which we record, and the owner can switch back to the default engine at any time. Before data is sent, the names of parties, clients and other people we can identify are replaced with placeholders (for example "[Petitioner 1]") and restored only in the answer you see, and identifiers such as phone numbers, email addresses, Aadhaar and PAN numbers are removed; case facts are not removed, and a name we cannot recognise as a name may still be sent. Features that use no case data (the general legal assistant, general precedent research and summaries of public judgments) use the cloud AI engine by default; the same replacement applies to the names of your clients and parties, but avoid entering other client details in them. Your conversations with the AI are stored encrypted on our servers. You can switch these features to our own servers only in Settings → AI.

4.3 Every AI request is recorded with its time, user, case, purpose, engine and the document excerpts used, but not the prompt or the answer. For AI drafts we also keep the draft as generated, the authorities and case passages used, the instructions, and later edits, reviews and exports, while the draft exists (Terms, section 3.6).

4.4 AI providers. We use a cloud AI provider only under terms that do not allow it to use your data to train its models, and after reviewing how long it keeps requests and which sub-processors it uses. Providers in use: [PROVIDER, LOCATION, RETENTION — fill in from the provider register before launch].

5. Who we share data with

  • (a) Collaborators you invite, to the extent of the access you give them.
  • (b) Service providers who help us run the Service (hosting, email delivery, payment processing, and, if chosen, cloud AI), under contracts that require them to protect the data and use it only for our instructions.
  • (c) Court data provider. When you use eCourts features, the case's CNR number is sent to our court-data provider (currently eCourtsIndia) to fetch publicly available case status, hearing dates and orders. Each such request is logged.
  • (d) Case law. Precedent research searches LawMuse's own library of Supreme Court and High Court judgments, kept on our servers and built from the courts' published records. Your questions, case details and documents are not sent to any external case-law service.
  • (e) Conversations and case chat. Your conversations with the AI assistant are stored on our servers so you can return to them; they are visible only to you, and you can delete them at any time. Messages and items shared in a case's chat room are visible only to the people the case owner allows into that room. Your phone number is shown to collaborators only if you turn on 'Share my phone number with collaborators'.
  • (f) Clients you share a case page with. The page shows only what you choose, to whoever has the link and its access code, until it expires or you withdraw it.
  • (g) Google, only if you connect Google Drive: copies of your documents are saved to a "LawMuse" folder in your own Drive. LawMuse can see only the files it creates there. You can disconnect at any time.
  • (h) Meta (WhatsApp), only if your office uses LawMuse's WhatsApp Business sending: the client's mobile number and the message are sent to WhatsApp to deliver it. Messages you share from your own phone go through your own WhatsApp, not through us.
  • (i) Our SMS and email providers ([SMS PROVIDER], [EMAIL PROVIDER]): your mobile number or email address and the one-time code, only to deliver the code.
  • (j) Cloudflare (Turnstile), when the Service shows a security check at sign-in, sign-up or a code request: your IP address and information about your browser or device go to Cloudflare to tell people from automated programs. Cloudflare may process it outside India.
  • (k) The advocate directory. If you are an advocate and choose to be listed, the details in section 2(g), except the proof, are shown to people signed in to LawMuse with a client account, until you stop the listing; your phone and email only if you choose to show them. If you write to an advocate, that advocate sees your name, email address and mobile number, and what you send. LawMuse does not recommend, rank or rate advocates and takes no fee for introductions.
  • (l) Authorities, where required by law, a court order or a lawful direction.
  • (m) A successor entity, if our business is merged or transferred, subject to this Policy.

6. Where data is stored

Your data is stored on servers located in [India]. We will transfer personal data outside India only as permitted under the DPDP Act.

7. How long we keep data

  • (a) Account data and Your Content are kept while your account is active.
  • (b) When you delete your account, it is closed at once: no one, including people you shared cases with, can open your cases, and nothing more is sent or run for it. For 30 days you can sign in and restore it as you left it. After that we erase Your Content from active systems, and from backups within [90] days. You can also choose to erase it at once.
  • (c) After erasure we keep only the details you gave to register (name, email, mobile number, enrolment number and the relevant dates), encrypted, for 180 days, as rule 3(1)(h) of the IT (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021 requires, and then delete them. If you paid for a plan, the payment records (with your name and email) are kept for the period tax law requires.
  • (d) Access and security logs are kept for at least one year (and at least 180 days as required under CERT-In directions), then deleted unless the law requires longer.
  • (e) Billing and tax records are kept for the period required by tax law.
  • (f) Messages between an advocate and a client in the app (about a case, or in an enquiry), with any voice notes, are deleted [180] days after they were sent. Enquiries that are declined, withdrawn or closed are deleted [180] days after they end. A directory listing and its proof are deleted when you delete your account; the proof is replaced when you upload a new one.

8. Security

We use reasonable security safeguards, including: encryption in transit (HTTPS / TLS); encryption at rest of stored documents (AES-256, with keys kept separately from the files) and of sensitive records such as AI conversations, email addresses and mobile numbers; hashed passwords and one-time codes; security checks against automated sign-in attempts; separation between customers, with access checked on every request; role-based access within a firm; least-privilege staff access; access, security and AI-processing logs; monitoring for attempts to reach other customers' data; backups; and security testing. No system is completely secure. If a personal data breach occurs, we will inform affected users without delay and notify the Data Protection Board of India and CERT-In as required by law. For case and client data, where you are the Data Fiduciary, we will give you the information you need to inform your clients.

9. Your rights

Subject to the DPDP Act, you have the right to:

  • (a) obtain a summary of your personal data we process and how;
  • (b) have inaccurate or incomplete data corrected, completed or updated;
  • (c) have your data erased when it is no longer needed, or withdraw consent;
  • (d) have your grievances redressed;
  • (e) nominate another person to exercise your rights in the event of your death or incapacity.

Most account data can be edited in the app under Profile. To exercise any other right, write to [PRIVACY EMAIL]. If you are not satisfied with our response, you may complain to the Data Protection Board of India.

10. Children

The Service is not intended for persons under 18, and we do not knowingly create accounts for them. Case records uploaded by advocates may contain personal data of children (for example, in family or juvenile matters). The uploading advocate, as Data Fiduciary, is responsible for processing such data lawfully.

11. Changes to this policy

We may update this Policy. We will notify you of material changes in the app or by email, and the app will ask you to review and accept the updated version.

12. Contact and grievance officer

Grievance Officer: [NAME]

Email: [GRIEVANCE EMAIL]

Address: [ADDRESS]

We will acknowledge a complaint within 24 hours and try to resolve it within 15 days of receipt.