Privacy Policy

1 Personal Information We Collect

When you use SatLegal, we collect personal data that you provide directly. Under the Digital Personal Data Protection Act, 2023 (DPDP Act), SatLegal acts as the Data Fiduciary and you are the Data Principal. This includes:

1. Identity data — name, username, or similar identifier.
2. Contact data — email address and mobile phone number.
3. Query and case data — your legal queries, answers to assessment questions, and any documents you upload to obtain a legal report.
4. Credentials — passwords and security information used for account access.
5. Payment data — transaction reference IDs from our payment processor (Razorpay). We do not store full card or bank details.
6. Marketing preferences — your opt-in or opt-out choices for marketing communications.
7. Chat and interaction data — to improve the accuracy of AI-generated legal information, we log and analyse your interactions on the platform.

2 Information We Collect Automatically

When you use our platform, we automatically collect certain technical data:

• Device data — IP address, inferred location, browser type and version, operating system, and referral source.
• Usage data — pages viewed, time spent, clicks, search queries (anonymised), and navigation patterns.
• Session data — stored locally in your browser (localStorage) to maintain your session and wizard progress.

This data is collected under the legitimate interest of operating and improving our platform, and is not linked to your identity unless you are logged in.

3 Cookies and Tracking Technologies

What we use

We use browser-based storage technologies including cookies and localStorage to operate the platform. These fall into three categories:

• Essential cookies — strictly necessary for the platform to function (session management, security, wizard progress). Cannot be disabled.
• Analytics cookies — help us understand how users interact with the platform (page views, search patterns, drop-off points). Only deployed with your consent.
• Marketing cookies — used for personalised communications and re-engagement. Only deployed with your explicit consent.

Your cookie choices

On your first visit, you will see a cookie consent banner. You may Accept All, Decline non-essential cookies, or Manage Preferences to choose by category. Your preference is stored and respected for all future visits. You may change it at any time via the link in our footer.

Third-party cookies

Our payment processor (Razorpay) may set its own cookies when you proceed to payment. These are governed by Razorpay's privacy policy and are not controlled by SatLegal.

4 How We Use Your Information

We use your personal data only for the purposes for which consent was given, or as permitted under the DPDP Act, 2023:

• To generate personalised legal reports and analysis based on your query.
• To connect you with a registered advocate if you choose to proceed.
• To process payments and issue GST invoices for services purchased.
• To send service-related communications (report delivery, booking confirmation, OTPs).
• To send marketing communications, where you have opted in.
• To improve platform accuracy and AI model performance.
• To comply with legal obligations under applicable Indian law.
• To maintain platform security and prevent fraud.

We will not use your personal data for purposes beyond those listed above without obtaining fresh consent.

5 Who We Disclose Personal Information To

We share your data only as necessary and lawful. Recipients include:

• Advocates on the platform — only if you choose to connect with one, and only after your explicit consent to share case details.
• Payment processors — Razorpay, for processing transactions. Governed by their privacy policy.
• Cloud infrastructure providers — MongoDB Atlas (database), Vercel (hosting), Anthropic (AI processing). All bound by data processing agreements with SatLegal.
• Legal and compliance authorities — where disclosure is required by law, court order, or government directive.
• Business successors — in the event of merger, acquisition, or restructuring, subject to equivalent privacy protections.

We do not sell your personal data to third parties for their own marketing purposes.

6 Advocate Interaction

• Anonymity until consent: Your identity is anonymised during legal analysis. Contact details are shared with an advocate only upon your explicit consent to connect.
• Case sharing: If you opt in to advocate matching, your full non-anonymised case, legal report, and contact information are shared with the matched advocate to facilitate direct assistance.
• No unsolicited contact: Advocates on our platform agree not to contact Data Principals outside the platform without explicit consent.

7 SMS and Marketing Communications

If you provide your mobile number, we may send you:

• Transactional messages — OTPs, report delivery, payment confirmation, booking updates.
• Service updates — changes to your case status or platform features.
• Promotional messages — only if you have explicitly opted in during registration.

You may withdraw consent for marketing communications at any time by clicking "Unsubscribe" in any message or by emailing contact@satlegal.in. Transactional messages cannot be opted out of while your account is active, as they are essential to service delivery.

8 Your Rights Under DPDP Act, 2023

As a Data Principal under the Digital Personal Data Protection Act, 2023 (India), you have the following rights with respect to your personal data held by SatLegal:

To exercise any of the above rights, contact our Grievance Officer at privacy@satlegal.in. We will respond within 30 days of receiving your request, or such shorter period as may be prescribed.

9 Data Processing Agreement (DPA)

This section constitutes the Data Processing Agreement between SatLegal ("Data Fiduciary") and you, the user ("Data Principal"), in accordance with the Digital Personal Data Protection Act, 2023.

9.1 Roles and Responsibilities

SatLegal as Data Fiduciary: SatLegal determines the purpose and means of processing your personal data. We are responsible for ensuring lawful, fair, and transparent processing in accordance with DPDP Act, 2023.

Sub-processors: SatLegal engages the following sub-processors who process data on our behalf. Each is bound by data processing obligations no less protective than those in this agreement:

• Anthropic PBC — AI processing (legal query analysis). Data processed: anonymised legal query text. Retention: as per Anthropic's data handling policy.
• MongoDB Atlas (MongoDB Inc.) — Database hosting. Data processed: user profiles, query logs, sales records. Location: Mumbai (ap-south-1) or nearest available region.
• Vercel Inc. — Platform hosting and serverless functions. Data processed: request logs, session data. Location: Global CDN, primary region India.
• Razorpay Software Pvt. Ltd. — Payment processing. Data processed: transaction data, contact details for payment. Governed by Razorpay's PCI-DSS compliant infrastructure.

9.2 Purpose Limitation

Personal data collected by SatLegal will be processed solely for the purposes described in this Privacy Policy. We will not process your data beyond these purposes without obtaining fresh, specific consent.

9.3 Data Minimisation

We collect only the personal data necessary for the stated purpose. Phone numbers are masked in analytics logs. Full payment details are never stored by SatLegal.

9.4 Consent Management

Consent is obtained at the point of data collection (registration, first query, cookie acceptance). You may withdraw consent at any time by contacting privacy@satlegal.in or using your account settings. Withdrawal of consent will result in deletion of your personal data within 30 days, subject to any legal retention obligations.

9.5 Data Breach Notification

In the event of a personal data breach that is likely to result in harm to you, SatLegal will notify the Data Protection Board of India and affected Data Principals in the manner and within the timelines prescribed under the DPDP Act, 2023.

9.6 Children's Data

SatLegal does not knowingly collect personal data of children (persons under 18 years of age) without verifiable parental consent, as required under Section 9 of the DPDP Act, 2023. If we discover that a minor has provided data without consent, we will delete it promptly.

9.7 Cross-Border Data Transfers

Processing by sub-processors (Anthropic, Vercel) may involve transfer of data outside India. SatLegal ensures that such transfers are made only to countries or entities that provide an adequate level of protection, or under appropriate contractual safeguards, in accordance with rules to be notified under the DPDP Act, 2023.

10 Data Retention

We retain your personal data only for as long as necessary to fulfil the purpose for which it was collected, or as required by law:

• Account data — retained for the duration of your account and for 2 years after account closure.
• Legal query and report data — retained for 3 years to allow you to access your report history and for dispute resolution.
• Payment and transaction records — retained for 7 years as required under Indian financial and tax regulations.
• Analytics logs — anonymised aggregate data retained indefinitely; identifiable logs purged after 12 months.
• Consent records — retained for the duration of processing plus 3 years, as evidence of lawful basis.

Upon expiry of the retention period, or upon a valid erasure request, personal data is securely deleted or anonymised.

11 Data Security

SatLegal implements appropriate technical and organisational measures to protect your personal data, including:

• HTTPS encryption for all data in transit.
• Encrypted database storage via MongoDB Atlas.
• HMAC-signed, time-limited authentication tokens (no persistent session cookies).
• Role-based access controls limiting staff access to personal data.
• Regular security reviews of API endpoints and data flows.

No method of electronic transmission or storage is 100% secure. In the event of a breach, we will act in accordance with our obligations under the DPDP Act, 2023.

12 Grievance Officer

In accordance with Section 13 of the DPDP Act, 2023, SatLegal has designated a Grievance Officer to address Data Principal complaints and requests:

If you are not satisfied with the resolution provided by our Grievance Officer, you may approach the Data Protection Board of India upon its constitution, as prescribed under the DPDP Act, 2023.

13 Contact Us

For any questions about this Privacy Policy, to exercise your data rights, or to update your consent preferences:

• Email: contact@satlegal.in
• Privacy/DPDP requests: privacy@satlegal.in

You may also manage your cookie preferences at any time by clicking Cookie Preferences.