Privacy Policy
Effective 25 October 2026. ApniLaw AI is in beta, and this page may change.
This policy explains how ApniLaw AI (the “Service”, at ai.apnilaw.com) handles personal data, in line with the Digital Personal Data Protection Act, 2023 (“DPDP Act”) and the rules made under it. It is written to be read, not skimmed past: please read the parts that apply to you.
1. Who is responsible
The Service is run by ApniLaw, operated by Innovik, a partnership firm, at A102, Royal Street, Palwal, Haryana 121102, India. For the personal data described here we are the “Data Fiduciary” under the DPDP Act. You can reach us, and our grievance contact, at info@apnilaw.com or +91-8569843472.
2. What we collect, and why
| When | What | Why |
|---|---|---|
| You join the waitlist | Your e-mail address; a referral code; the code of the person who referred you; the time; a one-way scrambled form (hash) of your network address, never the address itself | To send your invite, and to count referrals fairly and limit abuse. The e-mail is used for nothing else. |
| You create an account | Name, e-mail address, password (stored only as a salted hash, never readable by us), the invite code used | To give you an account and keep it secure. |
| You use the Service | Your questions and the answers; the research conversations you keep; notes, drafts, followed cases; facts about your matter that you state; documents you upload and their extracted text; the choices you make in settings | To do the research you ask for, and to keep your work for you to come back to. |
| You visit | Technical data in server logs (network address, time, pages requested, browser type); counters used to limit abuse | Security, preventing misuse, and keeping the Service running. |
| You write to us | What you send us, and your contact details | To reply and to handle requests and complaints. |
We collect only what we need for these purposes. We do not run advertising or behavioural-analytics trackers on the Service, and we do not buy or sell personal data.
3. Consent, and other lawful uses
We process your personal data on the basis of your consent, which you give by joining the waitlist or creating an account after being shown this notice, and which you can withdraw (see “Your rights”). The DPDP Act also allows some uses without consent, for example where you voluntarily give us data for a purpose and have not objected, to comply with law, or to protect against fraud and security incidents; we use those only where they truly apply.
4. Court records are public, and uploaded documents are yours
- The judgments, Acts and court case records in the Service are public documents and contain the names of judges, parties and advocates as the courts published them. We show them as published. If you think something should be corrected or removed, write to us and we will consider it.
- Documents you upload may contain other people’s personal data and privileged or confidential material. You must have the right to upload them. They are visible only to your account and are used only to answer you.
5. AI processing and who else sees your data
The research is done by software, with the help of AI language models run by other companies. To give you an answer we send them what is needed for that answer:
- your question, and recent context from the same conversation;
- passages from stored judgments and Acts that were found for the question;
- text from a document you attached or asked us to summarise, and facts you stated about your matter.
We use an AI gateway (OpenRouter) that routes each request to a model provider. These providers may process the request on servers outside India. The DPDP Act permits transfer of personal data outside India except to countries the Central Government restricts. We do not train any model of our own on your content. What a provider receives is also covered by that provider’s own terms and privacy policy.
When the setting that allows web search is on, a short search query (which we ask the AI to write in generic legal terms, without your name or confidential facts) is sent to a search provider (Tavily). Web search is switched off whenever a document of yours is attached to the question. Do not put confidential facts in a question if you do not want them to leave our systems; the instruction to keep queries generic is a precaution and not a guarantee.
Other than these, we share personal data only with the companies that host and run the Service for us (servers and e-mail delivery), who may use it only for that; with a court, regulator or authority when the law requires; and to protect the rights and safety of users, the public or ourselves. We do not sell personal data.
6. How long we keep it
- Account data: while your account is open, and then only as long as the law requires or a dispute is open.
- Research conversations, notes, drafts and uploaded documents: until you delete them or ask us to, or until your account is closed.
- Waitlist e-mails: until you are invited and create an account, or until you ask us to remove you.
- Server logs and abuse counters: a limited period needed for security and troubleshooting.
Deletion in the product is limited at present; if you cannot delete something yourself, write to us and we will do it.
7. Security
The Service is served over HTTPS; passwords are stored as salted hashes; sign-in uses a secure session cookie; each user’s conversations, notes and documents are kept separate and cannot be opened by another user; and sign-in attempts and costly actions are rate-limited. No system is perfectly secure. If a breach of personal data affects you, we will tell you and the Data Protection Board of India as the law requires.
8. Cookies
We use one cookie that the Service needs in order to work: it keeps you signed in. It is not used for tracking or advertising. There are no advertising or analytics cookies at present, and if that changes we will say so here and ask first where the law requires.
9. Your rights under the DPDP Act
You have the right to:
- ask for a summary of the personal data we process about you and how we process it, and who it has been shared with;
- ask us to correct, complete or update it;
- ask us to erase it, unless we must keep it by law;
- withdraw your consent at any time. This is as easy as giving it: write to us. Withdrawing means we stop processing, which may mean closing your account;
- have a grievance addressed;
- nominate another person to exercise these rights for you if you die or cannot act for yourself.
To use any of these, write to info@apnilaw.com from the e-mail address on your account (so we know it is you). We aim to reply within 30 days, and in any case within the time the law allows. If you are not satisfied with our reply, you may complain to the Data Protection Board of India. The Board will ask whether you first raised the matter with us, so please do.
10. Children
The Service is for lawyers, law students and legal professionals aged 18 or over. It is not directed at children, and we do not knowingly collect their personal data. If you think a child has given us data, write to us and we will delete it.
11. Changes
We will update this policy when what we do changes, and show the new effective date at the top. If a change affects how we use data you have already given us, we will tell you before it applies to you.
12. Contact and grievances
ApniLaw (operated by Innovik, a partnership firm)
A102, Royal Street, Palwal, Haryana 121102, India
info@apnilaw.com · +91-8569843472