Privacy Policy & Data Protection

At Advo Buddy (“we”, “us”, or “Platform”), we recognize that legal records, client identities, and chamber communications are among the most sensitive categories of information.

We are committed to operating as a responsible Data Processor (and where applicable, Data Fiduciary) in full compliance with the:

• Digital Personal Data Protection Act, 2023 (DPDP Act 2023);
• Information Technology Act, 2000 (including the IT (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011); and
• Ethical expectations of client confidentiality recognized under Section 126 of the Indian Evidence Act, 1872 and Section 132 of the Bharatiya Sakshya Adhiniyam, 2023 (BSA).

This Policy governs our practices regarding data collection, processing, protection, retention, and deletion across all Advo Buddy services.

We collect and process only the minimum necessary information required to deliver legal practice management services:

A. Account & Practitioner Profile Data:

• Practicing Advocates: Full name, email address, mobile phone number, State Bar Council enrollment number, chamber/office address, areas of specialization, and optional profile avatar.
• Authentication: Securely hashed passwords (via bcrypt) or OAuth authentication metadata via Supabase.

B. Case Management & Client Information:

• Case Particulars: Case number, CNR number, court/tribunal name, judge/bench, case type (e.g. Criminal, Civil, Writ), stage of proceedings, and hearing dates.
• Client & Opposing Party Details: Client full name, phone number (for optional client WhatsApp hearing alerts), address, opposing party name, and opposing counsel details.
• Chamber Records: Case notes, tasks, cause list items, fee ledger entries, invoice details, and audit history logs.

C. Uploaded Documents & AI Queries:

• Documents uploaded for OCR, analysis, or drafting (such as FIR copies, plaints, written statements, affidavits, or judgment orders in PDF, DOCX, or TXT format).
• Draft templates customized in DraftMitra.

We process personal and chamber data exclusively for specified, lawful purposes based on your contractual consent:

• Core Case Diary & Management: Rendering your interactive case board, daily cause-list diary, stage tracking, and client registry.
• Automated Hearing Reminders: Dispatching automated notifications (via WhatsApp, SMS, or Email) prior to scheduled hearings as configured in your alert preferences.
• Drafting & Template Automation: Merging case facts with court-standard drafting forms (e.g., bail applications, vakalatnama, recall petitions).
• AI Legal Assistance & Research: Processing legal research queries, synthesizing case briefs, and summarizing uploaded legal documents.
• Security & Audit Trails: Maintaining timestamped audit trails of case updates to prevent internal chamber disputes and detect unauthorized access.

Zero AI Training on Privileged Papers: We strictly prohibit the use of your confidential case briefs, client documents, or chamber notes to train, fine-tune, or improve public foundation artificial intelligence models.

All AI interactions (summaries, FIR analysis, translation, draft recommendations) are processed via enterprise AI endpoints with strict zero-data-retention agreements, ensuring that prompts and file contents are deleted immediately after the response is returned.

To provide high-reliability infrastructure, Advo Buddy partners with vetted technology service providers who adhere to rigorous data protection standards:

• Database & Auth Infrastructure (Supabase / AWS PostgreSQL): Encrypted database hosting, stateless authentication token verification, and multi-tenant row-level access enforcement.
• Telecommunication Services (Twilio): Secure carrier routing for WhatsApp and SMS hearing notification dispatches, compliant with Indian DLT (Distributed Ledger Technology) and TRAI regulations.
• eCourts Open Data Endpoints: Read-only retrieval of public court causelists and CNR status from public judicial portals.

Advo Buddy implements multi-layered security controls designed for sensitive legal environments:

• Encryption in Transit: All HTTP communications are strictly forced over HTTPS utilizing TLS 1.3 encryption protocols.
• Encryption at Rest: Database tables, document stores, and backups are encrypted at rest using AES-256 standard encryption.
• Multi-Tenant Isolation: Application database queries are strictly scoped to the authenticated user ID (`advocate_id`). No user can view, edit, or search cases belonging to another chamber.
• Stateless Authentication: Cryptographically signed JWT bearer tokens with short expiry windows and secure revocation on logout.
• Password Hashing: Passwords are salted and hashed using modern cryptographic algorithms before persistent storage; plain-text passwords are never stored or logged.

Data Retention: We retain your case data, client profiles, and billing records for as long as your account remains active or as required to maintain your chamber diary history.

Data Portability / Export: You can download or export your full case list, hearing records, and client register at any time in standard formats (CSV, JSON) directly from the application interface.

Permanent Account Erasure: In accordance with Section 12 of the DPDP Act 2023, you have the right to request the complete erasure of your personal data. Upon an account deletion request via support@advobuddy.com or your Settings panel, all case files, personal identifiers, and audit logs will be permanently purged from our active databases within 30 days.

As a Data Principal under Indian law, you are entitled to the following statutory rights:

1. Right to Access Information: Obtain a summary of personal data being processed and the identities of any data processors with whom it has been shared.
2. Right to Correction & Updating: Correct inaccurate or misleading personal data and update incomplete credentials in your profile.
3. Right to Erasure / Deletion: Request the deletion of personal data that is no longer necessary for the purpose for which it was processed.
4. Right to Nominate: Nominate another individual to exercise your rights under the DPDP Act in the event of death or incapacity.
5. Right to Grievance Redressal: Have your data privacy concerns addressed promptly by our designated Grievance Redressal Officer.

Advo Buddy uses essential browser local storage (`localStorage`) and session tokens strictly to maintain your authenticated login state and theme preferences (dark/light mode).

We do NOT utilize cross-site tracking cookies, third-party advertising pixels, or invasive behavioral fingerprinting tools.

In accordance with the Information Technology Act, 2000 and the Digital Personal Data Protection Act, 2023, the details of the designated Data Protection & Grievance Redressal Officer for Advo Buddy are set forth below:

If you have questions regarding this Privacy Policy, your client data, or wish to request deletion of your account and associated records, please reach out via our Contact Us page.