Data Processing
The technical detail: where your data sits and what protects it.
This page is the detailed companion to the Privacy Policy, for readers who want specifics — a firm assessing whether to put client material into this service, or an advocate satisfying themselves about their own obligations.
1Roles
For your own account data — your name, your office, your sign-ins — LawyerSaathi is the Data Fiduciary.
For the contents of the documents you upload, which are usually your clients’ personal data, you are the Data Fiduciary and LawyerSaathi is your Data Processor. We act on your instructions and for no independent purpose of our own.
2What we hold about you
Everything below is either something you typed into LawyerSaathi or something the service recorded while you used it. There is no third category — we buy no data, and we receive none from data brokers or advertising networks.
| Data | Where it comes from |
|---|---|
| Email address, name, and a link to your Google profile photo | Your Google account, when you sign in. We never see or store a password. |
| Full name, mobile number, office address, PIN code | The setup wizard, typed by you. |
| Office name, highest degree, years of experience, Bar Council number, practice areas | The setup wizard, typed by you. |
| Your uploaded Word documents, the template titles you give them, and the fields you mark inside them | Files you upload. These may contain your clients’ personal details — see “Your clients’ data”. |
| Page size, font, margins, line spacing, text colour, export format | Settings → Document Setup. |
| Your rating and review of LawyerSaathi | Only if you choose to write one. |
| A record of each document generated: when, whether from a template, and which file format | Recorded automatically so your dashboard can count your own usage. |
| A record of each sign-in attempt: when, from which IP address and browser, by which method, and whether it succeeded | Recorded automatically for your security — this is what powers “Recent sign-ins” in Settings → Security. |
3Who else processes it
LawyerSaathi is built on two third parties and no others. Neither is permitted to use your data for its own purposes.
| Processor | What it does |
|---|---|
| Google (Google Ireland Ltd / Google LLC) | Authentication only. When you press “Sign in with Google”, Google verifies who you are and tells us your email address, name and profile photo URL. Google never receives your documents. |
| Supabase Inc. | Hosts the database that holds the rows listed above, and the private file storage that holds your uploaded Word documents and their rendered previews. |
4What actually protects it
Stated specifically, because a general assurance is not checkable. These are measures implemented in the product, not aspirations.
- Every request travels over HTTPS.
- Sign-in is delegated to Google. We never receive, hold or transmit a password, so there is no password of yours for us to lose.
- Every database table holding your rows has row-level security enabled, restricting reads and writes to rows belonging to the signed-in account. This is enforced by the database, not only by application code, so a mistake in the application cannot expose another user’s rows.
- File storage is private. No uploaded document has a public URL; a file is served only through a short-lived signed link generated for you.
- Uploaded documents are treated as immutable. Once stored, a file is never overwritten, so a template can never silently change underneath the fields marked on it.
- Every request that names a stored file is checked against your own account before the file is touched, and the check matches the whole path rather than a prefix, so a crafted path cannot escape your folder.
- Sign-in records cannot be written or deleted by any user account, including yours. Only the server writes them. This is what makes them worth anything if they are ever needed as evidence.
- Uploads are limited to 10 MB per document and to Word format.
5What we do not claim
We would rather under-promise here than write an undertaking we cannot evidence. So, plainly: this page does not claim a specific encryption-at-rest cipher, a specific backup schedule, a restore window, or any security certification. Data is held by Supabase Inc. under their own infrastructure practices, and if you need contractual assurances at that level for your firm, ask us and we will get them in writing rather than assert them here.
6How long it is kept
For as long as your account exists, and then not at all — with one narrow, deliberate exception.
- Delete a template and its Word document is deleted from storage with it.
- Settings → Storage will remove rendered previews and any file you uploaded but never turned into a template. Previews are rebuilt automatically when next needed.
- Delete your account and your profile, practice details, every template and its fields, every uploaded document, your document setup, your reviews and your generation history are all permanently removed. This is a real deletion, not a hidden flag on a row.
- The exception is the sign-in record. Those rows survive deletion in anonymised form — your user id, IP address and browser are stripped out, leaving only that a sign-in happened, when, by what method, and whether it worked. This is kept so that a question like “was this account accessed by someone else before it was closed?” can still be answered. What remains identifies nobody.
7Location
Your data is held in cloud infrastructure operated by the processors named above and may be processed outside India. Where that happens it is under those providers’ own transfer safeguards. If your firm needs data held only in India, tell us before you upload client material — that is a hosting decision, and not one we would want you to assume.
8If something goes wrong
If personal data held by us is exposed or lost, we will investigate, act to contain it, and notify affected users and the Data Protection Board of India as the Digital Personal Data Protection Act, 2023 requires. We will tell you what happened and what data was involved, rather than only that “an incident occurred”.
Report a suspected problem to lawyersaathi1@gmail.com. A security report is welcome and will not be treated as a breach of the terms.
Write to lawyersaathi1@gmail.com. We answer in Gujarati or English.