Zero-Retention Guarantee
Your matter files, queries, and drafts are never used to train or refine foundational AI models.
Sovereign Data Residency
All data resides strictly within Indian sovereign borders (AWS Mumbai & Azure Central India).
Cryptographic Privilege
AES-256 GCM encryption at rest, TLS 1.3 in transit, and granular matter-level logical access boundaries.
Effective Date: September 10, 2026 | Governing Framework: Digital Personal Data Protection Act (DPDP) 2023, Information Technology Act 2000, and Bar Council of India professional standards.
1. Introduction & Scope
VakilOS Technologies Private Limited (“VakilOS”, “we”, “us”, or “our”) operates the sovereign enterprise generative AI platform and legal operating system for Indian advocates, senior advocates, law firms, and in-house legal departments.
This Privacy Policy explains how we collect, process, store, and safeguard data when you access our web application, document vaults, research workspaces, and marketing pages at vakilos.ai.
2. Absolute Model Training Immunity & Non-Retention
We recognize that attorney-client communications and legal work product are subject to statutory privilege under Sections 126 through 129 of the Indian Evidence Act, 1872 / Bharatiya Sakshya Adhiniyam, 2023.
- No Foundational Model Training: Documents uploaded to VakilOS Vaults, queries submitted to AI agents, and generated drafts are strictly excluded from model training datasets.
- Ephemeral Inference: AI inference processing runs in isolated, memory-contained environments with zero persistence on third-party model vendor infrastructure.
- Matter-Level Isolation: Vector embeddings and search indices are logically partitioned by tenant ID and space ID, preventing any cross-tenant data leakage.
3. Information We Collect
We collect only the minimum personal and operational data necessary to deliver our legal software services:
A. Account & Identity Credentials
Full name, official work email address, law firm or enterprise organization name, phone number, and passwordless authentication session logs.
B. Customer Matter Data
Court records, trial documents, contracts, bare act queries, and research instructions explicitly uploaded or provided by you.
C. Security & Audit Logs
IP addresses, cryptographic hash signatures, access timestamps, user agent strings, and role-based action histories to prevent unauthorized workspace access.
4. Sovereign Data Residency & Security Standards
In strict adherence to Indian data sovereignty directives and Section 16 of the Digital Personal Data Protection Act 2023:
- Domestic Infrastructure: Customer primary databases, encrypted file storage, and vector indices reside exclusively within data centers in Mumbai (AWS `ap-south-1`) and Pune (Azure India).
- Encryption at Rest & Transit: All data is encrypted using AES-256 GCM at rest and TLS 1.3 in transit with strict Perfect Forward Secrecy.
- Zero Human Review: VakilOS personnel do not inspect, browse, or read your private vault documents without explicit, auditable written consent for support diagnostics.
5. Your Rights Under DPDP Act 2023
As a Data Principal under Indian law, you have enforceable rights regarding your personal information:
- Right to Access: You may request a structured copy of all personal credentials associated with your account.
- Right to Correction & Erasure: You can request immediate correction of inaccurate profile data or complete deletion of your workspace and matter documents.
- Right of Grievance Redressal: You have the right to register concerns directly with our Grievance Officer and receive formal resolution within statutory timelines.
6. Cookies and Tracking Technologies
We use strictly necessary functional cookies and local tokens to maintain authenticated sessions and remember workspace configurations. We do not employ third-party advertising trackers or behavioral cross-site analytics cookies.
7. Data Protection & Grievance Officer
Pursuant to the Digital Personal Data Protection Act 2023 and the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021, you may direct all privacy inquiries, data deletion requests, or grievances to our designated desk:
VakilOS Privacy & Data Protection Desk
Email: support@vakilos.in
Platform: https://vakilos.ai
Response Commitment: All data principal inquiries are formally acknowledged within 24 business hours.