Privacy Policy

1. Who is responsible

Shivendra Pratap Singh, Prayagraj, Uttar Pradesh, India is the Data Fiduciary for the purposes of the Digital Personal Data Protection Act, 2023. Contact details are at the end.

2. What we collect

• Account details — your name, email address, and the answer to your security question. Your password and your security answer are stored only as bcrypt hashes; we cannot read either of them.
• What you write — the facts you enter, the documents generated from them, saved versions, and any client or hearing details you record.
• Usage records — which features you used and when, the number of AI tokens and searches consumed, and the cost of each. Used for capacity and billing, not profiling.
• Payment records — plan, amount, dates, and the Razorpay order and payment identifiers. We never receive your card number, CVV, UPI PIN or bank credentials. Those go directly to Razorpay.
• Institution membership — if you join a college, the fact of your membership and, if set, your batch.
• Technical data — a session cookie to keep you signed in, and server logs including IP address for security and debugging.

3. Why we collect it

• To provide the service you asked for — that is the lawful basis for most of it.
• To keep your account secure and let you recover it if you forget your password.
• To take payment and issue receipts.
• To understand load and cost so the service stays affordable and available.
• To comply with Indian tax and accounting law.

4. How long we keep it

• Your documents are kept until you delete them. There is no automatic expiry. Delete a draft and it is removed from the live database.
• Your account is kept until you close it. Closing it deletes your drafts, clients and hearing records with it.
• Backups are held by our database provider on a rolling basis and are overwritten in the normal course. Something deleted from the live service may persist in a backup for a short period before ageing out.
• Payment and invoice records are kept as long as Indian tax law requires, even after an account is closed. We cannot delete these on request.
• Usage logs are kept in aggregate for capacity planning.

5. Who else sees your data

We use the following providers. Each receives only what it needs to do its job, and none of them is permitted to use your data for their own purposes.

• Groq (United States) — receives the facts you enter, to generate the draft. This is the only third party that sees your document text.
• Neon (United States) — hosts the database where your account and documents are stored.
• Vercel (United States) — hosts and serves the application.
• Razorpay (India) — processes payments. Receives your name, email and the amount. Handles all card and UPI details itself.
• Indian Kanoon (India) — receives your search terms when you search judgments. It does not receive your documents or your identity.
• India Code (India) — a Government repository we read from. It receives nothing about you.
• Our email provider — receives your address to deliver service emails such as receipts.

Some of these operate outside India, so your data may be processed abroad. We will also disclose data where the law or a court requires it.

6. Who can see your documents inside LexForge

• You. Nobody else, by default.
• Not your college. A faculty co-ordinator can see that you are active and how many documents you have made. They cannot open one or read a word of it.
• Not other users. Accounts are isolated.
• Our administrator has database access, which is unavoidable for running and repairing the service. It is used for support and diagnosis, not for reading.

7. Your rights

Under the Digital Personal Data Protection Act, 2023 you may:

• Access the personal data we hold about you.
• Correct anything inaccurate — your name and email from Account settings, anything else by writing to us.
• Erase your data by deleting individual drafts or closing your account, subject to records we must keep by law.
• Complain to us first, and to the Data Protection Board of India if we do not resolve it.
• Nominate someone to exercise these rights if you die or become incapacitated — write to us.

8. Security

• All traffic is encrypted in transit over HTTPS.
• Passwords and security answers are hashed with bcrypt at cost 12 and are never stored in readable form.
• We deliberately hold no password reset tokens. Recovery works through your security question instead, so there is no long-lived token in the database for anyone to steal.
• Repeated wrong answers to a security question lock recovery temporarily.

No system is perfectly secure. If a breach affects your data we will notify you and the Data Protection Board as the law requires.

9. Cookies

We use one essential cookie to keep you signed in. There are no advertising cookies, no third-party trackers, and no cross-site analytics. There is nothing to opt out of, which is why you are not asked.

10. Children

LexForge is not for anyone under 18 and we do not knowingly collect data from children. If you believe a child has created an account, write to us and we will remove it.

11. Changes

We will update this policy as the service changes. The date at the top shows when it last changed, and we will give notice in the app for changes that materially affect you.

12. Grievance Officer

For any question or complaint about your personal data, contact us. We respond within 30 days, and usually far sooner.