1. Introduction & Commitment

Welcome to NyayaSetu (“nyaysetu.xyz”, “we”, “us”, or “our”), India's eCourts-verified legal service marketplace and digital practice management platform. We are deeply committed to safeguarding the privacy and confidentiality of litigants, advocates, bar council members, and all visitors who access our platform.

This Privacy Policy sets out how NyayaSetu collects, processes, stores, and protects personal data in compliance with the Digital Personal Data Protection Act, 2023 (DPDPA 2023), the Information Technology Act, 2000, and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011.

2. Data We Collect

To deliver verified legal match-making, eCourts status synchronization, and escrow milestones, we collect the following categories of information:

A. Information Provided Directly by Users

• Litigants & Clients: Full name, verified mobile number, email address, city/district, case inquiry descriptions, preferred court jurisdiction, and consultation appointment preferences.
• Advocates & Legal Practitioners: Full name, State Bar Council Enrollment Number (e.g., G/1234/2018), bar council digital card/certificate, chamber address, practice specialties (Civil, Criminal, Corporate, Matrimonial, Constitutional), years of experience, educational credentials, and verified bank account details for milestone disbursements.
• Authentication Credentials: OAuth profile data (via Google Identity Services), cryptographic password hashes (if registering via email/password), and session security tokens.

B. Public Registry & eCourts Ground Truth Data

• eCourts & High Court Records: For advocate trust scoring and verified case diary synchronization, NyayaSetu queries publicly accessible case records published via the National Judicial Data Grid (NJDG) and District/High Court e-Courts portals. This includes public CNR numbers, cause lists, case statuses, and judicial disposal records.

C. Technical & Usage Telemetry

• Device information, browser type, operating system, IP address, referral URLs, session timestamps, and interaction logs captured to detect automated abuse, prevent DDoS attacks, and optimize platform speed.

3. How We Use Collected Data

We process your data strictly for legitimate legal facilitation purposes:

• Advocate Identity Verification: Cross-referencing bar enrollment numbers against authorized Bar Council databases to prevent quackery and impersonation.
• AI Legal Triage (NyayaMitra): Analyzing natural language legal queries against Bharatiya Nyaya Sanhita (BNS 2023), Bharatiya Nagarik Suraksha Sanhita (BNSS 2023), and relevant statutes to categorize legal matters and suggest relevant practice areas.
• Chamber Appointments & Diary Management: Synchronizing advocate hearing dates and facilitating appointment slots between verified citizens and legal chambers.
• Escrow Milestones & Audit Logs: Tracking transparent escrow release agreements, verified disbursements, and billing receipts without intermediary fees.
• Compliance & Security: Enforcing compliance with Bar Council of India (BCI) Rule 36, fraud detection, and regulatory obligations under Indian law.

4. Data Protection under DPDPA 2023

As a Data Fiduciary under the Digital Personal Data Protection Act, 2023, NyayaSetu guarantees the following statutory rights to all Indian citizens (Data Principals):

• Right to Access: You may request a machine-readable summary of all personal data processed by NyayaSetu associated with your account.
• Right to Correction & Erasure: You can edit profile information or request permanent deletion of your account and related metadata, subject to regulatory retention laws.
• Right to Grievance Redressal: Dedicated redressal channels with designated turn-around times through our Data Protection & Grievance Officer.
• Right to Nominate: You have the right to nominate an individual who, in the event of death or incapacity, shall exercise your data rights.

5. Third-Party Integrations & Service Providers

NyayaSetu integrates with trusted third-party service providers who adhere to rigorous data security standards:

• Google Identity Services (OAuth 2.0): Provides secure one-click sign-in without NyayaSetu directly processing or storing external passwords.
• Google Analytics & Search Console: Aggregated, anonymized website analytics to monitor system performance and indexing (governed by Google's Privacy Policy).
• Cloud Infrastructure (Render): Fast, secure backend microservices hosted in ISO 27001 / SOC 2 compliant data centers with strict role-based firewalls.
• Payment Gateway & Escrow Banking: RBI-compliant payment aggregator partners for digital escrow holding and UPI/NEFT disbursements.

6. Data Security & Storage Architecture

We employ state-of-the-art security measures to protect your confidential information:

• Encryption in Transit: All web traffic is strictly encrypted using Transport Layer Security (TLS 1.3 / HTTPS).
• Encryption at Rest: Database assets, user identifiers, and encrypted session secrets are secured with AES-256 standard cryptographic suites.
• Minimal Data Exposure: AI legal triage queries are ephemeral and stripped of Personally Identifiable Information (PII) before model processing.

7. Cookies and Local Storage

NyayaSetu uses localized browser storage (localStorage) and essential session cookies exclusively for:

• Maintaining user login session tokens securely.
• Remembering language preferences (English, Hindi, Gujarati).
• Caching verified advocate directory search filters for improved rendering performance.

We do not use invasive third-party cross-site trackers or unauthorized behavioral ad networks.

8. Data Retention Policy

We retain personal data only for as long as necessary to fulfill the operational purposes for which it was gathered, or to comply with statutory audit obligations:

• Active account records are maintained until an explicit deletion request is fulfilled.
• Financial escrow records and invoices are archived for seven (7) years in compliance with Indian Income Tax and accounting laws.
• Temporary query logs and triage session caches are purged automatically within thirty (30) days.

9. Grievance Redressal & Data Protection Officer

In accordance with the Information Technology Act, 2000 and DPDPA 2023, if you have questions, concerns, or wish to exercise your data principal rights, please contact our designated Grievance Officer:

10. Updates to This Policy

We may update this Privacy Policy from time to time to reflect evolving regulatory standards, new judicial precedents, or platform enhancements. Significant amendments will be visibly notified on the NyayaSetu home dashboard with the updated “Effective Date”.