Privacy

Privacy Policy

Last updated: October 2026

This Privacy Policy describes how Bharat Technologies, Inc., a Delaware corporation, and its affiliates ("Bharat.Law", "we", "us") collect, use, share, and protect personal data when you visit bharat.law, use the app at app.bharat.law, the mobile applications, the NyaI™ system, the External Advocate network, and the related products and services (the "Services").

We follow the local laws that apply to you and to us, including data-protection, technology and consumer-protection rules. Where another data-protection regime applies to your use of the Services, we apply the additional safeguards required by that regime.

If you are using the Services as an employee or contractor of an organisation that has a Platform Agreement with us, your organisation is the controller of the content its users submit and create under applicable local laws; this Privacy Policy explains our practices, and the Platform Agreement governs our processing on your organisation's behalf.

1. Personal data we collect

Account and billing data: name, work email, mobile number, role, organisation, password (hashed), multi-factor tokens, billing address, GSTIN where applicable, and payment-instrument metadata (we do not store full card numbers; payments are processed by our payment partners).
Documents: files and case materials you or your Authorised Users upload to the Services, and the content extracted from them. Documents may contain any category of personal data the user chooses to submit, including sensitive personal data.
Research conversations: research queries and general questions you or your Authorised Users ask the Services, and the responses generated.
Work product: drafts, notes, summaries, and other content you or your Authorised Users create or generate in the Services.
Usage and device data: actions you take in the Services, in-product telemetry, error logs, browser type, operating system, device identifiers, IP address, approximate geolocation derived from IP, and timestamps.
Communications data: support tickets, chat transcripts, in-product messages, voice calls (where permitted and disclosed), and email correspondence with us.
Demo requests: when you ask for a demo: your name, email address, mobile number, organisation, practice type, team size, the times you suggest, anything you tell us about what you want to see, the page you came from, and a fraud-prevention score from Google reCAPTCHA.
Information from third parties: data we receive from identity providers when you sign in via SSO, from payment processors confirming a transaction, and from analytics and advertising partners about how you found and use the Services.
Court data: publicly available court information, such as case status, cause lists, orders, and judgments, which we collect from court and other public sources. Court data may include the names of parties and advocates. It is not specific to any user.
Information from External Advocates: where you engage an External Advocate through the Services, we may receive information from the advocate relating to your matter for fulfilment and quality-assurance purposes.

2. Why we use personal data

To provide the Services you have requested, including hosting your documents, research conversations, and work product, generating Outputs, tracking court matters, processing payments, and connecting you with External Advocates where you ask us to.
To operate, maintain, and secure the platform, including monitoring for fraud, abuse, and intrusion.
To train models that improve the customer experience and spam filtering, using anonymised research conversations as described in section 5. We never use documents or work product for model training.
To understand how the Services are used, and to measure and target our advertising, using analytics and advertising partners as described in section 4 and the Cookie Policy.
To communicate with you about your account, billing, security, product changes, and (with consent or as otherwise lawful) marketing.
To meet legal obligations and respond to lawful requests from courts, regulators, and law-enforcement authorities.
To exercise or defend legal claims.

3. Lawful basis

We process personal data only on a lawful basis recognised by the local laws that apply to you, including:

your consent, where you have given it - for example, for marketing emails or for optional features that share data with a third party;
the performance of a contract with you, including fulfilling a service you have requested;
our legitimate interests in operating, securing and improving the Services;
compliance with our legal obligations.

5. Model training

We treat each type of content differently:

Documents: documents you upload, and the content extracted from them, are never used to train, fine-tune, or improve any AI model, whether ours or a third party's.
Work product: drafts, notes, summaries, and other work you create in the Services are never used for model training.
Research conversations: your research queries and general questions, and the responses to them, may be used to train models that improve the customer experience and spam filtering. They are anonymised before use, so they do not identify you, your organisation, or any other individual, and we never use them in a way that discloses them to other users.
Third-party AI providers: the AI model providers we use are not permitted to use any of your content to train or improve their own models.
Operational signals: we use processing errors, performance data, and feedback you choose to send us to improve the reliability of the Services in general. These improvements never depend on the content of your documents.

Organisations using the Services under a Platform Agreement can find the binding commitments in the Data Processing Addendum.

6. International transfers

We may transfer personal data to, and process it in, jurisdictions outside your country of residence, in accordance with the local laws that apply to you and to us. Where required, we apply additional safeguards (such as contractual protections) to keep the data subject to a level of protection comparable to its origin.

7. Retention

We retain personal data only for as long as we need it for the purposes for which it was collected, including any period required by law. The main retention periods are:

Account data: for the duration of your account and a reasonable period afterwards for record-keeping, taxation, and dispute resolution.
Documents: for as long as you keep them in the Services. When you delete a document, it is held for up to 12 hours and then automatically and permanently deleted, together with references to it; it cannot be recovered during or after that period. Drafts or research you created from the document remain until you delete them, but their citations to the deleted document stop working.
Research conversations and work product: for the duration of your account, or until you delete them, so you can return to your research and drafts. Anonymised data used for model training no longer identifies you and is not linked to your account.
On account closure or the end of a Subscription Term: your content remains available for export for at least 30 days and is then deleted within a further 30 days, unless law requires us to keep it.
Court data: retained independently of any account, because it is public information that is not specific to any user.
Usage and device data: for security and analytics purposes, for the periods set out in our internal policy.
Communications data: for the duration of an active matter and a reasonable period thereafter.
Demo requests: the request record is deleted automatically 30 days after you submit it. The acknowledgement email, and any replies, are kept with our communications data.

Where law requires longer retention (for example, tax or anti-money-laundering rules), we will continue to apply this Policy's protections for as long as we hold the data.

8. Security

We maintain technical and organisational measures appropriate to the risk, including encryption in transit and at rest, access controls, monitoring, and incident response. No system is perfectly secure; if we become aware of a personal data breach affecting your personal data, we will respond in line with our Platform Agreement and applicable local laws.

9. Your rights

Subject to the local laws that apply to you, you have the right to:

access the personal data we hold about you;
request correction of inaccurate or incomplete data;
request erasure of personal data, where applicable;
withdraw consent at any time, where consent is the lawful basis (without affecting the lawfulness of processing carried out before the withdrawal);
nominate another person to exercise your rights in case of death or incapacity;
raise a grievance with us; and
approach the supervisory authority that has jurisdiction over you.

You can exercise these rights from your account settings or by writing to privacy@bharat.law. We will respond within the timelines set by applicable local laws and may need to verify your identity before acting on a request.

10. Children

The Services are not directed to individuals under 18 years of age. We do not knowingly collect personal data of a child as defined by applicable local laws. If you believe we have collected such data, please write to privacy@bharat.law and we will take appropriate steps.

11. Cookies and similar technologies

We use cookies and similar technologies as described in the Cookie Policy. You can manage your preferences through the cookie banner and the controls described in the Cookie Policy.

12. Automated processing and AI

We use machine-learning systems (including the NyaI™ system) to power features such as retrieval, drafting, and summarisation. The Services do not make decisions of legal or similarly significant effect about individuals on a solely automated basis. Outputs are intended for review by qualified human users. Where a Customer chooses to deploy a feature in a way that affects individuals' rights, the Customer is responsible for the human-in-the-loop arrangements required by applicable local laws and professional rules.

13. Links to third-party sites

The Services may link to third-party websites, court resources, and applications. Your interaction with those resources is governed by their own privacy notices. We do not control them and are not responsible for their practices.

14. Roles in the External Advocate network

When you use the Services without engaging an External Advocate, Bharat.Law is the controller of your personal data under applicable local laws. When you engage an External Advocate, that advocate is the controller of the personal data you provide to them; Bharat.Law acts as a processor for that data to the extent it passes through the Services. Where you use the Services through an organisation's workspace, the organisation is the controller of the content within that workspace; Bharat.Law is the processor, except where we use anonymised research conversations to train models, for which we act as an independent controller.

15. Changes to this Policy

We may update this Privacy Policy from time to time. If a change is material, we will notify you by email or in-product notice at least 15 days before it takes effect. Continued use of the Services after the effective date confirms acceptance of the updated Policy.

16. Contact and grievance redressal

For privacy questions or to raise a grievance, write to privacy@bharat.law. We will acknowledge your message and respond within the timelines required by applicable local laws.