Privacy Policy

HouseofTech Innovation Pvt Ltd (“we”, “us”, “our”, or the “Company”) operates Nyaya AI, an AI workspace and practice manager for Indian lawyers, available at nyayaai.co (the “Platform”).

Nyaya AI lets you draft legal documents, review and redline contracts, research questions of Indian law, translate and summarise material, compute statutory interest, and manage clients, matters, hearings and invoices. This Privacy Policy explains what we collect, why, and what we never do with it.

By creating an account or using the Platform, you agree to the practices described here. If you do not agree, please do not use the Platform.

1. Information We Collect

A. Information you provide directly

• Account details — your name, email address, and (optionally) your firm name, phone number and Bar Council enrolment number.
• Matter data — client names and contact details, matter titles, court and case numbers, hearing dates, notes, and invoice line items that you enter.
• Documents you upload — contracts, orders, pleadings, notices, and other files (PDF/DOCX) that you submit for review, drafting reference, translation or summarising.
• Prompts and instructions — the briefs, questions and refinement instructions you type into Draft, Review, Research, Translate and Brief.
• Payment-related details — the plan you buy and the gateway’s transaction reference. Card, UPI and netbanking credentials are handled entirely by the payment gateway and never reach our servers.
• Correspondence — support queries, feedback and the ratings you give to AI output.

B. Information collected automatically

• Device and browser information: browser type, operating system, IP address, language and region.
• Usage data: pages visited, tools run, and timestamps — recorded as events, not as the contents of your documents.
• Performance data: error logs and diagnostics used to keep the Platform reliable.
• Advertising and analytics identifiers set by the Meta Pixel and similar tools on our marketing pages, used to measure the performance of our advertising. These do not run inside your authenticated workspace on matter data.

C. Information we do NOT collect

• We do not read, index or scan your device’s file system — only the specific files you upload enter the Platform.
• We do not collect biometric identifiers, and we do not require Aadhaar, PAN or any government ID to use the Platform.
• We do not store your full card number, UPI PIN, CVV or netbanking credentials.
• We do not sell personal data or matter data to anyone, in any form.

2. How We Use Your Information

• Create and secure your account and keep you signed in.
• Run the tool you invoke — draft, review/redline, research, translate, brief, interest computation — on the input you supply.
• Store your matters, clients, hearings, documents and invoices so your workspace persists between sessions.
• Verify payments, activate your plan, and issue receipts and tax invoices.
• Maintain an audit record of AI runs (tool used, input reference, output, citations) so that you can trace how a draft was produced.
• Detect and prevent fraud, abuse and unauthorised access, and enforce fair-use limits.
• Improve reliability and fix bugs, using aggregated or de-identified data wherever possible.
• Send service messages such as receipts, plan-expiry notices and important account notices.

3. Your Documents and Matter Data

• Uploaded documents are stored as objects in Google Cloud Storage in the asia-south1 (Mumbai) region, under a path scoped to your firm.
• Matter, client, hearing, document and invoice records are stored in Google Cloud Firestore, also in asia-south1 (Mumbai).
• Access is scoped to your firm’s account. Other users of the Platform cannot see your documents or matters.
• Our staff do not routinely access the contents of your documents. Limited access may occur only for support you have requested, for a security investigation, or where legally compelled — and, where lawful, only after telling you.
• You can delete a document, matter or client from within the workspace at any time. Deletion removes it from your workspace and schedules removal of the stored object.

4. AI Processing — What Is Sent and to Whom

• AI runs only when you invoke a tool. Nothing is sent automatically in the background.
• When you run a tool, the text of your prompt, the text extracted from any documents you attached, and the relevant portion of our bare-Act corpus are sent to a large-language-model provider acting as our processor — currently Google (Gemini) and, for long-form asynchronous drafting, Anthropic and/or OpenAI.
• These providers are engaged under terms that prohibit using your content to train their models. We do not use your content to train any model either.
• AI providers may process data outside India, including in the United States and the European Union. Where a cross-border transfer requires safeguards, we rely on Standard Contractual Clauses or equivalent mechanisms.
• We keep a record of each AI run (the tool, the input reference, the output and any citations) against your account, so you can audit how a document was produced and so we can investigate errors and abuse.
• Do not paste material you are not permitted to disclose to a cloud processor. You remain responsible for your professional obligations of confidentiality and privilege in respect of client material.

5. Payments

• Payments are processed by RBI-licensed payment gateway partners (currently Instamojo; we may also use Razorpay, PhonePe or a similar provider). The active gateway may change without prior notice.
• The gateway collects and holds your payment credentials under its own PCI-DSS security standards. We receive only the transaction reference, the amount, and the buyer email/phone the gateway reports.
• We retain your plan, plan expiry date and transaction reference for billing, accounting and tax compliance.
• Plan, pricing, renewal and refund terms are set out in our Payment & Cancellation Policy.

6. Sharing & Disclosure

We do not sell or rent your personal data or your documents. We share limited data only:

• With service providers acting as our processors — Google Cloud (hosting, database, object storage), large-language-model providers (AI features), payment gateways (Instamojo, Razorpay, PhonePe), email delivery, and error/analytics infrastructure — under data-protection terms, and only to the extent needed to run the Platform.
• With recipients you choose — when you export or share a draft, that file goes where you send it, and its handling from that point is outside our control.
• To comply with a valid Indian legal process, court order or lawful government request. Where we are lawfully able to do so, we will give you reasonable notice and an opportunity to object before disclosing matter material.
• In connection with a merger, acquisition or restructuring, with notice to users.
• To protect the rights, safety and security of our users and the Platform.

7. Data Storage & Security

• All traffic to and from the Platform is encrypted in transit with TLS. nyayaai.co serves HSTS and is HTTPS-only.
• Data at rest in Google Cloud Storage and Firestore is encrypted using Google-managed encryption.
• Authenticated API responses are marked non-cacheable and varied on session, so one firm’s response can never be served from a shared cache to another.
• Access to production systems is restricted to authorised personnel and secrets are held in Google Secret Manager.
• No system is perfectly secure. Keep your credentials confidential, and keep your own copies of documents you cannot afford to lose.

8. Data Retention

• Account, matter, client and document records are retained while your account is active, and are deleted when you delete them or delete your account.
• AI-run records are retained while your account is active so you can audit your own drafts, and are deleted with your account.
• Transaction records are retained for the period required by applicable tax and accounting law (typically up to 7 years), even after account deletion.
• Server and security logs are retained for a short operational period, typically up to 90 days.
• Analytics data may be retained in anonymised form for up to 24 months.
• You may request deletion at any time — see Delete Account.

9. Your Rights

Under India’s Digital Personal Data Protection Act, 2023, and comparable laws such as the GDPR and CCPA/CPRA where they apply to you, you have the right to:

• Access a copy of the personal data we hold about you
• Correct or update inaccurate information
• Request erasure of your data (“right to be forgotten”)
• Withdraw consent, without affecting processing already carried out
• Nominate another person to exercise your rights in the event of death or incapacity (DPDP Act, section 14)
• Grievance redressal — see section 12 below
• Lodge a complaint with the Data Protection Board of India or your local data-protection authority

To exercise any of these rights, write to nyaya@houseoftech.ai from your registered email address. We respond within the timelines required by applicable law and never discriminate against you for exercising your rights.

10. Third-Party Data You Upload

• Documents you upload routinely contain the personal data of your clients and of third parties. In respect of that data, you are the Data Fiduciary / controller and we act as your Data Processor.
• You confirm that you have a lawful basis — your retainer, your client’s instructions, or the conduct of proceedings — for putting that material through the Platform.
• We process it only on your instructions, only to deliver the feature you invoked, and we delete it when you delete it.

11. Children

Nyaya AI is a professional tool intended for advocates, law firms and legal teams. It is not directed at children and may only be used by persons aged 18 or above. We do not knowingly collect data from children.

12. Grievance Officer

In compliance with the Information Technology (Reasonable Security Practices) Rules and section 13 of the Digital Personal Data Protection Act, 2023:

• Grievance Officer — HouseofTech Innovation Pvt Ltd, F-118, Adani Galeria, Sector 89A, Gurgaon, Haryana, India
• Email: nyaya@houseoftech.ai (subject line: “Nyaya AI Grievance”)
• We acknowledge complaints within 48 hours and dispose of them within 30 days.

13. Changes to This Policy

• We may update this Privacy Policy from time to time.
• Material changes will be notified in the product or by email to your registered address.
• Continued use of the Platform after an update means you accept the revised policy.

14. Contact Us

• Company name: HouseofTech Innovation Pvt Ltd
• Product: Nyaya AI (nyayaai.co)
• Email: nyaya@houseoftech.ai
• Address: F-118, Adani Galeria, Sector 89A, Gurgaon, Haryana, India