Privacy notice

VakilBox is run by [legal name of the company], [registered office address]. We hold personal data in two different roles.

• For law firms’ case files, we are a processor. If you are a client of a firm, a party to a case, or anyone named in a firm’s files, the law firm is responsible for your data (the “Data Fiduciary”). We store and process it only on the firm’s instructions, under our Data Processing Agreement. Please contact the firm first about that data.
• For our own users and visitors, we are responsible. For the data of advocates and staff who use VakilBox, firm billing contacts, and people who use our website, we are the Data Fiduciary.

We process your data with your consent, or for a legitimate use the Digital Personal Data Protection Act, 2023 allows — for example, data you give us yourself to use the service, or what the law requires us to keep, such as tax records.

Where we rely on consent, you can withdraw it at any time in the same way you gave it, or by writing to grievance@vakilbox.com. Withdrawing consent does not affect what was done before. If you withdraw consent needed to run your account, we may no longer be able to provide the service to you.

We store the data of firms registered in India in AWS Mumbai (ap-south-1). A firm's region is set when it registers and cannot be changed. Backups stay in the same region.

Only members of your firm can see firm data, and what each person sees depends on the roles and file-by-file access your firm sets. Our operators cannot read case data. Support gets access only when your firm grants it, for a limited time, and we record it.

We use a small number of providers to run the service — hosting, document storage and bot protection, payments, AI-assisted features when a member uses them, and crash reports if switched on. They are listed, with what each does, in the Data Processing Agreement. Some of them process data outside India, as the law allows.

We disclose data to authorities only when the law requires it. For firm data, we tell the firm first where the law allows.

We do not sell personal data. We do not share it with advertisers or data brokers. The apps carry no advertising or third-party analytics identifiers. We do not use firm data to train artificial-intelligence models.

• Firm data: while the firm’s subscription lasts, and for 90 days after the firm closes its account. Each firm can also set how long data is kept for each type of case. Then it is deleted, and we issue a certificate. Backup copies expire within 30 days after that.
• Member accounts: until the member is removed or deletes their account. After deletion, the name in the firm’s records is replaced with “Former member”.
• Invoices and tax records: as long as tax law requires (currently at least 8 years).
• Security logs: 180 days, as Indian cyber-security directions require.
• Contact-form messages: one year after we answer them. Newsletter: until you unsubscribe.

Data is encrypted between your device and our servers, and stored documents and backups are encrypted by our storage provider. Each firm’s data is walled off from every other firm inside the database. Passwords are stored only as one-way hashes. The Data Processing Agreement and the Trust & security page give more detail.

Under the Act you can:

• ask for a summary of the personal data we hold about you and how we use it, and who we have shared it with;
• ask us to correct, complete or update it;
• ask us to erase it, unless the law requires us to keep it;
• withdraw consent;
• nominate someone to use these rights for you if you die or cannot act;
• raise a grievance with us, and then, if you are not satisfied, complain to the Data Protection Board of India.

Members can delete their own account in the app (More → Delete my account) or on the delete account page. For data in a law firm’s files, ask the firm first; we will help the firm answer you.

Write to our grievance officer, [name of grievance officer], at grievance@vakilbox.com. We acknowledge every grievance within 48 hours and reply within 30 days. If you are not satisfied with our reply, you may complain to the Data Protection Board of India.

If a breach affects your personal data, we will tell you and the Data Protection Board as the law requires: what happened, what it means for you, and what you can do. For data in a law firm’s files, we tell the firm within 24 hours so that it can notify you.

The Android app collects your name, mobile number and e-mail to sign you in, and the case data you enter: clients, parties, hearings, documents, tasks, fees and expenses. It records an audit trail of who saw and changed what, because a law firm needs one. It also records an identifier for the phone itself, so a lost device can be signed out from your other devices.

The app asks for the microphone only when you tap to dictate a hearing outcome, so you can record what happened without typing in court. It never listens in the background. It asks for photos or the camera only when you attach an order sheet or a document to a case. It does not read your location, your contacts or your phone's calendar.

So the app works in court without signal, a copy of your firm's case data is kept on the phone itself and synced when you are back online. Your sign-in token is held in the phone's secure keystore. Turn on the app lock so a fingerprint or PIN is needed to open the app — on a phone that holds privileged client material, this matters.

Subscription payments are taken by Razorpay or Stripe on their own pages. Card numbers never reach VakilBox and are never stored by us or by the app.

The website and apps use only the cookies and browser storage needed to work: keeping you signed in, remembering light or dark mode, and Cloudflare’s bot check on forms. We use no advertising or tracking cookies, so there is nothing to opt out of.

VakilBox is a professional tool for advocates and their staff; members must be 18 or older. Law firms’ files can include data about children who are parties to a case. The firm is responsible for that data and for any parent’s or guardian’s consent the law requires.

If this notice changes in a way that affects you, the version number changes and we tell firm administrators in the app before the change takes effect.