Privacy Policy

1. Information We Collect

1.1 Personal Information

We collect information you provide directly to us, including:

• Name and contact information (email, phone number, WhatsApp number).
• Professional information (Bar Council number for lawyers, firm name).
• Account credentials (username, password).
• Payment information (processed securely through payment gateways).
• Case information and legal documents you upload.
• Communications with our support team.

1.2 Automatically Collected Information

When you use our Service, we automatically collect:

• Device information (IP address, browser type, operating system).
• Usage data (pages visited, features used, time spent).
• Location data (country, city - not precise location).
• Cookies and similar tracking technologies.

1.3 WhatsApp Integration Data

Through our WhatsApp bot, we collect:

• WhatsApp phone number and profile name.
• Messages sent to and from our bot.
• Interaction timestamps and frequency.
• Language preferences.

2. How We Use Your Information

• Providing and maintaining our Service.
• Processing your registration and managing your account.
• Sending OTP for verification.
• Providing customer support.
• Sending legal updates, case alerts, and news (with your consent).
• Processing payments and preventing fraud.
• Improving our Service through analytics.
• Complying with legal obligations.
• Protecting our legal rights and preventing misuse.

3. Why We Are Allowed to Use Your Data

We use your personal data in two ways:

• With your consent. We ask you before we use your data for a stated purpose, such as sending you legal updates. You can withdraw consent at any time.
• For uses the law allows without consent. These are the “certain legitimate uses” in Section 7 of the DPDP Act. Examples: you gave us your details to get a service and we use them for that service, or the law requires us to keep a record.

4. Data Sharing and Disclosure

• Service Providers: Third parties who help us operate our Service (hosting, payment processing, analytics).
• Legal Authorities: When required by law or to protect our rights.
• Business Transfers: In case of merger, acquisition, or sale of assets.
• With Your Consent: When you explicitly agree to sharing.

We do NOT sell your personal information to third parties.

5. Data Security

• Encryption of data in transit and at rest.
• Regular security audits and updates.
• Access controls and authentication mechanisms.
• Employee training on data protection.
• Secure data centers with physical security.

6. How Long We Keep Your Data

We keep data only as long as we need it. After that we erase it. You can ask us to erase your data at any time. We will do so unless a law says we must keep it.

• Account information: until you delete your account, plus 90 days.
• Legal documents you upload: as the law requires, typically 7 years.
• Communication logs and enquiries: 2 years.
• Payment records: as required by tax laws, typically 7 years.
• Security and access logs: at least 1 year, as Rule 8(3) of the DPDP Rules, 2025 requires.

7. Your Rights and How to Use Them

Under the DPDP Act, 2023, you have these rights:

• Access: ask for a summary of the personal data we hold about you and how we use it.
• Correction: ask us to correct wrong or incomplete data.
• Erasure: ask us to delete your data. We will, unless a law says we must keep it.
• Withdraw consent: you can withdraw consent at any time. It should be as easy as giving it.
• Grievance redressal: complain to us if you are not happy with how we handle your data (see Section 14).
• Nominate someone: choose a person to use these rights for you if you die or cannot act.

To make a request, email support@virtualvakil.com or message us on WhatsApp. Tell us the phone number or email you used with us. We may ask you to confirm it is you before we act.

8. Children's Privacy

Virtual Vakil is meant for adults. We do not knowingly collect data directly from anyone under 18. If a matter involves a child, we work with the child's parent or lawful guardian, and we use the child's data only with the verifiable consent of that parent or guardian. We do not track children or show them targeted advertising. If you think we hold a child's data without that consent, write to us and we will erase it.

9. Transfers Outside India

Some of our service providers, such as WhatsApp (run by Meta), may process data outside India. The DPDP Act, 2023 (Section 16) allows this except to countries the Government has restricted. We do not send your data to any country on that list.

10. Cookies and Tracking

We use cookies and similar technologies to:

• Keep you logged in.
• Remember your preferences.
• Analyze usage patterns.
• Improve user experience.

You can control cookies through your browser settings, but disabling them may limit functionality.

11. Third-Party Services

Our Service integrates with WhatsApp Business API, payment gateways, cloud services, and analytics services. These services have their own privacy policies, and we encourage you to review them.

Payments, refunds and cancellation

Payments are processed by our payment partner (Razorpay); we do not store your card or UPI credentials. We keep the payment reference, amount and status needed for receipts, refunds and your membership record. Cyber Surety memberships and paid subscriptions carry a 7-day refund guarantee — see our Refund Policy.

12. Updates to This Policy

We may update this policy from time to time. We will tell you about material changes by email or through the Service.

13. Contact Us

For questions about this policy or to use your rights, write to us:

14. Grievance Officer

If you have a complaint about how we handle your data, write to our Grievance Officer. This is also our grievance contact under the Information Technology Act, 2000 and its rules.

We will reply to every grievance and rights request within 30 days of receiving it. Rule 14(3) of the DPDP Rules, 2025 allows up to 90 days. We have chosen the shorter period. The main provisions of the Rules come into force on 13 May 2027, and we follow this timeline now.

15. Complaining to the Data Protection Board

Please use our grievance process first. Section 13(3) of the DPDP Act, 2023 asks you to do so before you approach the Board.

If we do not reply within 30 days, or you are not satisfied with our reply, you may complain to the Data Protection Board of India. Complaints to the Board are made through its digital office. We will help you set out the facts of your case if you ask.

16. If There Is a Personal Data Breach

If there is a personal data breach, we will inform each affected person without delay and in plain language. We will tell you what happened, what the likely effects are, what we have done, and what you can do to protect yourself. First, we contain the breach and find out what happened.

We will also inform the Data Protection Board without delay and give it full details within 72 hours, as Rule 7 of the DPDP Rules, 2025 requires once Rule 7 comes into force on 13 May 2027. Where the CERT-In Directions of 28 April 2022 apply, we also report to CERT-In within six hours of noticing the incident. If you find a security problem on our website, please report it as described in our security.txt.