DRAFT — have a lawyer review before use
1. Who we are
Law2Judge is an exam-preparation app for law students and judiciary aspirants, run by [Legal entity name], [Registered address]. For the purposes of the Digital Personal Data Protection Act, 2023 (DPDP Act), we are the "Data Fiduciary" for the personal data described here.
This policy explains what we collect, why, who we share it with, and the choices you have.
2. What we collect
Account details you give us:
- mobile number (used to sign in with an OTP)
- full name
- email address (optional)
- date of birth
- track (Student or Judiciary aspirant)
- education level
- location
- preferred language (English, Telugu or Hindi)
Study data created as you use the app:
- bookmarks
- progress through content
- MCQ attempts
- cart contents
- notifications feed
Purchase records: order details, payment status, payment reference and invoices. Payments are handled by Razorpay. We never see or store your card or UPI details.
Device and notification data: to send push notifications we use a device notification token. We also keep session information so we can allow only one active device per account.
[Owner/backend to confirm: any crash logs, analytics or IP address logging actually in use. Add them here, or state that none is collected.]
3. Why we use your data
We use your data only for these purposes:
- to create your account and verify you by OTP
- to show content suited to your track, level and language
- to save your progress, bookmarks and practice history
- to process purchases, give you access, issue invoices and handle refunds
- to enforce one active device per account and prevent sharing or misuse
- to send plan expiry reminders and announcements
- to give support and respond to your requests
- to meet legal, tax and accounting obligations
We rely on your consent for this processing, and in some cases on legitimate uses permitted by the DPDP Act (for example, complying with the law).
4. What we do not do
- We do not sell your personal data.
- We do not show advertising in the app.
- We do not use your data for third-party advertising.
5. Who we share data with
We share data only with service providers who help us run the app:
- Razorpay for payment processing
- Amazon Web Services (S3) for cloud file storage
- MongoDB Atlas for our database hosting
- Firebase Cloud Messaging, Apple Push Notification service and Expo for push notifications
These providers process data on our behalf, and some may store it on servers outside India. [Lawyer to confirm cross-border transfer position and any restrictions notified under the DPDP Act.]
We may also disclose data if required by law, a court order or a government authority, or to protect our rights and users' safety.
6. How long we keep data
We keep your account and study data while your account is active.
Order, payment and invoice records are kept for as long as tax and accounting law requires, even after you delete your account.
7. Deleting your account
You can request deletion in the app. After a 30-day grace period, we scrub your personal data and delete your study data. If you sign in again during the 30 days, the request is cancelled.
Order, payment and invoice records are retained as required by tax law. After deletion, we cannot restore your account, progress or access.
8. Your rights under the DPDP Act
You have the right to:
- Access a summary of the personal data we hold about you and how it is used
- Correct or update inaccurate or incomplete data (you can edit most details in the app)
- Erase your personal data, subject to legal retention (see above)
- Grievance redressal if you are unhappy with how we handle your data
- Nominate another person to exercise your rights if you die or become unable to act
- Withdraw consent at any time. This may mean we can no longer provide some or all of the service.
To use these rights, email [Support email] from the contact details on your account, or use the in-app options where available. We may need to verify your identity first. We will respond within a reasonable time [and within any period prescribed by the DPDP Rules].
If we cannot resolve your complaint, you may approach the Data Protection Board of India once it is operational.
9. Children
Law2Judge is for users aged 18 and above. We collect your date of birth and block registration by anyone under 18. If we learn that an under-18 user has an account, we will delete it.
10. Security
We use reasonable safeguards, including encrypted connections and access controls, to protect your data. No system is completely secure, so we cannot guarantee absolute security.
Keep your phone and OTPs private. If there is a data breach affecting you, we will notify you and the authorities as the law requires.
11. Permissions and notifications
The app asks permission to send push notifications. You can turn them off in your phone settings. Turning them off may mean you miss plan expiry reminders.
12. Changes to this policy
We may update this policy. If the changes are important, we will tell you in the app. The page shows when it was last updated.
13. Grievance Officer and contact
In line with the Information Technology Act, 2000 and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, our Grievance Officer is:
- Name: [Grievance Officer name]
- Company: [Legal entity name]
- Address: [Registered address]
- Email: [Support email]
We aim to acknowledge complaints within [48 hours — owner to confirm] and resolve them within [30 days — owner to confirm].
Governing law: India. Courts at [City] have jurisdiction, subject to your statutory rights.