Privacy Policy

Last updated: March 24, 2026 | Effective from the date of publication

1. Introduction

LexPatra ("Platform", "we", "us") is operated by M & D Law Associates LLP, a registered Limited Liability Partnership practising at the Punjab & Haryana High Court, Chandigarh, India. This Privacy Policy explains how we collect, use, store, share, and protect your personal data when you use our website, platforms (Draft Sahayak, AI Sahayak, Documents Sahayak), and related services.

This policy is drafted in compliance with the Digital Personal Data Protection Act, 2023 (DPDP Act), the Information Technology Act, 2000, and applicable rules thereunder.

2. Data Fiduciary

For the purposes of the DPDP Act, 2023, the Data Fiduciary is:

3. Personal Data We Collect

We collect the following categories of personal data:

3.1 Data you provide directly: Full name, email address, phone number, username, password (encrypted), user type (individual/lawyer/firm/business/student/institution), postal address (when requesting stamp paper delivery), Aadhaar number (only when required for specific document templates — entered by you into forms, not stored by us beyond document generation).

3.2 Data collected automatically: IP address, browser type and version, device information, pages visited, time spent on pages, referral source, cookies and session identifiers.

3.3 Data from document generation: Form field data entered during DIY document generation (names, addresses, dates, financial figures as required by the specific document template). This data is processed for document generation and stored only for the purpose of enabling re-download within the specified retention period.

3.4 Payment data: Credit purchase transactions are processed through third-party payment gateways (e.g. Razorpay). We do not store your credit card numbers, CVV, or bank account details. We receive only transaction confirmation, amount, and reference ID.

4. Purpose and Lawful Basis for Processing

Under Section 4 of the DPDP Act, we process your personal data for the following legitimate purposes:

4.1 Performance of contract: Account creation, credit management, document generation, expert drafting service delivery, and customer support.

4.2 Consent: Marketing communications, newsletters, and promotional offers (you may withdraw consent at any time).

4.3 Legitimate interests: Platform security, fraud prevention, analytics for service improvement, and legal compliance.

4.4 Legal obligation: Compliance with court orders, regulatory requirements, and applicable laws.

5. Data Storage and Security

Your data is hosted on servers located in India (Asia-South1, Mumbai region) via Google Cloud Platform, ensuring data residency within India as recommended under the DPDP Act. We implement industry-standard security measures including:

AES-256 encryption for data at rest, TLS 1.3 encryption for data in transit, secure password hashing (bcrypt), role-based access controls, regular security audits, and automated backup systems.

Generated documents are stored temporarily and automatically purged after 7 days. No permanent copies are retained unless you explicitly request archival.

6. Data Sharing

We do not sell, rent, or trade your personal data. We share data only with:

6.1 Service providers: Payment gateway (Razorpay), hosting provider (Google Cloud Platform / Hostinger), AI processing providers (for AI Sahayak tools) — all bound by data processing agreements.

6.2 Legal authorities: When required by law, court order, or governmental authority.

6.3 Professional advisors: If you use Draft Sahayak (expert drafting), your brief and document details are shared with the assigned practising advocate of M & D Law Associates LLP for the purpose of rendering legal services. This is protected by advocate-client privilege.

7. Your Rights Under the DPDP Act, 2023

As a Data Principal, you have the following rights:

7.1 Right to Access (Section 11): You may request a summary of your personal data being processed and the processing activities.

7.2 Right to Correction and Erasure (Section 12): You may request correction of inaccurate data or erasure of data that is no longer necessary for the purpose it was collected.

7.3 Right to Grievance Redressal (Section 13): You may raise grievances regarding data processing with our Grievance Officer (details below).

7.4 Right to Nominate (Section 14): You may nominate another individual to exercise your rights in the event of your death or incapacity.

7.5 Right to Withdraw Consent: Where processing is based on consent, you may withdraw consent at any time by contacting us. Withdrawal does not affect the lawfulness of processing prior to withdrawal.

8. Cookies

We use cookies for session management, user preferences, analytics, and platform functionality. See our cookie consent banner for details. You may manage cookie preferences through your browser settings. Essential cookies required for platform operation cannot be disabled.

9. Children's Data

LexPatra is not directed at individuals below 18 years of age. We do not knowingly collect personal data from children. If we become aware that a child's data has been collected, we will take steps to delete it promptly. In compliance with Section 9 of the DPDP Act, verifiable consent of a parent or lawful guardian is required for processing data of persons below 18 years.

10. Data Retention

We retain your personal data only as long as necessary for the purposes stated in this policy. Account data is retained while your account is active and for 3 years thereafter. Generated documents are purged after 7 days. Transaction records are retained for 7 years as required by Indian tax and accounting regulations. You may request earlier deletion by contacting us.

11. Grievance Officer

In accordance with Section 13 of the DPDP Act, 2023 and Rule 5(9) of the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021:

12. Changes to This Policy

We may update this policy from time to time. Material changes will be notified via email or a prominent notice on the Platform. Continued use of the Platform after changes constitutes acceptance.

13. Governing Law

This Privacy Policy is governed by the laws of India. Any disputes shall be subject to the exclusive jurisdiction of the courts at Chandigarh/Panchkula, Haryana.