DPDP Act 2023

Privacy Policy

Last updated: May 17, 2026 • Data localization within India (Mumbai Region)

DPDP Act 2023 Compliance: This Privacy Policy is drafted in accordance with the Digital Personal Data Protection Act, 2023 (India). LegalMint AI acts as a Data Fiduciary.

Data We Collect

We collect the following categories of personal data:

Account Data: Name, email address, phone number
Business Data: Company name, business type, entity structure, GSTIN, PAN, CIN
Usage Data: Pages visited, documents generated, features used
Payment Data: Processed by Cashfree (we do not store card details)
Technical Data: IP address, browser type, device information, cookies

Purpose of Processing

We process your data for:

Providing and improving the Platform
Generating legal documents based on your business profile
Tracking compliance requirements applicable to your business
Sending regulatory alerts and compliance reminders
Processing payments and managing subscriptions
Communicating with you about service updates
Complying with legal obligations under Indian law

Legal Basis

We process personal data based on your consent (Section 6, DPDP Act 2023) and for legitimate purposes including contract performance and legal compliance.

Data Storage & Localization

All personal data is stored in India using Supabase's Mumbai region. We do not transfer personal data outside India without your explicit consent, in compliance with DPDP Act data localization requirements.

Data Sharing

We share data only with:

Cashfree: For payment processing (PCI-DSS compliant)
Resend: For email delivery
NVIDIA/Groq: For AI document generation (anonymized, no personal identifiers)
Vercel: For hosting and infrastructure

We do NOT sell your personal data to third parties. All service providers are bound by data processing agreements.

Data Retention

We retain your data for as long as your account is active. Upon account deletion, personal data is permanently removed within 30 days, except where retention is required by Indian law (e.g., tax records under the Income Tax Act, 1961).

Your Rights (Data Principal Rights)

Under the DPDP Act 2023, you have the right to:

Access: Request a copy of your personal data
Correction: Update inaccurate or incomplete data
Erasure: Request deletion of your personal data
Grievance Redressal: Raise complaints about data processing
Nominate: Nominate a person to exercise rights in case of death/incapacity

Exercise these rights via Settings > Data & Privacy, or contact our Data Protection Officer.

Cookies

We use essential cookies for authentication and session management. We may use analytics cookies to understand Platform usage. You can manage cookie preferences in your browser settings.

Security Measures

We implement industry-standard security measures including encryption in transit (TLS 1.3), Row Level Security (RLS) in our database, rate limiting, and security headers. Sensitive fields (PAN, GSTIN) are encrypted at rest.

Children's Data

The Platform is not intended for individuals under 18. We do not knowingly collect data from children. If you believe a child has provided personal data, contact us immediately.

Grievance Redressal

For privacy concerns, contact our Grievance Officer:

Grievance Officer, LegalMint AI
Email: privacy@legalmint.ai
Response time: Within 72 hours

If unresolved, you may approach the Data Protection Board of India.

Changes to This Policy

We may update this Privacy Policy. Material changes will be notified via email and in-app notification. Continued use constitutes acceptance of the updated policy.