On this page
In short
We collect what we need to run Legal Staff for you, we do not sell personal data, and we do not use advertising or analytics cookies. For the case data your firm uploads, your firm decides what is collected and why; we process it only on the firm’s instructions. You can ask to see, correct or erase your data, withdraw consent, nominate someone, or complain, using our Data rights page.
Who we are and our role
This policy is issued by Legal Staff (the operator of legalstaff.in) (“Legal Staff”, “we”, “us”). It explains how we handle personal data on our website and in the Legal Staff app, under India’s Digital Personal Data Protection Act, 2023 (the “DPDP Act”) and the Digital Personal Data Protection Rules, as they come into force.
We have two different roles:
- Data fiduciary for account and website data: the details of advocates and staff who sign up, directory applications, demo and contact requests, payments and technical data. We decide why and how this data is used.
- Data processor for practice data that a law firm or advocate enters about its clients, opposing parties, witnesses and others in its cases. The firm is the data fiduciary for that data: it decides what to collect and why, and we process it only to provide the service on the firm’s instructions.
If you are a client of a firm that uses Legal Staff and have a question about your case data, the firm is the right first contact. If you write to us instead, we will pass your request to that firm and tell you we have done so.
What personal data we collect and why
We collect only what each purpose needs. The table lists each purpose.
| Data | What it includes | Why we use it | Basis |
|---|---|---|---|
| Google sign-in | Your name, email address and profile picture, as shared by Google when you choose to sign in. | To create your account, sign you in and show who did what inside your firm. | Consent |
| Firm and team details | Firm or chamber name, team members’ names, emails, roles and phone numbers. | To set up your workspace, control who can see what, and send reminders to the right person. | Consent; contract with the firm |
| Practice data your firm enters | Cases, parties, clients, hearings, orders, documents, notes, tasks and invoices. | To provide the service to your firm. We act as a data processor for this data (see below). | On the firm’s instructions |
| Advocate directory applications | Name, enrolment number, State Bar Council, enrolment year, city, email, mobile, practice areas, courts, languages, and the names of the verification documents you attach. | To verify and, once approved, publish your directory profile. Contact details are used to reach you about the application. | Consent |
| Demo and contact requests | Name, email, phone, firm and your message. | To reply to you and arrange a demo. | Consent |
| Payments | Order and payment IDs, plan, billing cycle, amount and GSTIN (if you give one). Card, UPI and bank details are handled by Razorpay and never reach us. | To activate your plan, issue GST invoices and keep tax records. | Contract; legal obligation |
| Notifications | The email address or WhatsApp number of the member a reminder is for, and the hearing details in it. | To send hearing reminders and briefings that your firm has turned on. | Consent; on the firm’s instructions |
| Technical data | Hosting logs (IP address, browser, time, page requested) and data kept in your browser’s storage. | To keep the service secure and working, and to keep you signed in. See our Cookie Policy. | Legitimate use; necessary for the service |
We do not ask for, and you should not upload to the directory, any document beyond what verification needs. We do not use personal data for advertising, and we do not sell it.
Why we are allowed to use it
Most of our processing is based on your consent, which you give when you sign in, apply to the directory, send us a request or turn on a feature. Consent is specific to the purpose shown at the time, and you can withdraw it (see your rights).
Some processing relies on the “certain legitimate uses” the DPDP Act allows without fresh consent, for example where you have given data voluntarily for a specific purpose, or where we must keep records to comply with law (such as tax and GST records) or respond to a lawful request.
For practice data, the firm is responsible for having a valid basis for the client and party data it enters.
Who we share data with
We share personal data only with service providers that help us run Legal Staff, under contracts that limit them to providing that service. Some only come into play when your firm turns a feature on.
| Provider | What they do | Where |
|---|---|---|
| Supabase | Database, authentication and private file storage for accounts and practice data. | Mumbai, India (ap-south-1 region) |
| Vercel | Hosting and content delivery for the website and app files; security logs. | Global edge network |
| Google sign-in; web fonts for the site. | Global | |
| Razorpay | Payment processing and checkout. | India |
| Resend | Sending email reminders and notices, once email is connected. | May be outside India |
| Meta (WhatsApp Business API) | Sending WhatsApp reminders, only once your firm connects WhatsApp. | May be outside India |
| A court-data provider | Fetching case status by CNR, only if your firm connects one. | Depends on the provider |
Inside a firm, data is visible to that firm’s members according to the roles the firm sets. Client portal sharing shows a client only what the firm chooses to share. We may also disclose data where the law requires it, for example to comply with a court order or a lawful request from a government authority.
Data outside India
Our main database and file storage are hosted in Mumbai, India (AWS ap-south-1, via Supabase). Some providers listed above may process data outside India, for example to deliver email or serve website files from the nearest location. The DPDP Act permits transfer of personal data outside India except to countries the Central Government restricts by notification; we will follow any such restriction.
How long we keep data
- Account and practice data: for as long as the firm’s account is active. The firm can export its data and delete records at any time, and can ask us to delete the account.
- After an account is closed: we delete or anonymise the data within a reasonable period, except what we must keep by law.
- Payment and invoice records: for as long as tax and accounting laws require.
- Directory applications: while the profile is listed or the application is being reviewed; you can ask us to remove it.
- Demo, contact and data-rights requests: as long as needed to deal with them and keep a record of how we responded.
When the purpose is over and no law requires us to keep the data, we erase it, as the DPDP Act and Rules require.
How we protect data
- Row-level security in the database, so each firm can reach only its own records.
- Private storage for documents, reached only by signed-in members of the firm.
- Encryption in transit (HTTPS) between your browser and our services.
- Sign-in through Google, so we never store your password.
- Access logging where our providers make it available, and access to production data limited to people who need it.
No method of storing or sending data is perfectly secure, so we cannot promise absolute security. Please keep your Google account secure and remove team members who leave.
If there is a data breach
If a personal data breach happens, we will act to contain it, and we will inform the people affected and the Data Protection Board of India in the form and within the time the DPDP Act and Rules require. Where we hold the data as a processor for a firm, we will tell that firm promptly so it can meet its own duties.
Your rights under the DPDP Act
As a data principal (the person the data is about), you have the right to:
- Access information about the personal data we process, how we process it, and who we have shared it with.
- Correction, completion, updating and erasure of your personal data.
- Withdraw consent at any time, as easily as you gave it. Withdrawal does not affect processing already done. If you withdraw consent needed to run your account, we may not be able to keep providing the service.
- Grievance redressal: to have a complaint about how we handle your data dealt with by us.
- Nominate another person to exercise your rights if you die or become unable to do so.
- Complain to the Data Protection Board of India, after first using our grievance process.
The Act also asks data principals not to file false or frivolous complaints and to give accurate information. Each right is explained on our Data rights page.
Children
Legal Staff is a professional tool for advocates and law firms. It is not meant for anyone under 18, and we do not knowingly collect personal data of children without verifiable consent of a parent or lawful guardian. Firms that enter data about a child in a case (for example, a minor party) are responsible, as data fiduciary, for handling it as the law requires. If you think we hold a child’s data by mistake, tell us through the request form.
How to make a request
Use the request form on our Data rights page. We may ask you to confirm your identity before acting on a request. We will respond within the time the DPDP Rules prescribe. If the request is about practice data held by a law firm, we will pass it to that firm and tell you.
Grievance Officer
Grievance Officer, Legal Staff
Reachable through the request form on our Data rights page.
- Operator
- Legal Staff (the operator of legalstaff.in)
Changes to this policy
We will update this policy when our practices or the law change, and change the “Last updated” date at the top. If a change is significant, we will tell signed-in users in the app or by email before it takes effect.
Contact
For anything in this policy, use the form on our Data rights page. See also our Cookie Policy, Terms of Service and Refund Policy.
This policy is provided for information and should be reviewed by your legal adviser.