VakilBoxPrivacy and data processing (DPDP Act, 2023)
VakilBox processes personal data on behalf of law firms. Each law firm is the data fiduciary for its clients. This notice (version 2025-09) explains what we store, where we store it, and how to use your rights.
Where data lives
We store the data of firms registered in India in AWS Mumbai (ap-south-1). A firm's region is set when it registers and cannot be changed. Backups stay in the same region.
Who can see it
Only members of your firm can see it. What each person sees depends on the roles and file-by-file access your firm sets. Our operators cannot read case data. Support gets access only when your firm grants it. That access is for a limited time, and we audit it.
Consent and purpose
Client data is processed for representation, billing and case updates. Consent and the notice version are recorded at intake.
Retention and erasure
Your firm sets how long data is kept for each case type. We produce a certificate when data is erased. A firm can export everything and leave at any time. This works even in read-only mode.
Breach notification
If a breach is confirmed, affected persons and the Data Protection Board are notified within 72 hours of the confirmation.
What the mobile app collects
The Android app collects your name, mobile number and e-mail to sign you in, and the case data you enter: clients, parties, hearings, documents, tasks, fees and expenses. It records an audit trail of who saw and changed what, because a law firm needs one. It also records an identifier for the phone itself, so a lost device can be signed out from your other devices.
Camera and microphone
The app asks for the microphone only when you tap to dictate a hearing outcome, so you can record what happened without typing in court. It never listens in the background. It asks for photos or the camera only when you attach an order sheet or a document to a case. It does not read your location, your contacts or your phone's calendar.
The copy on your phone
So the app works in court without signal, a copy of your firm's case data is kept on the phone itself and synced when you are back online. Your sign-in token is held in the phone's secure keystore. Turn on the app lock so a fingerprint or PIN is needed to open the app — on a phone that holds privileged client material, this matters.
Payments
Subscription payments are taken by Razorpay or Stripe on their own pages. Card numbers never reach VakilBox and are never stored by us or by the app.
No advertising, no selling
We do not sell personal data. We do not share it with advertisers or data brokers, and the app carries no advertising or third-party analytics identifiers.
Children
VakilBox is a professional tool for practising advocates and their staff. It is not directed at children and we do not knowingly collect data from anyone under 18.
Changes to this notice
If this notice changes in a way that affects you, the version number changes and we tell firm administrators in the app before the change takes effect.
Grievance
Write to grievance@vakilbox.com. You will get a reply within 30 days.