Privacy Policy

NyayaDraft (“we”, “us”, “our”) is an AI-powered legal drafting service operating at nyayadraft.in. We help Indian consumers draft formal complaints and legal notices under the Consumer Protection Act, 2019.

For the purposes of the DPDP Act, 2023, NyayaDraft is the Data Fiduciary responsible for the processing of your personal data.

We collect only the information you provide when using our service:

We do not collect aadhaar numbers, PAN, biometric data, financial account numbers, or any other sensitive personal data beyond what is listed above.

1. ✓Draft generation: Your complaint details are sent to OpenAI (GPT-4o-mini) to produce a formal legal draft. OpenAI processes this data under our API agreement and does not use it to train models.
2. ✓PDF delivery: Your details are used to render the final PDF document that you download.
3. ✓Storage: Your draft (including AI response) is stored in our database for up to 90 days so you can re-download.
4. ✓Evidence storage: Uploaded files are stored in private cloud storage for 7 days. Files not linked to a saved draft are deleted within 48 hours.
5. ✓Payment processing: We pass your name and draft reference to Razorpay to create a payment order. Razorpay handles all card/UPI processing.
6. ✓Service improvement: Anonymised, aggregated data (e.g. “65% of complaints are e-commerce related”) may be used to improve the service.

Under Section 4 of the Digital Personal Data Protection Act, 2023, we process your personal data on the following lawful bases:

• Consent: You provide explicit consent via the checkbox on the complaint form before submitting any personal data.
• Contract performance: Processing your data is necessary to deliver the service you have paid for (draft + PDF).
• Legitimate interests: Fraud prevention, rate-limiting, and service security.

You may withdraw your consent at any time by emailing support@nyayadraft.in. Withdrawal does not affect processing already completed.

We do not sell your personal data. We share it only with:

All third parties are bound by data processing agreements. OpenAI’s API terms prohibit using API inputs to train their models. Evidence files are stored in a private bucket — not publicly accessible.

• Draft records (Supabase DB): Retained for 90 days from creation date, then permanently deleted.
• Evidence files (Supabase Storage): Deleted 48 hours after upload if not linked to a paid draft. For paid drafts, deleted at 90 days.
• Payment records: Razorpay retains payment records per RBI regulations (typically 5 years). We store only order IDs and payment IDs — never card data.
• Browser storage (localStorage): Your complaint form data is stored in your browser’s localStorage until you click “Start a new complaint” or clear your browser data.

As a Data Principal under the DPDP Act, you have the following rights:

• Right to Information (Section 11): Know what personal data we hold about you.
• Right to Correction (Section 12): Correct inaccurate or incomplete personal data.
• Right to Erasure (Section 12): Request deletion of your data (subject to legal retention obligations).
• Right to Grievance Redressal (Section 13): Raise complaints about data processing.
• Right to Nominate (Section 14): Nominate a person to exercise your rights in case of incapacity or death.

To exercise any right, email our Grievance Officer at support@nyayadraft.in with “Data Rights Request” in the subject line. We will respond within 30 days.

If your complaint is not resolved, you may escalate to the Data Protection Board of India once it is constituted under the DPDP Act.

NyayaDraft does not use tracking cookies, analytics cookies, or advertising cookies.

We use localStorage (not cookies) to temporarily save your complaint form progress so you don’t lose your work if you navigate away. This data never leaves your device unless you submit the form.

• All data transmitted to our servers is encrypted via TLS 1.2+.
• Database access uses Row Level Security (RLS) — no anon role can read your data.
• Evidence files are stored in a private Supabase Storage bucket with time-limited signed URLs (7 days).
• API routes are protected by CSRF origin checks, rate limiting, and HMAC signature verification for payments.
• We use the Supabase service role key only on the server — never exposed to the browser.

NyayaDraft is not directed at children under the age of 18. We do not knowingly collect personal data from children. If you believe a child has submitted data, please contact us immediately and we will delete it.

We may update this policy from time to time. When we do, we will update the “Last updated” date at the top of this page. Continued use of the service after changes constitutes acceptance of the updated policy.

As required under the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021 and the DPDP Act, 2023, our Grievance Officer can be contacted at: