Privacy notice

• For your account, billing, security records and our own records, NESTCLIP PRIVATE LIMITED decides why and how the data is used and is responsible for it.
• For the material a workspace puts into Vakilat, such as questions, documents and matters, the workspace decides why it is used. We process it only on the workspace's instructions, to provide the service. Questions about that material go first to the workspace.
• The court judgments we search are published by the Supreme Court of India and are kept apart from your data.

• Your name, email address and sign-in records, to create your account and secure it.
• Your workspace, role and memberships, to control who sees what.
• Your questions, the answers, your documents, matters and saved items, to provide the research you ask for.
• Your plan, billing details (name, address, state and any GSTIN), invoices and payment status, to bill you and issue GST invoices. Card, UPI and bank details stay with Razorpay.
• Security and usage logs, to protect the service and meet the law.

The app uses cookies only to sign you in and keep you signed in, and your browser's local storage only for your theme and to sign out every tab together. We do not use your questions or material to train AI models, we do not sell data, and we do not show advertising.

• Cloudflare hosts the app and this website, stores your workspace's data and documents, sends invoice emails, and routes AI requests through its AI Gateway, which does not keep their content.
• Google runs the Gemini AI models that plan, research, write and check answers. It receives the text each request needs, such as your question, passages of judgments and the text of documents you attach to a question, under its paid-service terms, which do not let it use that text to train its models.
• WorkOS runs sign-in, including Sign in with Google, and receives account details only.
• Razorpay takes payments and receives billing details only.
• GitHub, and Blacksmith, which runs our GitHub tools, handle a privacy request: the address you wrote from and, if you asked for a copy of your data, that copy, which our staff download to send to you and GitHub deletes after one day.
• Discord carries our internal alerts, which hold only internal reference numbers, never names, addresses or content.

We will update this notice before another provider receives your data. These providers operate worldwide, so your data may be processed outside India.

When you attach documents to a question, Vakilat sends the text of each one, with its file name and page numbers, to the AI models that plan and write the answer, for that research run only. A follow-up question in the same chat reads them again. The steps that search for and check authorities never see them. It reads up to five documents, at most 20,000 characters of each and 40,000 in total, and the answer names any pages it left out. It reads a document only if you can open it when the question runs, and skips one that was deleted, flagged by the virus check or is still being checked. The models are told to treat the text as facts from your file, never as law or as instructions.

The answer may state facts from your documents and cites the file and page it relies on. It is saved in the chat like any answer, and the chat's activity shows which files were read and how many pages. The research run keeps no copy of the documents' text. Documents you upload are never added to the judgments Vakilat searches, and we do not use them to train AI models.

A document you upload in a private chat is yours: only you can see it. A document you attach in a matter, in one of its chats or on its Documents tab, can be opened, searched, downloaded and used in that matter's chats by everyone working on that matter in your workspace, so attach there only what the matter's team may see. The matter's lead, the person who added it or the person who uploaded it can remove it from the matter; only the person who uploaded a document can delete it.

You can connect Vakilat's research tools to an AI assistant you use, such as ChatGPT, Claude or Microsoft Copilot. Your conversation stays with that assistant, under your own account with its provider and that provider's terms and privacy policy; we do not receive it. When the assistant uses a Vakilat tool, we receive only this:

• Your Vakilat sign-in. WorkOS signs you in and gives the assistant a short-lived access token for your account. We read only which Vakilat account it is, to check your plan and its limits.
• What the tool needs, such as a search query, a citation, a case number, a quotation or a code section, to answer that call. A search query also goes to Google's Gemini embedding model, through Cloudflare's AI Gateway, to find judgments that match its meaning, under the paid-service terms described above. We do not store what the tools were asked.
• A record of each call, with the tool, your account, the result and the time, and a daily count of your calls, to apply the daily and per-minute limits of your plan, to keep the service secure and to show you today's use on the Connect page in the Vakilat app.

The tools only read the Supreme Court judgments and code tables we hold. They never open your matters, documents or Library, so none of your workspace's material reaches the assistant through Vakilat. We keep the daily counts for one year and the records of each call for up to one year, and then delete them. You can disconnect Vakilat at any time in the assistant's settings. To end our side of the connection, or to use any right in “Your rights”, write to privacy@vakilat.io.

• Your work and saved material: until you or your workspace asks us to delete it.
• After a deletion request, live copies are removed within 30 days; backup copies expire on their own schedule.
• Security records: for the period Indian law requires.
• Invoices and billing records: as long as tax law requires, up to eight years.
• A legal hold or other legal duty can require us to keep data longer.

Each workspace's data is kept in its own separate store, stored encrypted by our hosting provider, and access is checked on every request. Our staff do not open your private work. If a security incident affects your data, we will tell you and the authorities as the law requires.

Vakilat is not for anyone under 18, and we do not knowingly collect a child's personal data. If we learn that we have, we delete it.

Requests to this website pass through Cloudflare, which processes technical data such as IP addresses to deliver pages and block abuse. We measure how the site is used so we can tell which pages help advocates. We run no advertising trackers.

Cloudflare Web Analytics runs for every visitor. It counts page views and records the page, the site that sent you, your country, your browser, operating system and device type, and loading times. It sets no cookies and stores nothing on your device, and Cloudflare says it does not collect or use visitors' personal data.

Google Analytics runs for every visitor unless you turn it off. It sets two cookies, _ga and _ga_YYQS8GBT3L, which hold a random ID for up to two years after your last visit so that repeat visits can be counted. Google receives the pages you view, the site that sent you, your approximate location worked out from your IP address, your browser and device details and, if you choose Start free, a record that you did. We have turned off Google's advertising features for this site, and Google keeps the detailed records for at most 14 months.

On your first visit a notice says so; choose OK to close it. To stop Google Analytics, choose Turn off Google Analytics at the foot of any page: it stops and its cookies are removed. We remember that choice for a year, in your browser's local storage and in a cookie named analytics-consent, and you can turn it back on the same way.

Until 12 October 2026 this website collected requests for early access: your name and email address, your phone number if you gave it, your Bar Council state, practice area and firm size, and when you agreed to the notice then in force. Each request was delivered to our team's private Discord channel, which is where we keep the list. We do not store it anywhere else.

We use these details only to tell you about access to Vakilat, on WhatsApp too if you gave a phone number. We keep them until you ask us to delete them, and in any case no later than 20 October 2027 if you have not become a user. Deleting them removes your request from our Discord channel.

You can ask to see, correct or delete your personal data, to have a copy of your work, to withdraw consent where we rely on it, to nominate someone to act for you, and to raise a grievance. We check who is asking before we act. For material a workspace controls, we pass your request to the workspace and help it respond.

Write to the Grievance Officer, NESTCLIP PRIVATE LIMITED, at privacy@vakilat.io. We acknowledge every complaint within 48 hours and resolve it within one month.

If we do not resolve your grievance, you can complain to the Data Protection Board of India.

We will tell you about a material change before it applies and update the date above. This notice is in English; versions in Indian languages are being prepared.