Privacy Policy

When you create an account, we collect:

• Full name and email address
• Profile details you choose to provide (phone number, bar registration number, specialisations)
• Authentication method (Google OAuth or Email OTP)
• Account creation date and last login

• Workspace name, type (individual / firm), city, state
• Bar council registration number and GST number (optional)
• Firm contact email and phone number
• Team member roles and permissions

This is the core data you create and manage within ArgDay:

• Case titles, numbers, parties, court names, and stages
• Hearing dates, case notes, tasks, and events
• Case documents you upload (petitions, orders, affidavits, contracts, etc.)
• Document metadata (filename, type, size, upload date)
• AI-generated summaries and Q&A responses linked to your documents

This data is entirely yours. We do not read, analyse, or share it except to deliver the Service to you.

• IP address, browser type, operating system, and device information
• Pages visited, features used, and session duration
• Error logs and crash reports for service improvement
• API request logs (anonymised after 30 days)

We do not store payment card details. Billing is handled by third-party payment processors. We store only plan type, subscription status, and billing cycle information.

Most fields in ArgDay are optional. You can use the Service without providing your phone number, bar registration number, GST number, or firm details. Providing more information improves the experience but is not mandatory.

When you request an AI summary or use the Q&A feature, the content of the selected document is sent to a large language model (LLM) API. This processing is:

• Always server-side - your documents are never processed in the browser or sent to any AI service directly from your device
• Per-request - documents are sent only when you explicitly trigger a summarisation or Q&A
• Not stored by the AI provider beyond the API call lifecycle (see sub-processor policy below)

We currently use OpenAI API for AI features. OpenAI's API, when used via API key (not ChatGPT), does not use submitted data to train models by default. We have opted out of any data training arrangements. For OpenAI's data handling policy, see openai.com/policies/api-data-usage-policies.

AI features are entirely opt-in. You choose which documents to summarise. If you do not use AI features, no document content is sent to any AI provider.

Your data is stored in cloud infrastructure. We use Supabase, which stores data in secure data centres. We endeavour to select data centre regions closest to India where available.

• AES-256 encryption for documents stored in object storage
• TLS 1.2+ encryption for all data in transit
• Row-Level Security (RLS) enforced at the database layer - workspace data is strictly isolated
• Signed time-limited URLs for document access (URLs expire in 60 seconds)
• No public file storage buckets - all documents are private
• Multi-factor authentication support for accounts
• Regular automated security audits and dependency updates
• Principle of least privilege applied to all internal service accounts

In the event of a data breach that is likely to result in risk to your rights or freedoms, we will notify affected users within 72 hours of becoming aware of the breach, as required under applicable law. We will also notify the relevant regulatory authority where required.

You may request a copy of all personal data we hold about you by contacting privacy@argday.com. We will respond within 30 days.

You can update most of your profile information directly in Settings. For other corrections, contact us.

You may request deletion of your account and all associated data. Exceptions apply where retention is required by law (e.g., billing records). We will confirm deletion within 30 days.

You may export your case data and documents from within the platform. For a full data export, contact support@argday.com.

Where processing is based on consent (such as AI features), you may withdraw consent at any time by not using those features. Withdrawal does not affect prior processing.

Under the DPDPA 2023, you have the right to raise a complaint with our Data Protection Officer. If not resolved, you may approach the Data Protection Board of India.

You are solely responsible for:

• The security and confidentiality of your account credentials (email, OTP codes, Google OAuth session)
• Ensuring you log out from shared or public devices
• Keeping your registered email account secure - a compromised email account can compromise your ArgDay account
• Controlling who within your organisation has access to your ArgDay workspace
• Promptly revoking access for team members who leave or should no longer have access
• Ensuring devices used to access ArgDay are protected with appropriate security measures

While we implement industry-standard security measures, no system is completely immune to attack. ArgDay is not liable for:

• Unauthorised access to your account resulting from your compromised credentials, phishing attacks on you, or your failure to maintain account security
• Data breaches or loss resulting from malware, keyloggers, or security failures on your own devices or network
• Unauthorised access granted by you or team members to unauthorised parties
• Loss or exposure of data resulting from your sharing of login credentials
• Security vulnerabilities in third-party devices, browsers, or networks you use to access ArgDay
• Cyberattacks, hacking, or data breaches caused by nation-state actors, sophisticated threat actors, or events beyond our reasonable control
• Any loss, damage, or liability arising from a security incident at our sub-processors (Supabase, OpenAI, Resend), subject to those providers' own terms

We do not warrant that the Service is completely secure or that unauthorised third parties will never be able to defeat our security measures. Transmission of data over the internet inherently carries risk. You accept this risk by using the Service.

In the event of a breach affecting your data, our obligations are limited to notification as described in Section 6.3 and reasonable cooperation in your response efforts.