1.Who this covers
eAdvocate Diary is operated by eAdvocate Diary (“we”, “us”). This policy explains what we do with information handled through our website, web application and related services (together, the Platform).
It applies to advocates and legal professionals who hold an account with us, to junior and team members invited onto an account, and to visitors to our website. It is written against the Digital Personal Data Protection Act, 2023 and the Information Technology Act, 2000 and rules made under it.
2.The two kinds of data on this Platform
This is the most important section of this policy, and everything below depends on it. Data on the Platform falls into two categories with genuinely different legal treatment.
Account Data — we are the Data Fiduciary
Information about you as our customer: your name, mobile number, email address, enrolment details, password, subscription and payment records, and how you use the Platform. We decide the purposes for which this is processed, so we are the Data Fiduciary and you may exercise your statutory rights against us directly.
Practice Data — you are the Data Fiduciary, we are a Data Processor
Everything you enter about your matters: case numbers, CNR and FIR numbers, party names and contact details, court and clerk details, hearing dates and outcomes, notes, client records, and uploaded documents. Much of this is personal data belonging to other people — your clients and opposing parties — and some of it is privileged.
For Practice Data, you are the Data Fiduciary and we act only as your Data Processor. We process it on your instructions, to run the Platform for you. We do not decide what you collect, and we do not use it for our own purposes.
What this means in practice
If a client of yours asks to see, correct or erase their data, that request is yours to answer, not ours — you hold the relationship and the professional obligation. We will support you in giving effect to it. Equally, it is you who must have a lawful basis for putting their data here in the first place.
3.What we collect
You give us
- Account details — first and last name, mobile number (verified by OTP), email address, password (stored only as a salted hash, never in readable form), profile photograph if you upload one.
- Professional details — Bar Council enrolment number, practice area, courts you appear before, firm or chamber name, where you choose to provide them.
- Practice Data — as described above, including any document you upload to the document vault.
- Support correspondence — messages you send us and our replies.
We collect automatically
- Technical and log data — IP address, browser and device type, timestamps, pages and API endpoints accessed, and errors encountered. We keep these to keep the service secure and working.
- Activity records — a log of actions taken inside your account (a case created, a hearing status changed, a document shared), so that you and your team can see who did what.
We receive from others
- Payment confirmations from our payment gateway. We receive the outcome, amount and a transaction reference. We never receive or store your full card number, CVV or UPI PIN.
- Message delivery receipts from WhatsApp, telling us whether a reminder or shared file reached its recipient.
4.How we use it, and what we will never do
We process data to:
- create and operate your account, including OTP verification and login;
- store and display your cases, hearings, clients, notes and documents;
- send the reminders and alerts you have configured, including WhatsApp messages and hearing notifications;
- generate the case lists and reports you export as PDF or Excel;
- take payment, manage your subscription and issue invoices;
- provide support when you ask for it;
- detect and investigate abuse, fraud and security incidents, and keep backups; and
- comply with law and respond to valid legal process.
Commitments we make about your Practice Data
- We do not sell it. Not to anyone, in any form, including de-identified or aggregated form.
- We do not use it to train artificial intelligence models, ours or anybody else’s.
- We do not use it for advertising or share it with advertising networks or data brokers.
- We do not read your case content. Our staff access it only where you specifically ask us to in support, or where it is strictly necessary to fix a fault or meet a legal obligation. Such access is restricted to authorised personnel and is logged.
5.Professional privilege and confidentiality
Communications between an advocate and a client are protected under Section 132 of the Bharatiya Sakshya Adhiniyam, 2023 (previously Section 126 of the Indian Evidence Act, 1872). Storing privileged material with a service provider does not remove that protection, and we treat all Practice Data as confidential regardless of whether privilege attaches to any particular item.
We do not disclose Practice Data to any third party except: to the sub-processors listed below, strictly to operate the Platform; where you direct us to (for example when you generate a share link or send a file on WhatsApp); or where we are compelled by a valid order under Indian law.
If we receive a legal demand for data in your account, we will notify you before responding wherever we are lawfully able to, so that you can take steps to protect the material — including asserting privilege on your client’s behalf.
6.Sub-processors and third-party services
We use a small number of established providers to run the Platform. Each is bound by contract to process data only on our instructions and to maintain appropriate security.
- Cloud hosting and database — hosting of the application and the database in which your cases, hearings and records are stored.
- Document storage — files you upload to the document vault are held with a specialist media storage provider. Documents are served through our own application, and share links are opaque, time-limited tokens that do not expose the underlying storage location.
- WhatsApp Business Platform (Meta) — used to deliver reminders and files you choose to send. The message content and recipient number are shared with Meta for delivery, and Meta’s own terms apply to that transmission.
- Payment gateway — collects and processes your payment instrument directly. Your card and UPI credentials go to them, not to us.
- Email and SMS delivery — for OTPs, account notices and transactional mail.
We will update this list as our providers change. Where a change materially affects how your data is handled, we will tell you in advance.
7.Where data is stored, and transfers outside India
We aim to store Practice Data on infrastructure located in India. Some of the providers above operate globally, so certain data — particularly message delivery through WhatsApp and some technical and log data — may be processed outside India.
Where that happens, it is on the basis permitted by Section 16 of the Digital Personal Data Protection Act, 2023, and under contractual protections requiring a standard of security no lower than that described in this policy.
8.How long we keep it
- While your account is active — we keep Practice Data for as long as you keep it. Disposing of a case in the Platform is a reversible archive, not a deletion; the record remains until you delete it or close your account.
- After you cancel — your data remains available for export for 30 days. After that we begin deletion.
- Backups — residual copies may persist in encrypted backups for up to 90 days after deletion, after which they are overwritten.
- Records we must keep — invoices, tax records and transaction data are retained for the period required by Indian tax and company law, currently eight years.
- Security logs — retained up to 180 days, consistent with CERT-In directions.
9.How we protect it
- All traffic between your browser and the Platform is encrypted in transit (TLS).
- Passwords are stored only as salted one-way hashes and cannot be recovered by us.
- Session tokens are held in HTTP-only cookies, which scripts running in the browser cannot read.
- Export and share links are encrypted, opaque tokens with a fixed expiry. They do not reveal our storage provider or any internal address, and they stop working when they expire.
- Access to production systems is restricted, authenticated and logged.
- Data is backed up regularly, and backups are encrypted at rest.
No system is perfectly secure, and we do not claim otherwise. If a breach occurs that is likely to affect you, we will notify you and the Data Protection Board of India as required by law. You must tell us promptly at eadvocatediary@gmail.com if you believe your account has been compromised.
Anyone with a share link can open it
When you generate a link to a case list or document, that link works for whoever holds it until it expires. Treat it as you would a physical copy of the file, and send it only to the intended recipient.
10.Your rights
In respect of your Account Data, the Digital Personal Data Protection Act, 2023 gives you the right to:
- obtain a summary of the personal data we hold about you and how it is processed;
- have inaccurate or incomplete data corrected, updated or completed;
- have your data erased, where it is no longer needed for the purpose it was collected for and we are not required by law to keep it;
- nominate another person to exercise these rights on your behalf in the event of death or incapacity; and
- have your grievances redressed, through the officer named below.
Most of this you can do yourself from within the Platform. For anything else, write to eadvocatediary@gmail.com. We will respond within 30 days. If you are not satisfied with our response, you may complain to the Data Protection Board of India.
If you are a client of an advocate who uses this Platform and want to exercise rights over your data, please contact that advocate. They control the record; we hold it for them, and we are not permitted to alter or release it on our own initiative. If you write to us, we will refer you to them.
12.Children
The Platform is intended for practising legal professionals and is not directed at children. We do not knowingly create accounts for anyone under 18. If you believe a child has registered, tell us and we will remove the account.
13.Changes to this policy
We may update this policy as the Platform or the law changes. The date at the top always reflects the current version. Where a change materially affects your rights or how we use your data, we will give you notice in the Platform or by email before it takes effect.
14.Contact and Grievance Officer
For any question about this policy or about your data, write to eadvocatediary@gmail.com.
In accordance with the Digital Personal Data Protection Act, 2023 and the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021, our Grievance Officer is:
- Email: eadvocatediary@gmail.com
- Phone: +91 8004925994
- eAdvocate Diary, 13-A Ganga Nagar New PAC Line Shyam Nagar, Kanpur Nagar - 208015, Uttar Pradesh
Grievances are acknowledged within 24 hours and resolved within 15 days of receipt.