Privacy Policy

Advocate Diary is a practice management application for advocates, chambers and law firms in India. It is a software service only. Advocate Diary is not a law firm, does not act as an advocate or legal advisor for any person, and does not provide legal advice or legal opinions. Nothing in the service or in this policy creates an advocate-client relationship.

This policy explains what information the application collects, how it is used, and the controls that apply to it. It describes only practices that are actually implemented in the application as it operates today.

Where a firm uses Advocate Diary to record information about its own clients and matters, the firm decides what information to enter and remains responsible for it, including for its professional and confidentiality obligations towards its clients. Advocate Diary processes that information in order to provide the service to the firm.

We collect the following when you register and use an account:

• Registration details: your name, email address, mobile number, the account type you choose (individual advocate or law firm), and the firm name where you provide one.
• Profile details you maintain in Settings, such as your name and mobile number.
• Organisation details for your practice, including the practice or firm name and the practice details you choose to save in Settings.
• Team information where a firm administrator adds advocates, staff or client portal users, including the name, email address and role assigned to each member.
• Sign-in information, including the time of your last successful sign-in, and records of sign-in sessions so you can stay signed in.
• If you sign in with Google, the name, email address and profile picture returned by that sign-in.

The application does not use cookies or similar technologies for advertising, and it does not include advertising trackers.

The substance of what Advocate Diary holds is the information you enter. This typically includes:

• Client records, including the names and contact details you choose to store for your clients.
• Case and matter records, including case numbers, courts, parties, case type and status, and the notes you add.
• Hearing records, including dates, courts, benches, court rooms, outcomes and adjournments.
• Tasks, reminders and diary entries.
• Court details you add for your own use.
• A timeline of activity on your matters, and updates you choose to publish to a client.

This information is entered at your discretion. You decide what is recorded about a matter or a client, and you can edit or remove records from within the application.

You can upload documents and attach them to your matters. Uploaded files are stored using Cloudflare R2 object storage, which the application uses as its document store.

• Documents are not served from public links. Each download is authorised against your signed-in account before access is given.
• Access to a document is limited to users of the organisation the document belongs to.
• Alongside the file, the application stores information needed to manage it, such as the file name, its storage location, the matter it is attached to and who uploaded it.
• When you delete a document in the application, it is marked as deleted and is no longer available through the application.

A firm can invite its client to a read-only client portal. When a firm sends an invitation, the application sends an email to the address the firm provides and stores an invitation record so the invitation can be accepted and can expire.

• The client portal is read-only. A client signing in can see only their own matter and the updates the firm chooses to publish.
• A client cannot see the firm's internal notes, other clients, other matters or firm-wide data.
• The firm controls whether to invite a client and what to publish to the portal.

The application creates in-app notifications about your own matters, such as upcoming hearings and tasks, and stores the notification preferences you set so it can respect your choices.

Transactional emails are sent where they are needed to operate the service — for example password reset emails, client portal invitations and payment receipts. These emails are sent through the email delivery service the application is configured to use. Advocate Diary does not send marketing or promotional email through the application.

Subscriptions are processed through Razorpay, a payment gateway. When you subscribe, you are taken to Razorpay's checkout to complete the payment.

• Advocate Diary does not store your card number, CVV, UPI PIN, net banking credentials or any other payment instrument credentials. These are entered into and handled by Razorpay, not by Advocate Diary.
• The application stores subscription information needed to run your account, such as the plan you are on, the status of the subscription, trial and renewal information, and whether it has been cancelled.
• The application stores payment records returned by the gateway, such as the payment status, amount and the date a payment was made, together with the gateway's own reference identifiers, so that your plan and receipts are correct.
• Razorpay's handling of your payment details is governed by Razorpay's own terms and privacy policy.

Passwords are not stored in a readable form. When you set a password it is converted into a one-way hash using bcrypt, and only that hash is stored. Nobody operating the service can read your password back, which is also why a forgotten password must be reset rather than retrieved.

• Passwords must be at least eight characters.
• Password reset links are stored only as hashes, are single use and expire.
• Repeated failed sign-in attempts are rate limited to make guessing attacks harder.
• Signing out invalidates the session token so it cannot be reused.

We use the information described above to:

• Provide the service — maintain your account, your firm's records, your diary, documents and reports.
• Authenticate you, keep you signed in, and apply the role permitted to your account.
• Send transactional messages needed to operate the service, such as password resets, client portal invitations and payment receipts.
• Manage subscriptions, plan limits, trials and billing status.
• Keep the service secure — including rate limiting sign-in attempts and authorising each document download.
• Operate the service overall, including understanding aggregate usage such as the number of accounts and subscriptions, so the service can be maintained and supported.

We do not sell your information, and we do not use the contents of your matters, clients or documents for advertising.

Advocate Diary is built so that each organisation's records are scoped to that organisation. Every record you create belongs to your organisation, and requests are answered only from within it, so one firm's data is not visible to another firm's users.

• Within a firm, what a member can do depends on the role assigned to them — for example only a firm administrator can manage the team.
• Client portal users are limited to their own matter and cannot reach firm data.
• Platform administration, used to operate the service itself, is separate from firm accounts. A platform administrator account does not belong to any organisation and is blocked from firm and organisation records; equally, firm users cannot reach platform administration.

The application uses the following third-party services, and only for the purposes described:

• Razorpay — to process subscription payments and to confirm payment events.
• Cloudflare R2 — to store the documents you upload.
• An email delivery service — to send transactional email such as password resets, client portal invitations and payment receipts.
• Google sign-in — used only where you choose to sign in with Google, to confirm your identity for sign-in.
• Cloud hosting and a managed database — used to run the application and store your records.

These services receive only what they need to perform that function. Advocate Diary does not use advertising networks or analytics trackers in the application.

You are responsible for the security of your own account. In particular:

• Keep your password confidential and do not share your sign-in credentials.
• Use a password that you do not reuse on other services, and change it if you believe it has been exposed.
• Sign out on devices that are not yours, including shared or court-room devices.
• Add team members only where they should have access to your firm's records, give each the correct role, and remove access when a member leaves.
• Invite a client to the portal only at the email address you have verified with that client.
• Tell us promptly if you believe an account has been accessed without authorisation.

You can edit or delete records from within the application at any time. Deleting a record removes it from the application for your users.

You can cancel a paid subscription from Settings. Cancelling a subscription changes your billing and plan; it is not by itself a request to delete your account.

If you want your account and your firm's data removed, you can ask us using the contact details in the next section. We will act on that request. We do not state a fixed retention or deletion period here, because no specific retention period has been established for the service — so rather than promise a period we do not operate to, we will confirm to you what has been done when we handle your request. Where information must be kept in order to meet a legal or accounting obligation, such as records of payments already made, it will be retained for that purpose only.

For any question about this policy, or to make a request about your information — including access to it, correction of it, or deletion of your account — contact us at:

supravat111@gmail.com

Please write from the email address registered on your account, so that we can be reasonably satisfied the request comes from you before acting on it. We may ask you for further information to confirm your identity where a request concerns account data.

If you are a client of a firm that uses Advocate Diary and your request concerns the information that firm holds about your matter, please contact the firm directly. The firm decides what is recorded about its clients and matters.

No telephone number or postal address is published for privacy requests, and none should be assumed. Email is the contact route for the service.

We may update this policy as the application changes. The effective date at the top of this page shows when the current version took effect. Where a change materially affects how information is handled, we will make the updated policy available on this page before continuing to operate under it. Continuing to use the service after an update means the updated policy applies to your use of it.

This policy and the handling of information described in it are governed by the laws of India, including the Digital Personal Data Protection Act, 2023 and the Information Technology Act, 2000, as applicable. No particular court or place of jurisdiction is specified in this policy.