Privacy Policy

1. Who we are

KanunSetu (operated by Kaasho Pvt Ltd) runs an online legal advisory marketplace at kanunsetu.com that connects clients with Bar-Council-verified advocates across India. This Privacy Policy describes how we handle personal information collected through the platform. It is published in accordance with the Information Technology Act, 2000, the Information Technology (Reasonable security practices and procedures and sensitive personal data or information) Rules, 2011, and the Digital Personal Data Protection Act, 2023 (DPDP Act).

By creating an account or otherwise using KanunSetu, you consent to the practices described here. If you don't agree, please do not use the platform.

2. What information we collect

We collect information in three ways:

• Information you give us: name, email, phone, city, gender, profile picture, password (stored as a bcrypt hash, never in plaintext), and — for advocates — bar registration number, practice areas, hourly rate, KYC documents, and bank account details for payouts.
• Information generated by your use of the platform: bookings you make, consultations you participate in, chat messages and files you share during a consultation, reviews you write, and notifications sent to you.
• Information collected automatically: IP address, device and browser metadata, approximate location derived from IP, and pages visited. Used for security, fraud detection, and improving the service.

3. How we use it

• To run the booking and consultation flow — matching you with advocates, scheduling, and powering the chat / audio / video sessions.
• To process payments via Razorpay and remit payouts to advocates.
• To send transactional notifications (booking confirmations, reminders, refunds) by email, SMS, in-app notification, or push.
• To verify advocate identity and Bar Council enrolment before publishing their profile.
• To investigate fraud, abuse, or violations of our Terms of Service.
• To comply with legal, regulatory, and tax obligations in India.

We do not sell your personal information. We do not use your consultation chats or shared documents for advertising, analytics training, or any purpose other than providing the consultation itself.

4. How we share information

We share your information only in these specific cases:

• With the advocate you book: your name, email, city, and anything you share during the consultation are visible to that advocate. Each advocate is bound by the rules of professional conduct of their State Bar Council, including duties of confidentiality.
• With service providers we rely on to operate the platform — Razorpay (payments), Firebase (authentication and OTP), AWS (hosting and document storage), an email/SMS/push delivery provider when notifications are enabled. These providers process data only on our instructions and under contract.
• When required by law — in response to a valid legal demand, court order, or law-enforcement request, or to protect our rights, the safety of users, or to investigate fraud.
• In the event of a corporate transaction (merger, acquisition, sale of assets), in which case the acquirer will be bound by the protections of this policy.

5. Documents and consultation chat

Files you upload during a consultation (PDFs, images, contracts, KYC documents) are stored encrypted at rest using AES-256 and are accessible only to you and the advocate on the specific booking. Each file is also scanned at upload to block malicious content.

unsend

6. Payments

All payments are processed by Razorpay. We never see, handle, or store your full card number, CVV, UPI PIN, or net-banking credentials. Razorpay is PCI-DSS compliant and handles card data under their own privacy terms. We retain only the transaction reference, amount, status, and a gateway-provided payment ID — needed for accounting, refunds, and dispute resolution.

7. Cookies and similar technologies

We use a small number of cookies and similar local-storage mechanisms:

• Strictly necessary — to keep you logged in across pages, hold your booking reservation during checkout, and maintain CSRF protections.
• Functional — to remember preferences such as your last-viewed advocate or filter selection.
• Analytics — basic usage analytics so we can understand how the site is used and find bugs. We do not currently run third-party advertising trackers.

You can clear cookies via your browser settings. Note that disabling strictly necessary cookies will prevent you from logging in.

8. Data retention

• Account profile, bookings, payments, and consultation messages are retained for as long as your account is active.
• If you request account deletion, we remove personal identifiers (name, email, phone, profile picture) within 30 days. We retain transactional records (booking IDs, payment IDs, GST records, payouts) for the period required by Indian tax and accounting law — currently 8 years.
• Anonymised, aggregated data (e.g., total bookings per month) may be retained indefinitely for analytics and reporting.

9. Your rights

Subject to applicable law, you have the right to:

• Access the personal information we hold about you.
• Correct inaccurate information — most fields can be edited directly from your Profile and Settings pages.
• Request deletion of your account and personal data (see retention above).
• Withdraw consent for marketing communications at any time.
• File a complaint with us first via support@kanunsetu.com, and if unresolved, with the Data Protection Board of India once it is constituted under the DPDP Act.

10. Children

KanunSetu is not directed at users under 18 years of age. We do not knowingly collect personal information from minors. If you believe a minor has created an account, please contact us and we will delete it.

11. Security

We use industry-standard measures to protect your data — TLS encryption in transit, AES-256 encryption at rest for documents, bcrypt-hashed passwords, OTP-gated phone changes, role-based access controls for the admin team, and regular security reviews. No system is perfectly secure; if you suspect a security issue with your account, write to support@kanunsetu.com immediately.

12. International transfers

Our infrastructure runs in AWS Mumbai (ap-south-1). Some of our service providers (e.g., Firebase, Razorpay) may process limited data outside India. Where this happens, we rely on the legal basis available under the DPDP Act and contractual commitments to ensure your data is protected.

13. Changes to this policy

We may update this Privacy Policy from time to time. Material changes will be announced by email or in-app notice at least 14 days before they take effect. The "Last updated" date at the top of this page always reflects the current version.

14. Contact us

For privacy questions, requests, or complaints, write toamailto:support@kanunsetu.comsupport@kanunsetu.com. You can also reach our Grievance Officer at the same address — we'll route your message internally.

Questions? Write to support@kanunsetu.com.