Privacy Policy

Last updated: September 24, 2026
Version: 1.1

MeraBakil ("we", "us", "our") operates the MeraBakil platform at merabakil.in. This Privacy Policy explains how we collect, use, store, and protect your personal data in accordance with the Digital Personal Data Protection Act, 2023 (DPDP Act) and applicable Indian laws.

Beta notice: MeraBakil is in open beta. Features, data practices, and this policy may change as we improve the service.

1. Data we collect

We may collect the following categories of personal data:

• Account data: name, email address, password (hashed), role (citizen or advocate), profile details.
• Authentication data: Google OAuth identifiers when you sign in with Google.
• Usage & measurement data: pages visited, feature interactions, and analytics via Google Analytics 4, plus advertising-measurement signals via Google Ads (including a Google click identifier, gclid, when you arrive from an ad) used to measure and improve our campaigns. You can opt out of analytics and advertising cookies at any time via the consent banner ("Necessary only").
• Session recordings & heatmaps: with your consent, Microsoft Clarity records anonymised replays of how pages are used — mouse movement, clicks and scrolling. Sensitive areas are masked before anything leaves your browser: your Saarthi conversations, uploaded documents, case details, wallet figures, one-time codes and personal details are never captured.
• Saarthi (AI chat) data: your questions, conversation history, attachments, and AI-generated responses.
• Document data: files you upload for document Q&A or case management.
• Voice data: audio input when you use voice features (processed to generate text/responses).
• Marketplace data: appointment bookings, consultation messages, and related metadata.
• Technical data: IP address (hashed for consent records), browser type, device information, and correlation IDs in server logs.

2. How we use your data

We process your data for:

• Creating and managing your account (contract performance).
• Providing AI legal guidance, research, document analysis, and marketplace features.
• Connecting citizens with independent advocates (marketplace).
• Billing and wallet transactions where applicable.
• Security, fraud prevention, and rate limiting.
• Improving the platform during beta (with consent, via privacy-friendly analytics).
• Complying with legal obligations.

Lawful basis: consent (analytics, optional features) and performance of our service agreement.

3. AI processing & third parties

We use third-party services to operate MeraBakil:

AI outputs are generated automatically and may be inaccurate. They are not legal advice. See our Terms of Service.

Some providers may process data outside India. We take reasonable steps to ensure appropriate safeguards for cross-border transfers.

4. Cookies & local storage

We use browser local storage for:

• Essential: authentication tokens, user session, theme preference.
• Consent preference: your cookie/analytics choice.

We also use cookies for optional analytics and advertising measurement:

• Google sets analytics and advertising cookies (for example Google Analytics _ga and the Google Ads click cookie _gcl_aw). Because MeraBakil operates under India's DPDP Act, these are enabled by default; choosing "Necessary only" switches Google Consent Mode to deny analytics and advertising storage.
• Microsoft Clarity sets first-party cookies (_clck, _clsk) to recognise a returning visit, but only after you choose "Accept all". Until you choose, and if you choose "Necessary only", Clarity runs without cookies and cannot link your visits together. If you later decline, we instruct Clarity to erase these cookies.

You can change your choice at any time via Cookie settings in the site footer, and clear local storage and cookies via your browser settings, which will sign you out.

5. Data retention

• Account and conversation data are retained while your account is active.
• You may request deletion of your account and associated data (subject to legal retention requirements).
• Server logs are retained for a limited period for security and debugging.
• Consent records are retained for compliance audit purposes.

6. Your rights (DPDP Act)

You have the right to:

• Access your personal data.
• Correct inaccurate data via your profile settings.
• Withdraw consent for non-essential processing (e.g., analytics).
• Request erasure of your data, subject to legal exceptions.
• Nominate another person to exercise your rights in the event of death or incapacity.
• Lodge a complaint with the Data Protection Board of India.

To exercise these rights, contact our Grievance Officer (below).

7. Security

We implement industry-standard measures including encrypted passwords (Argon2), JWT authentication, HTTPS, rate limiting, and access controls. No method of transmission over the Internet is 100% secure.

8. Children

MeraBakil is not intended for users under 18 years of age. We do not knowingly collect data from children.

9. Grievance Officer

In accordance with the DPDP Act, you may contact our Grievance Officer:

• Email: admin@merabakil.in
• Response time: within 30 days of receipt

10. Changes to this policy

We will update this page when our practices change. Material changes will be communicated via the platform or email where appropriate. Continued use after changes constitutes acceptance of the updated policy.

11. Contact

For privacy-related questions: admin@merabakil.in