Last updated: September 2026
This describes what data Nirnaya GPT actually collects and how it's used. It has not been reviewed by a lawyer and is not a substitute for one — treat it as a plain, accurate description of the system rather than a polished legal document. This English version is authoritative; if you're reading a translated page elsewhere in the product, this page governs.
Because this is a legal-intake tool, what you type may include sensitive personal information — your own or other people's. Only include what's actually relevant to your issue.
We only ever store the last 4 digits of an Aadhaar number, whether you type it into a form or it appears in a chat message or an uploaded document — the rest is automatically masked before it's saved. A document you draft that needs to state your Aadhaar number will use this masked form; carry your original Aadhaar card as physical ID proof when you file it.
To make the product work, parts of your conversation and case facts are sent to:
We do not sell your data, and we don't share it for advertising purposes.
Our database and file storage are hosted in South Korea (via Supabase/AWS). Anthropic, OpenAI, and Voyage AI process data in the United States. This means your data is transferred outside India in the course of providing the service. We rely on our processors' own data-protection commitments; if you have concerns about this, contact us using the details below before using the service.
Your cases, messages, and findings are only visible to your own account — enforced at the database level (Postgres Row Level Security), not just in the application code. Authentication uses Supabase's session cookies, which are functional/essential cookies, not tracking or advertising cookies. Aadhaar/PAN/CIN/GST numbers you save to a reusable identity record are additionally encrypted at rest.
You can download a copy of everything we hold about your account, or permanently delete your account and all associated data, any time from your profile page — no need to contact us for either. Deletion removes your cases, messages, documents, uploads, identity records, and credit history; it cannot be undone. Separately, a case with no activity for 24 months is automatically scheduled for deletion: you get a one-time notice first (WhatsApp, or email if we don't have a phone number for you), and opening the case again within 30 days of that notice cancels the deletion.
For a privacy question, a data request you can't complete yourself from your profile page, or a grievance about how your data has been handled, write to support@nirnayagpt.in, or use the grievance form below — either reaches the same Grievance Officer function.
Under Section 13 of the Digital Personal Data Protection Act, 2023, we've designated a Grievance Officer function, reachable at support@nirnayagpt.in or via the form below. We aim to acknowledge a grievance within 48 hours and resolve it within 30 days; if it needs longer, we'll tell you why and give a revised timeline.
If we become aware of a personal data breach affecting your information, we will notify the Data Protection Board of India without delay and submit a full report within 72 hours, as required under Section 8(6) of the Digital Personal Data Protection Act, 2023. We will also notify you — using the contact details on your account — as soon as practicable, describing what happened, what data was affected, and what we're doing about it.
If this changes meaningfully, we'll update this page and the date above.