ClaimLexClaimLex← Back to site

Privacy Policy

Last updated: July 25, 2026
📑 Table of contents (14 sections)
  1. 1. Who we are (Data Fiduciary)
  2. 2. Personal data we collect
  3. 3. Purposes and lawful basis of processing
  4. 4. AI features and your data
  5. 5. Cookies & tracking
  6. 6. How we share your data
  7. 7. Data retention
  8. 8. Data security
  9. 9. Your rights (DPDP Act)
  10. 10. Children's data
  11. 11. International transfers
  12. 12. Grievance Officer / Data Protection contact
  13. 13. Changes to this Policy
  14. 14. Contact

Privacy Policy

Effective Date: July 25, 2026

Last Updated: July 25, 2026

ClaimLex Technologies ("ClaimLex", "we", "us", "our") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, retain and safeguard your personal data when you use the ClaimLex platform ("Platform"), and your rights in relation to that data.

This Policy is issued in compliance with the Digital Personal Data Protection Act, 2023 (DPDP Act), the Information Technology Act, 2000 and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 (SPDI Rules). By using the Platform, you consent to the practices described here.

1. Who we are (Data Fiduciary)

For the purposes of the DPDP Act, ClaimLex Technologies is the Data Fiduciary determining the purpose and means of processing your personal data. Our contact details are in Section 12.

2. Personal data we collect

a. Information you provide:

  • Identity & contact data — name, email address, phone number (if provided), organisation/role.
  • Account credentials — hashed password (we never store passwords in plain text).
  • Billing data — plan, invoices, GST details you supply; payment-card data is handled by our processor (Razorpay) and is not stored by us.
  • User Content — notes, bookmarks, tags, saved searches, alerts.
  • Communications — messages you send to support or grievance channels.

b. Information collected automatically:

  • Usage & device data — pages viewed, searches run, judgments opened, feature usage, browser type, operating system, device identifiers, and approximate location derived from IP.
  • Log data — IP address, timestamps, referring URLs, and session identifiers.
  • Cookies & similar technologies — see the Cookie Policy.

c. Information from third parties:

  • Payment/verification status from Razorpay; analytics from Google Analytics.

We do not intentionally collect special-category or sensitive personal data beyond what is necessary, and we ask you not to submit such data in free-text fields.

3. Purposes and lawful basis of processing

We process your personal data for the following purposes, on the basis of your consent and/or the necessity to perform our contract with you and our legitimate interests:

Purpose Basis
Create and manage your account Contract
Provide the Platform, search, AI and workspace features Contract
Process payments, invoicing and GST compliance Contract / Legal obligation
Enforce device limits, prevent fraud and abuse Legitimate interest / Contract
Send service, security and transactional emails Contract
Send product updates, digests and marketing (opt-out available) Consent
Analytics and product improvement Legitimate interest / Consent
Comply with law and respond to lawful requests Legal obligation

4. AI features and your data

When you use AI-assisted features, your query and relevant corpus context are processed to generate a response. We may retain queries and outputs to operate, secure, meter and improve the feature. We do not sell your data, and we do not use your personal data to train third-party foundation models.

5. Cookies & tracking

We use strictly necessary, functional and analytics cookies. You can control non-essential cookies as described in the Cookie Policy. We honour privacy-preserving defaults where feasible.

6. How we share your data

We do not sell your personal data. We share it only with:

  • Service providers / Data Processors who process data on our behalf under contract — cloud hosting, payment processing (Razorpay), email delivery, and analytics — bound to confidentiality and security obligations;
  • Legal & regulatory authorities, where required by law, court order, or to protect rights, property or safety;
  • Business transfers — in connection with a merger, acquisition or asset sale, subject to this Policy.

7. Data retention

We retain personal data only for as long as necessary for the purposes above or as required by law (for example, invoicing and tax records are retained for the period prescribed under applicable tax law). When no longer required, data is deleted or anonymised. You may request deletion as set out in Section 9.

8. Data security

We implement reasonable security practices and procedures appropriate to the risk, including encryption in transit (TLS), password hashing, access controls, network hardening behind a CDN/WAF, audit logging, and regular backups. No method of transmission or storage is completely secure; we cannot guarantee absolute security but commit to promptly addressing any incident and notifying you and the authorities where required.

9. Your rights (DPDP Act)

Subject to applicable law, you have the right to:

  • Access — obtain a summary of the personal data we process about you;
  • Correction & updating — correct inaccurate or incomplete data;
  • Erasure — request deletion of your personal data where it is no longer necessary;
  • Withdraw consent — withdraw consent at any time (this does not affect prior lawful processing);
  • Grievance redressal — raise a complaint with our Grievance Officer and, thereafter, the Data Protection Board of India;
  • Nominate — nominate another individual to exercise your rights in the event of death or incapacity.

To exercise any right, email privacy@claimlex.in. We will respond within the timelines prescribed by law after verifying your identity. Certain data may be exported or your account deleted from your account settings.

10. Children's data

The Platform is not directed to children under 18. We do not knowingly process the personal data of children. If you believe a child has provided us data, contact privacy@claimlex.in for deletion.

11. International transfers

We primarily store and process data on infrastructure located to serve Indian users. Where a service provider processes data outside India, we ensure appropriate safeguards consistent with the DPDP Act and applicable transfer restrictions.

12. Grievance Officer / Data Protection contact

Grievance & Data Protection Officer: Surendra Bhilwal

Email: privacy@claimlex.in (data) · grievance@claimlex.in (grievances)

Address: ClaimLex Technologies, Mumbai, Maharashtra 400001, India

We acknowledge grievances within 48 hours and endeavour to resolve them within the statutory timeline. See the Grievance Redressal page.

13. Changes to this Policy

We may update this Policy from time to time. Material changes will be notified by email or in-app notice and reflected in the "Last Updated" date. Continued use after changes constitutes acceptance.

14. Contact

Questions about privacy? Email privacy@claimlex.in. For general queries, see the Contact page.