What happens to your data, in plain words.
Who can see it, where it is processed, how long it is kept and who else touches it. The same commitments as our privacy policy, without the legal drafting.
At a glance.
Not used for training. Your content is never used to train AI models. Model request logging is off, so prompts and replies are not written to any log of ours.
Encrypted. In transit with TLS, and at rest with keys AWS manages for us.
Private by default. Nothing you upload or ask is visible to anyone in your firm until you share it.
Deletion is final. Deleted sessions and documents are removed at once, with no backup copy that outlives them.
Access is logged. Sign-ins and access events are kept for security auditing.
Data protection law. ValminAI is the Data Fiduciary under the Digital Personal Data Protection Act, 2023.
Where your data goes.
Every place a question or a document travels when you use LegalGita.
- 1
You
Questions, documents and shared links, over TLS.
- 2
LegalGita
Files, their details and their search index, stored on Amazon Web Services and encrypted at rest. Sign-in through AWS Cognito.
- 3
AI models
Your question and the passages retrieved to answer it go to models on Amazon Bedrock, only to produce your answer. Not stored for training.
- 4
External search
Search text written from your question goes to case-law and web search providers. Never your uploaded files.
Where processing happens
- Your data is stored and processed in the region of your jurisdiction. For clients in India, LegalGita runs in the AWS Mumbai region, so your documents, your questions and the AI processing of them never leave India.
- Clients in other jurisdictions are hosted in a region of their own, so the same rule holds wherever you practise.
- External search cannot be turned off. Search text can contain terms from your question, such as party names or statutes. If you would not put a question into a public search engine, treat it the same way here.
Who can see your content.
Nobody in your firm sees what you upload or ask until you share it. Here is everyone else.
People you share with. A named colleague gets the level you choose: read, read and work with (no download), or full access. A link works without sign-in for one hour to seven days, and can be revoked earlier.
Your firm's administrators. Members and each member's share of the allowance, as a percentage. Not your questions, conversations or documents, unless you share them.
ValminAI. Two people, the Chief Executive Officer and the Chief Engineer, under confidentiality obligations, may read conversations only to diagnose a fault, review answer quality, give support you asked for, investigate a security incident or meet a legal obligation. Docket documents are not part of quality review. Your firm can ask for a contractual restriction, or to be excluded from quality review.
How long it is kept.
The defaults the service runs with. If you need them fixed in your contract, ask us.
- Conversations and results
- Until you delete them. Legal matters often run for years, so they do not expire.
- Docket documents and their index
- Until you delete them, or your account is closed.
- Case maps
- 365 days
- Security and access logs
- 365 days
- Usage records
- 400 days, so a question about an earlier billing cycle can still be answered.
Deletion is final.
Deleting a conversation removes it with every result stored against it. Deleting a document removes the file, its details and the passages indexed from it, so it stops being searchable at the same moment.
We keep no backup snapshots or point-in-time copies from which deleted records could be restored. The other side of that: nothing deleted by mistake can be recovered.
Closing an account does not by itself erase what is stored. Ask us and we will delete it.
Service providers.
Everyone who processes data to run LegalGita. We update this list before adding a provider that processes your content.
Certifications.
LegalGita is not yet independently certified. We will publish each certification here as we complete it. Until then, we answer your firm's security questionnaire in full and walk your team through the architecture.
Request the security questionnaireYour rights.
- See, correct and delete your data, and ask for it to be erased when you leave.
- See and erase anything LegalGita has learned about how you work.
- Raise a grievance with us. We acknowledge within 48 hours and resolve within 30 days, and you can then go to the Data Protection Board of India.
ValminAI Technology Consulting Pvt. Ltd., C-58/19, 313 BHEL Vinayak Building, Sector 62, Noida. contact-us@valminai.com
Bring your security team.
We will take them through how LegalGita handles privileged material, before anyone uploads a file.