Privacy Policy

This page is the notice we give under the Digital Personal Data Protection Act, 2023 (DPDP Act) and the privacy notice we publish for the purposes of the Information Technology Act, 2000.

It is an electronic record under the Information Technology Act, 2000. It does not need a physical or digital signature.

This notice stands on its own. It is not buried in our Terms of Service. You can read it without agreeing to those Terms.

1. Who we are

LAWONE SOLUTIONS PRIVATE LIMITED (we, us, Law1, or Lawone Solutions Pvt Ltd) is the data fiduciary. We decide why and how personal data is processed for the Law1 legal-research service at https://law1.in (the Service).

Registered office: 2nd Floor, A417, Lane 4, Road no 28, Ramnagar, Wagle Estate, MH, 400604, India. CIN: U58122MR2026PTC481366.

You are the User — the individual whose personal data we process. In the DPDP Act you are the Data Principal.

An Org is the organisation that is the billing boundary and the data boundary for research work on Law1 (projects, stars, comments, and similar material we store for that Org). There is no “personal org”. Creating a User does not create an Org. A User may belong to more than one Org. Each Org has its own entitlements and research data.

Questions about this notice: [email protected] or Contact. Grievance: Grievance officer. Other legal pages: Legal hub.

This notice is in English. If you need it in another language specified in the Eighth Schedule to the Constitution, write to [email protected].

2. What this policy covers

This policy covers personal data we process when you browse Law1, create or use a User account, create or join an Org, pay, write to us, or otherwise use the Service.

It does not turn a name that appears in a court judgment into a private record. Judgments we host are public records. Requests to unpublish or redact a judgment follow Case and content removal, not this page.

Cookies are described in the Cookie Policy. How the contract works is in the Terms of Service. Money is in Refund & Cancellation.

3. Personal data we collect

We collect only what we need for the purposes in section 4. Itemised by source:

You give us

• Email address — when you sign in, accept an invite, write to [email protected], or contact us. The address on a User is that User’s sign-in identity, verified at signup — not a profile field we rewrite. In this version of the Service we do not change it. A different mailbox is a new User.
• Display name — the name we store on your User. If you sign in with Google, we may pre-fill this from the name Google sends. You can change it.
• Org details — org name, category, and city, when you create an Org.
• Billing profile (Owner, when the Org pays) — legal name, address, Indian state (place of supply), and GSTIN if you give one.
• Contact form — name, email, category, message, and optional error codes you quote. The form does not accept file attachments. We deliver the message by email to [email protected]. We do not keep a support-ticket archive in the product.
• Support mail — whatever you send to [email protected], including removal requests and rights requests.

Google sends us (if you use Continue with Google or One Tap)

We ask Google only for openid, email, and profile. We receive your verified email and the display name and profile details Google sends for those scopes. We do not ask Google for Drive, Gmail, Calendar, or other extra scopes.

Signed-out Log in and Start free may load Google Identity Services (including One Tap and FedCM) from accounts.google.com. That is the same Google sign-in. It is not Google Analytics 4. Cookies or credential-manager state that script sets are Google’s — see the Cookie Policy.

We generate when you use the Service

• Sessions — sign-in state, active Org, device/session records, and related security signals (including IP address used for rate limits and abuse control).
• Metering and usage — what the Org is entitled to, views, PDF downloads, credits, and similar usage we need to run plans and stop scrape or overuse.
• Org research data (on that Org) — projects, stars, comments, and case-tracking or progression notes when those features are available.
• Billing and payment records — quotes, charges, collector payment references, and GST tax invoices.
• Policy acceptances — when you tick to accept Terms, Acceptable Use, Disclaimer, Refund, or Shipping, we store that you did, which pages and effective dates, when, and from where.
• Auth and support metadata — for example that a session was created or revoked, or that a Google account was linked; and, if you submit Contact while signed in, the user and active-org identifiers we include in the outbound mail so we can help you.

We do not collect

• We do not collect a phone number in this version of the Service. We do not ask for SMS or WhatsApp on sign-up, /start, account settings, trial, or checkout.
• We do not run an advertising product. We do not build an ads profile. We do not sell personal data.

Court judgment text we host is a public record. We do not treat a name in a published order as something you “gave” us under this policy. See Case and content removal.

4. Why we use it

We process personal data only for a lawful purpose that is not forbidden by law, and only on a ground the DPDP Act actually provides: consent (section 6), or a legitimate use listed in section 7.

This page is a notice. It is not a tick-box that consents to every use we might ever invent. We do not say that ticking our Terms accepts this policy as consent for all processing.

If we later ask for consent for something that is not covered above, we will say so at the time, and you can refuse. How to withdraw consent is in section 9.

We may use personal data in an aggregated or de-identified form that no longer identifies you, to understand how the Service is used and to keep it reliable.

5. Cookies and similar technology

Auth session cookies are strictly necessary. They keep you signed in. They are not gated on a cookie notice or an analytics choice. If we cannot set them, you cannot use a signed-in account.

We use two cookie categories only: strictly necessary, and analytics. There is no marketing category. Analytics is notice-first (on by default). You withdraw on the Cookie Policy and in account settings. The table, the notice, and what Off does are on that page.

6. Who we share with

We do not sell personal data. We do not share it with advertisers.

We use data processors under contract to provide the Service. They may process personal data only on our instructions, for the purpose we give them.

Search. Full-text search runs on Meilisearch on our servers. The browser never receives Meilisearch credentials, host names, or raw filter power. Search queries are processed on our side.

We aim to host application and case-law databases in India. Staff who operate Law1 may access personal data when they need to for support, billing, security, or to comply with law.

We may disclose personal data if Indian law or a competent court or authority requires it, or to establish, exercise, or defend a legal claim.

Members of an Org can see that Org’s research data and the display names of fellow Members. Comments are not a public forum.

If we transfer the Service in a reorganisation, personal data may move to the successor. We will give notice.

7. Processing outside India

Some processors — including Google, Cloudflare, Turso, Cloudflare R2, and possibly our email provider — may process personal data outside India. We do not claim that personal data never leaves India.

Under section 16 of the DPDP Act, we may transfer personal data for processing outside India except to a country or territory the Central Government restricts by notification. Rule 15 of the Digital Personal Data Protection Rules, 2025 allows the Central Government to set further requirements where personal data would be made available to a foreign State or an entity under its control.

Unless a restriction of that kind applies to a transfer, the transfer is allowed. We will not transfer personal data in breach of any such restriction.

We are not established in the United Kingdom or the European Union. This notice is not a GDPR or UK-GDPR statement. We do not appoint an EU or UK representative.

8. How long we keep it

We keep personal data while it is needed for the specified purpose in section 4, or for as long as Indian law requires. When the purpose is served and no law requires a keep, we erase it (and we require processors to erase what we sent them), as section 8(7) of the DPDP Act provides.

We use three buckets:

• Account-lifetime — your User, the Org, and that Org’s research data, for as long as that User or Org exists. We do not silently delete an account after a period of no login. A Member leaving an Org does not wipe that Org’s research data.
• Statutory — GST tax invoices and related books. These survive org delete.
• Purpose-limited — sessions, cookies, analytics, operational logs, and email deliverability suppression, kept only as long as that purpose needs.

The judgment corpus we host is not your personal data under this policy. Unpublish and redact follow Case and content removal.

GST tax invoices and related books. We retain tax invoices and the accounts and records that GST law requires us to keep. We cannot honour an erasure request for those records while the statutory keep still runs.

Under section 36 of the Central Goods and Services Tax Act, 2017, read with rule 56(16) of the Central Goods and Services Tax Rules, 2017, we retain those invoices and records until seventy-two months from the due date of furnishing the annual return for the financial year they belong to. If there is an appeal, revision, other proceeding, or an investigation under Chapter XIX of that Act, we keep the records that relate to it for one year after final disposal, or for the seventy-two-month period, whichever is later.

Org delete does not produce a cash refund and does not wipe invoices we must keep. See Refund & Cancellation and the Terms of Service.

Deleted data may remain in backups until those backups expire. We do not promise instant erase from every copy.

9. Your rights and how to exercise them

Under the DPDP Act you may:

• Access a summary of your personal data and of our processing, and (where the Act requires) the identities of other fiduciaries and processors with whom we have shared it.
• Correct, complete, or update inaccurate, incomplete, or out-of-date personal data.
• Erase personal data, unless we must keep it for the specified purpose or to comply with law (including GST invoices).
• Withdraw consent, where consent is the ground, as easily as you gave it. Withdrawal does not make earlier processing unlawful. If you withdraw consent we need in order to provide the Service, we may stop providing that part of the Service. The consequences are yours to bear, as the Act provides. For analytics, withdrawal is the Analytics cookies control on the Cookie Policy and in account settings — per browser, not a setting stored on your User.
• Nominate another individual to exercise these rights if you die or become incapable, in the manner the Act and the Rules prescribe.
• Use our grievance process (section 10).

In this version of the Service, write to [email protected] for access, correction, erasure, nomination, and export. There is no in-product rights form. We may need to verify that the request comes from you.

The sign-in email on a User is that User’s identity, verified at signup. We do not rewrite it. If you need a different mailbox, create a new User. That does not take away the right to correct other personal data that is inaccurate, incomplete, or out of date.

Analytics withdrawal is not this channel. Use the Analytics cookies control on the Cookie Policy and in account settings.

• Export of your data: request via [email protected].
• Erase a User account: you may also delete it in the product when that control is available. Deleting a User does not, by itself, delete the Org or cancel a paid plan.
• Delete an Org: only the Owner may do this. Until in-product org delete is available, the Owner should request it via [email protected]. We will erase Org research data we no longer need for the specified purpose or for law. We retain tax invoices and other records the law requires.
• Nominate someone to exercise these rights if you die or become incapable: email only. There is no nomination screen in the product.

We will not erase: GST tax invoices while the statutory keep runs; live billing or payment mandates we need to run the contract; the judgment corpus; another Member’s identity or an Org’s research or billing history merely because one Member asks. The Org is the billing and research-data boundary. The corpus follows Case and content removal, not this page.

If you no longer want us to use data you voluntarily gave us for a specified purpose, tell us. That is how you indicate that you do not consent to further use under section 7(a).

10. Grievance and the Board

For a grievance about our handling of your personal data, or about the exercise of your rights, use the Grievance officer page.

Email [email protected]. We do not use a separate grievance@ address. We do not publish a personal name or phone number for this purpose.

You must exhaust that grievance process before you complain to the Data Protection Board of India (DPDP Act, section 13(3)).

If we do not resolve the grievance, you may complain to the Board under the DPDP Act, through the channel the Board publishes.

For ordinary product support that is not a statutory grievance, use Contact or [email protected].

11. Children

The Service is for people who are 18 or older. We do not direct it at children. We do not offer a guardian or parental-consent flow.

In the DPDP Act a child is a person who has not completed eighteen years. An Org category labelled student means an adult professional student (for example law, CA, or CS). It does not mean a minor.

If we learn that we have collected personal data of a person under 18, we will delete the account and that personal data, except records we must keep by law.

12. Security

We take reasonable technical and organisational measures to protect personal data in our possession or under our control, including when a processor handles it for us.

In particular:

• sign-in uses email one-time codes or Google — there is no password to steal from us;
• OAuth access and refresh tokens we store are encrypted at rest;
• auth session cookies are Secure, HttpOnly, and SameSite=Lax;
• the public site sits behind Cloudflare (TLS, WAF, tunnel);
• judgment bodies are not served from public object-store URLs;
• Meilisearch credentials never go to the browser.

No method of transmission or storage is perfectly secure. We do not claim ISO, SOC 2, or similar certification on this page.

If there is a personal data breach that the DPDP Act requires us to report, we will inform the Board and each affected User in the form and manner prescribed.

13. Changes

We may change this policy. A material change will have a new effective date on this page. We will give notice by email and in the product.

This version of the Service does not require you to tick again after a change. If you continue to use the Service after that notice, you accept the changed policy. If you do not agree, stop using the Service and, if you are the Owner, cancel or delete as appropriate.

14. Contact

Data fiduciary: LAWONE SOLUTIONS PRIVATE LIMITED, 2nd Floor, A417, Lane 4, Road no 28, Ramnagar, Wagle Estate, MH, 400604, India. CIN: U58122MR2026PTC481366.

Email: [email protected]

Contact form: Contact

Grievance: Grievance officer

Related pages: Terms of Service · Cookie Policy · Refund & Cancellation · Case and content removal · Legal hub