Privacy Policy | Attorni

Effective Date: 9 October 2026

This Privacy Policy (“Policy”) explains how Arka Pvt Ltd (“Company”, “we”, “us” or “our”) processes personal data in connection with the Attorni AI website, application and related services (collectively, the “Services”).

We are committed to protecting personal data in accordance with applicable Indian data protection, information technology and cybersecurity laws, including the Information Technology Act, 2000 and applicable rules made thereunder, and the Digital Personal Data Protection Act, 2023 (“DPDP Act”) and Digital Personal Data Protection Rules, 2025 as and when the relevant provisions apply.

For personal data that Arka collects for its own account administration, billing, security, support and business operations, Arka acts as the Data Fiduciary where applicable. When a law firm, legal professional or other customer submits case files or other Customer Content containing personal data for processing through the Services, the customer ordinarily determines the purpose of that processing and Arka acts as the Data Processor on the customer’s behalf, subject to the applicable agreement and Data Processing Addendum (“DPA”).

1. Data We Collect

Depending on how you use the Services, we may collect or process the following categories of information:

Account and identity data, such as name, email address, organisation or firm name, account identifiers and Bar Council ID where applicable.
Billing and subscription data, such as billing contact details, subscription status, invoices and payment status. Full payment credentials may be processed by a payment provider where applicable rather than stored directly by Arka.
Customer Content, including case files, pleadings, correspondence, evidence, legal documents, prompts, instructions, generated work product, matter metadata and personal data contained in uploaded materials.
Technical and security data, including IP address, session and authentication data, device/browser information, application events, security records and diagnostic information.
Support communications and information you provide when contacting us for assistance or reporting an issue.

2. Purposes of Processing

We process personal data as reasonably necessary to:

provide, operate, maintain and improve the functionality and reliability of the Services;
authenticate users and maintain secure signed-in sessions;
process uploaded documents and user instructions, including through artificial intelligence and machine-learning services requested by the user;
administer subscriptions, billing and customer relationships;
provide customer support and troubleshoot technical issues;
detect, investigate and prevent fraud, misuse, security incidents and other threats;
comply with legal, tax, regulatory, cybersecurity and court obligations; and
establish, exercise or defend legal claims and enforce our agreements.

3. Customer Content, Legal Confidentiality and Privilege

We recognise that Customer Content may include confidential client information, litigation strategy, evidence, professional communications and other sensitive legal material. Our users may be subject to duties under the Advocates Act, 1961, the Bharatiya Sakshya Adhiniyam, 2023 and other applicable professional and legal obligations.

Arka does not claim ownership of Customer Content. We do not routinely inspect Customer Content manually. Authorised Arka personnel may access Customer Content only where reasonably necessary for customer-requested support, troubleshooting, security or fraud investigation, incident response, maintenance requiring such access, compliance with applicable law or binding legal process, or another purpose authorised by the customer. Such access is restricted and logged.

Arka treats Customer Content as confidential regardless of whether a particular document ultimately qualifies for legal privilege under applicable law.

4. Artificial Intelligence and Model Training

The Services use artificial intelligence and machine-learning technologies to analyse and interact with Customer Content. Arka does not use Customer Content, prompts, uploaded documents or customer-specific outputs to train, fine-tune or improve shared or general-purpose AI models.

Arka uses enterprise or commercial AI services with contractual or technical controls intended to prevent Customer Content from being used for general model training. Where supported, Arka enables provider privacy controls such as training opt-outs and zero-data-retention settings. Current material AI processing providers and relevant data-handling information are described on the AI Processing Providers page.

AI-generated outputs may contain errors or omissions. Users remain responsible for independently reviewing and verifying AI-generated output before relying on it for professional, legal, court or client-facing purposes.

5. Third-Party Service Providers and Subprocessors

We engage third-party service providers to operate, secure and support the Services, including providers of cloud infrastructure, data storage, artificial intelligence and document processing, application monitoring, authentication, communications and payment services. We do not publish a complete inventory of our technical stack in this Policy. Information identifying material Data Processors or Subprocessors that process personal data on our behalf is maintained by Arka and may be provided to customers or Data Principals upon request where applicable.

Arka requires material providers to be subject to appropriate contractual, confidentiality, data-protection and security obligations relevant to the services they provide. Not every provider processes Customer Content, and not every AI provider is used for every customer, matter or feature.

6. Cross-Border Processing

Arka and its authorised providers may process personal data in India and other jurisdictions in which relevant service providers operate. Certain AI and cloud services may involve cross-border or global processing. Where required by applicable Indian law, Arka implements contractual, technical or organisational safeguards and complies with applicable restrictions on cross-border processing.

Specific provider identities and relevant processing-location information are maintained in Arka’s current subprocessor records and may be made available to customers or Data Principals upon request, subject to applicable law and contractual confidentiality restrictions.

7. Cookies and Similar Technologies

Arka currently uses an essential session cookie associated with its Phoenix/Elixir application to authenticate users, maintain signed-in sessions and protect account security. We do not currently use advertising, behavioural tracking or non-essential analytics cookies.

If we introduce non-essential analytics or tracking technologies in the future, including a product analytics service such as PostHog, we will update this Policy and implement any consent or notice mechanism required by applicable law before such use.

8. Retention and Deletion

We retain personal data only for as long as reasonably necessary for the purposes described in this Policy, subject to contractual and legal requirements.

Active Customer Content remains available until deleted by the user/customer or until the applicable account or organisational tenant is offboarded, subject to the functionality of the Services.
Arka maintains daily backups of its production relational database. Current scheduled database backups are retained for seven (7) days. Uploaded file objects are maintained separately from these database backups.
When an uploaded file is deleted, it is removed from active use. The applicable cloud storage recovery mechanism may retain the deleted object in a protected soft-deleted state for up to seven (7) days before permanent expiry. Object versioning is not enabled for the current production file store, and no additional bucket retention policy is configured.
Application performance and distributed-tracing metadata is currently retained for up to ninety (90) days. Arka’s custom telemetry instrumentation is designed to transmit operational metadata such as model identifiers, token usage, latency, cost information, trace identifiers and performance data, and not Customer prompts, AI responses, uploaded documents or document text.
Relevant security and ICT logs may be retained for longer where required by applicable cybersecurity law, including applicable CERT-In directions.
Billing, tax, fraud-prevention, dispute, compliance and legal records may be retained for the period required or permitted by applicable law.

Where a customer terminates its workspace, users can download uploaded files before deletion. Arka does not currently provide a bulk export function for chat history.

9. Security Safeguards

Arka implements technical and organisational measures designed to protect personal data and Customer Content against unauthorised access, disclosure, alteration, loss or destruction. These measures include encrypted transport, encryption-at-rest controls provided by relevant infrastructure services, role-based access controls, tenant-level permissions, logged support access, secure password storage, dependency vulnerability monitoring and incident-response procedures.

Additional information is available in our Security & AI Data Handling Policy. No system can be guaranteed to be completely secure, and users are responsible for protecting their own credentials and devices.

10. Minors

The Services are not directed to children under 18 and individuals under 18 are not permitted to create Attorni accounts. This does not prevent authorised adult users from processing Customer Content that lawfully contains personal data relating to minors, including where such information forms part of legal proceedings or case materials.

Where Arka processes minors’ data solely within Customer Content, the relevant customer is responsible for establishing the lawful basis and satisfying applicable obligations relating to that processing.

11. Your Rights and Customer Content Requests

Where Arka acts as the Data Fiduciary, you may have rights under applicable law, including rights relating to access to information about processing, correction and erasure, grievance redressal and nomination, as and when such rights apply. Where processing is based on consent, you may withdraw that consent through the means made available by Arka, subject to processing that is otherwise permitted or required by law.

Where Arka processes personal data contained in Customer Content solely on behalf of a customer, the customer ordinarily remains responsible for responding to Data Principal requests relating to that Customer Content. Arka will provide reasonable assistance to the customer in accordance with the applicable DPA and law.

12. Intermediary Activities

To the extent Arka qualifies as an intermediary under the Information Technology Act, 2000 and applicable rules in relation to Customer Content transmitted, received or stored on behalf of users, Arka will comply with applicable intermediary obligations. Users remain responsible for ensuring that they have the lawful right and authority to upload and process Customer Content through the Services.

13. Changes to this Policy

We may update this Policy from time to time to reflect changes in our practices, technology, providers or legal obligations. Where required by law or where a change materially affects users, we will provide appropriate notice before or when the updated Policy takes effect.

14. Privacy & Grievance Contact

Privacy and grievance matters may be handled by a founder or director of Arka who is authorised to respond on behalf of the company. This role is not described as a statutory Data Protection Officer unless Arka becomes subject to a legal requirement to appoint one.

Privacy & Grievance Contact: abhishek@attorni.ai
Email: privacy@attorni.ai
Support: support@attorni.ai

Security incidents and vulnerability reports may be sent to security@attorni.ai.