What happens to your case material.

01Who We Are and What This Policy Covers

Vexisx operates a privacy-native legal AI platform (the "Platform") built for Indian advocates, litigators, and law firms. This Policy explains what data we collect, what is sent to our servers and to the third-party AI provider, how long it is kept, and what rights you have under the Digital Personal Data Protection Act, 2023 ("DPDP Act") and the DPDP Rules, 2025.

This Policy applies to:

• Visitors to vexisx.in
• Users of the Vexisx app at app.vexisx.in
• Advocates, law firm staff, and administrators with a Vexisx account

02How Your Case Material Is Processed

This is the most important section of this Policy: it explains what happens to the documents and messages you process with Vexisx, and what reaches our servers and the third-party AI provider.

1. In your browser. You choose the documents and messages to process in the Vexisx app (app.vexisx.in). The files you upload are sent to our server to be read: they are held only in a temporary folder while their text is extracted and are then deleted, and neither the files nor their text are stored or logged. Where AI reading of scanned pages is switched on, images of the scanned pages are sent to an AI model for this, through OpenRouter and under Zero Data Retention (see below).
2. In transit. The text of the documents and messages you choose to process — including the names and other personal details in them — is sent as written, encrypted (TLS).
3. In the cloud. Our application server passes the text to a third-party AI model (accessed through OpenRouter — see Section 8) to produce the draft, summary, answer or analysis.
4. Back to you. The result is returned to the app. Your cases, chats and calendar are stored in your browser, not on our servers, encrypted with a key the browser keeps and cannot export. They stay in that browser: they are not copied to your other devices or browsers, and clearing the browser’s site data deletes them.

Zero Data Retention

Every AI request is sent with Zero Data Retention: OpenRouter routes it only to model providers that do not store prompts or outputs, and refuses the request rather than use one that does. Neither OpenRouter nor the model provider keeps what you send after the response is produced, and none of it is used to train any model.

Case-law research

When you search case law, or a draft is prepared with research, search queries are sent to Indian Kanoon’s search service. The queries Vexisx writes for a draft contain legal issues only — not names, places, dates or amounts from your case. Searches you type yourself are sent as you write them, so do not put a client’s details in a search.

03What Data We Collect

We do not store your case documents, case text, or the client details in them on our servers. They pass through our server only to be processed — see Section 2.

04Legal Basis and Purpose of Processing (DPDP Act 2023)

Under the DPDP Act, we process personal data only where we have a lawful basis:

• Consent — for account creation, marketing communications, and any processing of your personal data beyond what's needed to provide the service. Consent notices will be made available in accordance with DPDP Rules requirements.
• Legitimate use — for account security, fraud prevention, service delivery, and legal compliance.

We process data strictly for the purposes disclosed at collection: providing the drafting/summarisation/strategy/contradiction-detection/timeline features, billing, support, and product improvement. We do not use your account data for purposes incompatible with these.

05Data Retention

• Case text sent to the cloud model: processed only to generate your response. We do not store it: our service monitoring records technical details only (time, size, model and cost), never the text. Every request is sent with Zero Data Retention, so neither OpenRouter nor the model provider stores it.
• Documents you upload: deleted as soon as their text has been extracted; neither the files nor their text are stored or logged.
• Saved cases, chats and calendar: kept in your browser until you delete them (or clear the browser’s site data); not sent to us except as part of an AI request you make.
• Account data: retained until you delete your account. You can do this yourself at any time (in the app: Settings → Security → Delete my account; or in your account on vexisx.in), and your account data is then deleted.
• Payment records: kept for the period Indian tax and company law requires (up to 8 years). If you delete your account, they are kept without your name or email.
• Usage data and API request records: 12 months, for product and business analysis.
• Error logs: 90 days.
• Support communications: 18 months, for customer service and dispute history.

06Your Rights as a Data Principal

Under the DPDP Act, you have the right to:

1. Access — a summary of the personal data we hold about you and the processing activities.
2. Correction and erasure — request correction of inaccurate data or erasure once the purpose of processing is served, subject to legal retention requirements. You can delete your account yourself at any time (see Section 5).
3. Grievance redressal — raise a complaint with our Grievance Officer (Section 12) before approaching the Data Protection Board of India.
4. Nominate — nominate another individual to exercise your rights in the event of death or incapacity.
5. Withdraw consent — as easily as you gave it, for processing that relies on consent.

07Data Breach Notification

In the event of a personal data breach, Vexisx will notify the Data Protection Board of India and affected users in accordance with the DPDP Rules 2025 — within 72 hours of becoming aware of the breach, with no de minimis threshold (all breaches are reportable). We will describe the nature of the breach, likely consequences, and remedial measures taken.

08Third-Party Processors

We rely on the following categories of sub-processors, who process case text only as described in Section 2:

• OpenRouter — routes case text (and, where AI reading of scanned pages is on, images of scanned pages) to the AI model that generates drafts, summaries and analysis. Every request is sent with Zero Data Retention, so neither OpenRouter nor the model provider stores it or trains on it.
• Render (Singapore) — runs our application server, which passes requests between the app and the services in this list and reads uploaded documents (Section 2).
• Supabase (Mumbai, India) — our account database and sign-in.
• Razorpay (India) — processes payments; we never receive or store your card or UPI details.
• Langfuse — technical monitoring of AI requests (time, size, model and cost); never the text you send.
• Resend — sends sign-in codes and account emails, so it receives your email address.
• Indian Kanoon — receives case-law search queries to find relevant judgments (see Section 2); it does not receive your documents.
• Hostinger — hosts vexisx.in and the app’s files. It sees ordinary web request details such as your IP address, not your case material: the app sends that to our application server directly.
• FormSubmit — delivers messages sent through our support form (name, email, phone if given, and the message) to our inbox.

We maintain data processing agreements with sub-processors and will update this list as our infrastructure evolves.

09Your Role as Data Fiduciary for Client Data

If you are an advocate using Vexisx to process a client's case material, you are the Data Fiduciary for that client's personal data under the DPDP Act, and Vexisx acts as your Data Processor. This means:

• You remain responsible for obtaining appropriate client consent to use AI tools in their matter, consistent with Bar Council of India professional conduct rules and your duty of confidentiality.
• Vexisx processes that data only on your instructions, as described in Section 2.
• Check that the documents and messages you send are the ones you mean to process: everything you send is processed as written, including any personal data in it.

10Cross-Border Data Transfer

Our account database is in India (Supabase, Mumbai). Some processing happens outside India:

• Our application server runs in Singapore (Render), so account details, case text and the documents you upload pass through it.
• Case text is processed by OpenRouter and the AI model provider, which may be outside India (for example, in the United States), under Zero Data Retention.
• Langfuse (technical monitoring, no text), Resend (your email address, for sign-in codes) and FormSubmit (support form messages) may process data outside India.

The DPDP Act allows personal data to be transferred outside India except to countries the Government of India restricts by notification. We do not transfer personal data to any restricted country and will update this section if that list or our providers change.

11Security Measures

• Zero Data Retention for every AI request
• TLS encryption in transit
• Encrypted storage of cases, chats and calendar in your browser, with a key that cannot be exported
• Uploaded documents deleted as soon as their text is extracted; case text never written to our logs
• Access controls and audit logging on our infrastructure
• No training of AI models — ours or third-party — on user or client data

12Grievance Officer & Contact

Grievance Officer: to be appointed
Email: privacy@vexisx.in
Address: Rohtak Chowk, Puran Nagar, Charkhi Dadri, Haryana 127306

If you have any question or concern about how your data is processed, please contact us.

13Children's Data

The Platform is intended for use by licensed legal professionals and is not directed at or intended for use by minors. We do not knowingly collect personal data from individuals under 18.

14Changes to This Policy

We will notify registered users of material changes to this Policy via email and/or in-app notice before they take effect.

This version took effect on 25 Oct 2026. It replaces the version of 11 Oct 2026: Vexisx no longer replaces names and other identifiers with placeholders before sending text, and it is now provided as a web app at app.vexisx.in instead of a desktop application.