Privacy policy

Lexoradv (“we”) operates a technology platform that connects people seeking legal advice with advocates enrolled with a State Bar Council in India. We are the data fiduciary for the personal data described here, within the meaning of the Digital Personal Data Protection Act, 2023 (“DPDP Act”).

We do not practise law. We do not give legal advice and we are not party to the advocate–client relationship. That relationship, and the professional duties that come with it, exists between you and the advocate you engage.

Registered entity: Samidla Enterprises. Registered address: 202, Maphar Eleganza Maaz, Mithila Nagar, Banjara Hills, Hyderabad 500034. Contact: help@lexoradv.com.

If you book consultations:

• Name, email address, and phone number if you provide one
• Your country, time zone and language preference
• The state your matter concerns and the practice area you select
• What you write when describing your matter
• Documents you upload for a consultation
• Your consultations: times, references, status, and what you paid
• Reviews you submit after a completed consultation

If you are an advocate: everything above that applies, plus your State Bar Council enrolment number, enrolment certificate, admission dates, practice areas, languages, availability, the fee agreed with us, and payout records. Your enrolment certificate is an identity document and is treated as such.

Automatically: we record when a session was authenticated, and we log administrative actions taken on the platform, approvals, price changes, refunds, with the identity of the administrator who took them. We do not run third-party advertising or analytics trackers.

We do not collect your bank or card details. Payment details are handled by our payment provider; we hold only a reference issued by them. Advocates supply bank details directly to the payout provider, and we store a token, never an account number.

• To provide the service: creating your account, showing available times, taking bookings, creating meeting links, and passing documents between you and your advocate.
• To verify advocates: checking an enrolment number and certificate against the State Bar Council roll before a profile can be booked. This is the basis for showing anyone on the platform.
• To match jurisdiction: we use the state you select to prevent you booking an advocate who is not enrolled there.
• To take payment and settle with advocates: including keeping records required for tax and accounting.
• To keep the platform accountable: the audit log records administrative decisions so they can be reviewed later.
• To contact you about your consultations: confirmations, changes, cancellations. We do not send marketing email unless you ask us to.

We process this data on the basis of your consent, given when you create an account and when you book, and where necessary to perform our agreement with you or to meet a legal obligation.

What you tell an advocate you engage, and the documents you share with them, may be privileged under Section 126 of the Indian Evidence Act. We treat that material differently from ordinary account data:

• Documents are scoped to a single consultation. An advocate can reach your file only through the consultation it belongs to, never from a general list of clients.
• Files are held in private storage. Every view generates a fresh link that expires within minutes, so there is no durable URL to forward or leak.
• An advocate’s consultation notes are visible only to them unless they explicitly choose to share them with you.
• Platform administrators can access documents where necessary to investigate a dispute, a complaint, or suspected misuse. Every such access is logged.

We do not read your documents for any other purpose, and we do not use them to train any model.

The advocate you book. They see your name, the state and practice area, what you wrote about your matter, and any documents you upload for that consultation. They do not see your other consultations or your payment details.

Service providers we rely on. Each receives only what it needs:

• Supabase: database, authentication and file storage. Holds account data and uploaded documents.
• Vercel: application hosting. Processes requests; does not store your consultation records.
• Google: Calendar and Meet, used to create the video consultation. Receives the participants’ email addresses, the consultation reference, and the scheduled time. Your description of the matter is included in the calendar entry, so avoid putting sensitive detail in that field if you would rather it stayed off a calendar invitation.
• Our payment provider: currently a test gateway that processes no real payments. Before live payments begin, this section will name the provider and what it receives.

Nobody else. We do not sell personal data, and we do not share it for advertising. We may disclose data where required by law, by a court, or to establish or defend a legal claim.

Your data is stored in India, on infrastructure operated by Supabase in Mumbai (region ap-south-1), and served through Vercel’s network from Mumbai as well.

That includes your account details, what you write about your matter, and any documents you share with an advocate. None of it leaves the country in the ordinary course of providing the service.

We state this plainly because it is the kind of thing people assume without checking, and because it has not always been true here: until September 2026 this data sat in Singapore, and the pages you are reading said so. It was moved before any consultation had taken place, so nothing written to us by a client or an advocate was ever held outside India.

Nothing in the DPDP Act required the move. Section 16 permits transfers abroad except to countries the Government restricts by notification. We did it because a person telling an advocate about their case should not have to wonder which country the account of it is sitting in.

• Account data: while your account is open, and for a reasonable period afterwards to handle disputes.
• Consultation documents: you may withdraw a document you uploaded at any time, which removes it from storage. Otherwise a document stays available to both of you for as long as the consultation record exists, and is deleted when you close your account. We do not delete consultation documents on a timer: an advocate’s file and your own copy of the advice are the point of keeping them.
• Booking and payment records: retained as long as required by tax and accounting law, even after you close your account.
• Advocate verification records: retained while the advocate is listed and afterwards, because they evidence why someone was permitted to advise.
• Audit log: records who did what, and who looked at what, and cannot be edited or deleted by administrators. Entries that record only that somebody read a record are erased after eighteen months. Entries that record a change are kept, because they may be needed years later for tax or a dispute, but the IP address in them is erased at the same eighteen months.
• Phone verification codes and delivered email: erased after eighteen months. The Digital Personal Data Protection Rules, 2025 set a floor of one year on keeping processing records; eighteen months clears it without keeping anything longer than it is useful.

Under the DPDP Act you may:

• Ask what personal data we hold about you and how it is processed
• Ask us to correct data that is inaccurate or incomplete
• Ask us to erase data we no longer need to keep
• Withdraw consent, which will end your ability to use the service
• Nominate someone to exercise these rights if you die or become incapacitated
• Complain to the Data Protection Board of India

Two limits worth stating plainly. We cannot erase records we are required to keep for tax, or entries in the audit log: that log exists precisely so it cannot be rewritten. And we cannot delete material from an advocate’s own files; their professional obligations govern that, not us.

To exercise any of these, write to help@lexoradv.com. We respond within 30 days.

Access rules are enforced in the database itself rather than only in the application, so a mistake in the interface does not expose data. Every table denies access by default, and a query returns only rows the signed-in user is entitled to.

• Everything travels over TLS, and the site instructs browsers never to load it any other way
• Bank account numbers and PANs are encrypted with AES-256-GCM before they reach the database, under a key the database does not hold: a copy of the database on its own yields nothing usable
• Document buckets are private; access derives from the consultation
• Links to files are signed and expire in minutes
• Consultation prices and meeting links cannot be altered by users
• Administrator accounts cannot be self-assigned
• Changes are written to an append-only log, and so is any reading of one person’s records by another, so a misuse of authorised access can be found afterwards

No system is perfect. If we discover a breach affecting your personal data, we will notify you and the Data Protection Board as the DPDP Act requires. If you believe you have found a vulnerability, write to help@lexoradv.com.

We set cookies that are strictly necessary to keep you signed in and to keep your session secure. We do not use advertising cookies, and we do not run third-party analytics, so there is nothing here to opt out of. Clearing these cookies signs you out.

The platform is not intended for anyone under 18. We do not knowingly create accounts for children. If you believe a child has registered, write to us and we will remove the account.

If you are unhappy with how we have handled your personal data, contact our Grievance Officer:

grievances@lexoradv.com
202, Maphar Eleganza Maaz, Mithila Nagar, Banjara Hills, Hyderabad 500034

We acknowledge complaints within 24 hours and aim to resolve them within 15 days, the periods set by rule 3(2) of the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021. If you remain dissatisfied, you may complain to the Data Protection Board of India.

If your complaint concerns an advocate’s professional conduct rather than their handling of data, that is a matter for the State Bar Council with which they are enrolled. We will tell you which one that is.