Last updated: 20 May 2026 · Effective: 20 May 2026
This Privacy Policy explains how Cognexiaai LLP("Cognexia AI", "we", "us", "our") collects, uses, shares and protects your personal data when you use the Cognexia AI Legal platform ("Platform", "Service"). This Policy applies to all users globally and is designed to comply with:
Cognexiaai LLPis an Indian technology company incorporated under the Companies Act 2013. We operate the Cognexia AI Legal platform ("CAILegal") — an AI-powered legal intelligence SaaS product available globally at cognexiaailegal.com.
Data Controller / Data Fiduciary
Cognexiaai LLP
Cognexia AI, India
Email: privacy@cognexiaai.com
Data Protection Officer: dpo@cognexiaai.com
We collect the following categories of personal data:
Account Data
Full name, email address, password (hashed), country of registration, plan tier, subscription status, account creation date.
Usage & Query Data
Legal queries you submit to the platform, tool inputs (facts, jurisdiction, documents), AI-generated responses, session history.
Payment & Billing Data
Payment method details (processed by Razorpay — we do not store card numbers), subscription plan, transaction history, invoices.
Technical Data
IP address, browser type and version, device type, operating system, time zone, referring URL, pages visited, session duration, error logs.
Advocate Marketplace Data
For advocates: bar enrolment number, bar council, courts practised, specialisations, city/state, consultation fee, availability schedule, case statistics, reviews received.
Communication Data
Support tickets, contact form submissions, forum posts, questions and answers, appointment booking information.
Cookies & Analytics
Session cookies, authentication tokens, analytics identifiers (see Section 9).
⚠ Important: Do Not Enter Sensitive Personal Data
Please do not enter special categories of personal data (health, biometric, financial, criminal history, religious beliefs) into the platform unless strictly necessary for your legal query. We process such data solely on your instructions and do not use it for any other purpose.
| Purpose | GDPR Legal Basis | DPDP Act Basis |
|---|---|---|
| Service delivery | Contract performance (Art 6(1)(b)) | Contractual necessity |
| Billing & payment | Contract performance (Art 6(1)(b)) | Contractual necessity |
| Security & fraud prevention | Legitimate interests (Art 6(1)(f)) | Legitimate uses |
| Legal compliance | Legal obligation (Art 6(1)(c)) | Legal obligation |
| Analytics (anonymised) | Legitimate interests (Art 6(1)(f)) | Legitimate uses |
| Marketing emails | Consent (Art 6(1)(a)) | Consent of Data Principal |
| AI model improvement | Consent (Art 6(1)(a)) | Consent of Data Principal |
We share personal data only with the following categories of recipients:
Your legal queries are processed by Anthropic's Claude API to generate AI responses. Anthropic processes data under a Data Processing Agreement and does not use your data for training purposes.
Payment card data and transaction information for subscription billing. Razorpay is PCI-DSS compliant.
Backend infrastructure hosting. Our servers are operated on Railway's cloud platform.
Frontend web application hosting.
We may disclose data to courts, regulators, or law enforcement where required by applicable law, subject to legal review.
We do not sell your personal data to third parties. We do not share data with advertising networks or data brokers.
The CAILegal platform uses large language model (LLM) technology powered by Anthropic's Claude API to generate legal research, draft documents, analyse cases, and provide legal intelligence. Key disclosures:
After expiry of retention periods, data is securely deleted or anonymised. You may request earlier deletion (see Section 8 — Your Rights).
Depending on your country of residence, you have the following rights regarding your personal data:
Right of Access
Request a copy of all personal data we hold about you.
GDPR · DPDP · CCPA · UK GDPRRight to Rectification
Request correction of inaccurate or incomplete data.
GDPR · DPDP · UK GDPRRight to Erasure (Right to be Forgotten)
Request deletion of your personal data, subject to legal retention requirements.
GDPR · DPDP · CCPA · UK GDPRRight to Data Portability
Receive your data in a machine-readable format (JSON/CSV).
GDPR · DPDP · UK GDPRRight to Restrict Processing
Request we limit how we use your data while a dispute is resolved.
GDPR · UK GDPRRight to Object
Object to processing based on legitimate interests.
GDPR · UK GDPRWithdraw Consent
Withdraw consent for processing where consent was the basis.
GDPR · DPDP · CCPA · UK GDPRRight to Non-Discrimination
We will not discriminate against you for exercising privacy rights.
CCPA · DPDPRight to Nominate
Under DPDP 2023, you may nominate a person to exercise rights on your behalf in the event of death/incapacity.
DPDP (India)Grievance Redressal
File a complaint with our Grievance Officer (India) or Data Protection Officer (EU).
DPDP · GDPRHow to Exercise Your Rights
Email us at privacy@cognexiaai.comwith subject line "Privacy Rights Request". Include your full name, email address, and the specific right you wish to exercise. We will respond within 30 days (GDPR) / 21 days (DPDP Act India) / 45 days (CCPA).
We implement the following security measures to protect your personal data:
In the event of a personal data breach that risks your rights and freedoms, we will notify affected users and the appropriate supervisory authority within 72 hours (GDPR requirement) or within prescribed timeframes under applicable national law.
The CAILegal platform is intended for professional and legal use by adults aged 18 and above. We do not knowingly collect personal data from children under 18 years of age. If you believe a child has provided personal data to us, please contact us at privacy@cognexiaai.com and we will promptly delete such data.
As an Indian company, Cognexia AI is a Data Fiduciary under the DPDP Act 2023. We comply with all obligations including:
Grievance Officer (India): grievance@cognexiaai.com · Response within 21 days
Data Protection Board of India: You may file a complaint with the Board if your grievance is not resolved.
If you are located in the European Economic Area (EEA) or the United Kingdom, the following additional provisions apply:
If you are a California resident, the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA) apply. Additional rights include:
General Privacy Queries
privacy@cognexiaai.comFor privacy questions, data subject requests, consent withdrawal.
Data Protection Officer (DPO)
dpo@cognexiaai.comFor GDPR / DPDP Act DPO contact, breach notifications, regulatory matters.
Grievance Officer (India — DPDP)
grievance@cognexiaai.comFor complaints under the DPDP Act 2023. Response within 21 days.
Changes to this Policy: We may update this Privacy Policy from time to time. We will notify you of material changes by email and by posting a notice on the platform at least 30 days before the changes take effect. Your continued use of the Service after the effective date constitutes acceptance of the updated Policy.