Privacy Policy

This Policy forms part of our Terms and Conditions and is the document referred to in Clause 11 of those Terms.

---

In brief

The full text governs. This is what it says.

• We collect the minimum needed to run the service.
• Your research queries are the most sensitive thing we hold. What a person searches for is a record of what is happening in their life. We treat it accordingly.
• We do not sell, rent or trade your information, and we do not build advertising profiles.
• We do not use your private research to train shared models.
• You can choose not to provide information, and withdraw consent later.
• You can delete your account and your data, from inside the app or by writing to us.
• Our Grievance Officer answers within 48 hours and redresses within one month.

---

1. Who we are and what this Policy covers

This Policy is published by TLY SOFT PRIVATE LIMITED, a private company limited by shares incorporated under the Companies Act, 2013, bearing Corporate Identity Number U62013DC2026PTC473011, having its registered office at Innov8 Harsha Bhawan, 4th Floor, 13/29 E-Block, Connaught Place, New Delhi 110001, India, which operates the Platform under the brand and product name Vitark ("Vitark", "we", "us").

It applies to information collected through vitark.ai, through the Vitark mobile applications, and through any interface by which we make the Platform available (together, the "Platform").

It is published in line with the Information Technology Act, 2000 and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 (the "SPDI Rules"). It sets out the type of information we collect, the purposes for which we collect and use it, to whom it may be disclosed, how long it is retained, and the security practices we apply.

2. The information we collect

2.1 Sensitive personal data or information

Under Rule 3 of the SPDI Rules, certain categories are treated as sensitive personal data or information. Of those categories, we collect:

• Passwords. Stored only in hashed form. We never hold your password in readable form and cannot recover it for you.
• Financial information, limited to payment-related metadata returned by our payment gateway, such as transaction identifier, amount, date, instrument type and the last four digits.

We do not collect biometric information, medical records or history, information about physical, physiological or mental health condition, or information about sexual orientation, as data fields.

An important qualification. We do not ask for those categories, but a research query can contain them. A user researching a medical negligence claim, a matrimonial matter, or an offence under Section 377 or Section 376 of the Indian Penal Code may type facts about themselves into the search box. Where a query contains information of a sensitive character, we treat it as sensitive personal data or information and apply the protections in Section 4 and Section 8 of this Policy.

2.2 Other information you give us

We do not store full card numbers, CVV, UPI credentials or net-banking passwords. Payment is handled by our payment gateway, which is separately responsible for those.

2.3 Information collected automatically

Device and browser type, IP address, approximate location derived from IP at city level, pages visited, session timestamps, and error and performance logs.

2.4 The mobile application

Where you use the Vitark mobile application, we additionally collect:

• A device identifier, used to keep you signed in and to associate a purchase with your account.
• Crash reports and diagnostic logs, which may contain the screen you were on and the technical state of the application at the point of failure.
• Push notification tokens, where you enable notifications. You can turn notifications off in your device settings at any time.
• Store purchase records, where you subscribe through the Google Play or Apple app stores. The store, and not Vitark, processes the payment and tells us only that a valid subscription exists.

We do not collect your precise location, your contacts, your photographs, your microphone or camera input, your calendar, your device files, or a list of applications installed on your device. We do not use advertising identifiers and we do not share information with advertising networks or data brokers.

The itemised position, in the categories the app stores use, is at Annexe A.

2.5 What we do not want

We do not ask for and do not want your Aadhaar number, PAN, or any government identity document, unless a specific institutional arrangement requires it and you are told separately at that point.

Please do not paste identity documents into the search box. If you do, delete the query from your history and write to us at ask@vitark.ai so that we can remove it from our logs.

3. Why we collect it

We collect information only for lawful purposes connected with our function of providing the Platform, and only where the collection is necessary for that purpose.

4. Your research queries

A list of what somebody searched on a legal research platform is a list of their problems. "Bail." "Domestic violence remedies." "Wrongful termination." "Child custody."

We treat query data as the most sensitive category we hold, and specifically:

• Basic research does not require an Account. You can use the Platform without logging in, and unauthenticated research is not linked to an identity.
• We do not publish, display or share any user's research history, individually or in aggregate, in marketing, case studies, demonstrations or investor material.
• We do not use your private research content to train shared models.
• Queries of a sensitive character are subject to elevated access controls, meaning fewer staff can access them and access is logged.
• You can delete your search history from your Account at any time. Deletion removes it from active systems within 30 days and from backups within 90 days.

5. Consent, and your choice not to provide information

We collect information with your consent, given when you create an Account, make a payment, or submit information to the Platform.

You may decline. You are not obliged to provide any information. Where you decline to provide information that is necessary for a particular function, we may be unable to provide that function. Basic research remains available without an Account.

You may withdraw consent at any time by writing to ask@vitark.ai. On withdrawal we will stop processing for the relevant purpose and delete the information, unless we are required by law to retain it. Withdrawal does not affect processing already carried out. Where consent is withdrawn in respect of information necessary to operate your Account, we will be unable to continue providing the service and the Account will be closed.

You may review and correct the information we hold about you, and ask us to correct anything inaccurate or deficient, by writing to ask@vitark.ai.

6. Who we disclose it to

We do not sell, rent or trade your information.

We disclose information only to:

• Our payment gateway, to take payment and process refunds.
• The Google Play and Apple app stores, where you subscribe through them, limited to what the store requires to operate the subscription.
• Cloud hosting and infrastructure providers, who store and serve the Platform.
• Artificial-intelligence service providers, who process queries and associated research content in order to generate the responses you request, strictly to provide that response and under contracts that prohibit the use of your content to train their models.
• Communications providers, to send transactional email and messages.
• Third-party knowledge partners, as described in Clause 4 of the Terms and Conditions, strictly on a need-to-know basis and only for the purpose of providing the information you have requested.
• Professional advisers, where necessary and under a duty of confidence.
• Government agencies, where mandated by law, and to any other party where required by a court order or other lawful demand.

Each provider is engaged under a written contract which restricts it to our purposes, requires it to provide the same or an equal level of protection for your information as this Policy provides, and prohibits further disclosure.

Change of control. If the business is acquired or merges, information may transfer as part of that transaction. You will be told, and the acquirer will be bound by this Policy until it is lawfully replaced.

7. Transfer outside India

Information may be stored or processed on infrastructure located outside India. Any such transfer is made only where necessary for the performance of our contract with you or with your consent, and only to a recipient that maintains the same level of data protection as is required under Indian law.

8. Security

We implement and maintain reasonable security practices and procedures, comprising a documented information security programme and information security policies containing managerial, technical, operational and physical control measures commensurate with the information being protected.

These include encryption of information in transit, hashing of stored credentials, role-based access controls, access logging, and periodic review.

If a security incident occurs, we will investigate, contain it, notify affected users and notify the relevant authorities where required. We will tell you what happened, what information was involved, what we have done, and what you should do.

No system is perfectly secure. Please use a strong and unique password, and tell us immediately at ask@vitark.ai if you suspect unauthorised access to your Account.

9. How long we keep it

We do not retain information for longer than is required for the purpose for which it was collected, or as required by law. When a retention period ends, information is deleted or irreversibly de-identified.

10. Deleting your account and your data

You can delete your Account at any time.

• In the app: Settings, then Account, then Delete Account.
• On the web: your Account settings page.
• Without the app, and without signing in: write to ask@vitark.ai from your registered email address, or follow the steps at vitark.ai/delete-account.

Deleting your Account deletes your profile, your research history, your saved matters and your notes. A small set of records is retained where the law requires it, principally invoices and grievance correspondence, and those are described in Section 9 and in the deletion policy.

The full route, what is deleted, what is kept and for how long, is set out in our Account and Data Deletion Policy.

11. Children

The Platform is intended for users aged 18 and over. A minor may use the Platform only under the supervision of a parent or legal guardian who has accepted the Terms on the minor's behalf.

We do not undertake behavioural profiling or targeted advertising directed at children.

If you believe a minor has created an Account without supervision, write to ask@vitark.ai and we will act.

12. If you take part in our research

Separately from the Platform, we carry out field research: interviews, surveys and group discussions with people about their experience of legal problems.

That research is governed by a separate document, the Research Participant Notice and Consent, not by this Policy. It sets out what a participant is asked, how their words are anonymised, what may be published, and how to withdraw. Taking part is voluntary and unconnected to your use of the Platform.

If you have taken part in our research and wish to withdraw, the route is in that notice.

13. Information appearing inside judgments

This Policy governs information about you as a user of the Platform. It does not govern your name appearing inside a published court judgment, because that is the court's record and not information we have collected from you.

If you are named in a judgment on the Platform, please see the Suppression and Redaction Policy, which sets out a separate route, including immediate suppression where an identity is protected by statute or by direction of a court.

14. Grievance Officer

Any discrepancy or grievance in relation to the processing of information may be raised with:

Grievance Officer: Hemant Chhabra

Email: grievance@vitark.ai

Postal: TLY SOFT PRIVATE LIMITED, Innov8 Harsha Bhawan, 4th Floor, 13/29 E-Block, Connaught Place, New Delhi 110001

Acknowledgement: within 48 hours of receipt.

Redressal: within one month from the date of receipt of the grievance.

These timelines match Clause 17 of the Terms and Conditions.

15. Cookies

We use cookies and similar technologies for functions that are strictly necessary (keeping you logged in, security, load balancing), for preferences (language and display settings), and for analytics (understanding aggregate usage).

We do not use advertising or cross-site tracking cookies.

You can control cookies through your browser. Blocking strictly necessary cookies will prevent the Platform from working.

16. Changes to this Policy

We may update this Policy. Material changes, meaning changes that reduce your rights or expand our processing, will be notified by email at least 15 days before they take effect, and you may close your Account before the change applies.

The "Last Updated" date above reflects the current version.

17. Contact

All queries, including privacy, grievances, refunds and billing: ask@vitark.ai

Postal: TLY SOFT PRIVATE LIMITED, Innov8 Harsha Bhawan, 4th Floor, 13/29 E-Block, Connaught Place, New Delhi 110001

---

Annexe A: What we collect, itemised

This annexe states, item by item and in the categories the app stores use, what the Platform collects. "Collected" means it leaves the device and reaches us or a processor. "Linked to you" means it is associated with your identity or Account. No data we collect is used for tracking, meaning it is not used to follow you across other companies' apps or websites for advertising.

Three declarations that follow from the table, and that must remain true:

1. No data is used for tracking, as the app stores define tracking. We do not share any identifier with an advertising network or a data broker.
2. Data is encrypted in transit.
3. You can request deletion of your data, and the route does not require reinstalling the application. See Section 10 and the Account and Data Deletion Policy.

---

TLY SOFT PRIVATE LIMITED | CIN U62013DC2026PTC473011

Registered office: Innov8 Harsha Bhawan, 4th Floor, 13/29 E-Block, Connaught Place, New Delhi 110001

ask@vitark.ai | vitark.ai

This Policy is part of the Terms and Conditions for Vitark.ai. Use of the Platform constitutes acceptance of this Policy.