Data Privacy Policy

1. What Information Do We Collect

We collect only the categories of personal data set out below, and only for the purposes stated against each. We do not collect any category of personal data beyond what is necessary for the stated purpose.

1.1 Information You Provide to Us

This notice is provided to you at or before the time your consent is sought. It is available in English; a version in a language listed in the Eighth Schedule to the Constitution of India will be made available on request.

1.2 Non-identifying and aggregated information

We may generate aggregated or de-identified statistics (for example, task volumes by court) that cannot reasonably identify you. Such information is not treated as personal data. Where we combine it with personal data, we treat the combined information as personal data.

1.3 Information collected automatically

When you use the Platform we automatically collect limited technical information (device and app identifiers, IP address, and diagnostic logs) to keep the Service secure, deliver notifications, and diagnose problems. LLevo does not use third-party advertising networks, does not serve behavioural advertising, and does not sell your personal data.

1.4 Third-party processors we rely on

We use a small number of trusted third parties strictly to run the Service. Each is engaged as a Data Processor under a contract requiring safeguards consistent with this Policy (s.8(2)):

Google Firebase (Cloud Messaging): delivery of push notifications. Resend: delivery of email verification and sign-in codes. Razorpay: payment processing. Cloudflare R2: secure storage of uploaded documents (private buckets; files are only ever served back through an authorised, access-controlled route). Expo / push-notification infrastructure: delivery of task notifications to your device.

1.5 Do Not Track

The Platform does not currently respond to browser "Do Not Track" signals, as no consistent industry standard exists. As noted above, we do not track you across other websites or apps for advertising.

1.6 Children

The Platform is intended only for individuals who are 18 years of age or older. We verify age at account creation and do not knowingly collect the personal data of anyone under 18. This is addressed further in Section 10 (Children's Data), in line with s.9 of the DPDP Act.

2. How We Use Your Information and Our Lawful Grounds

2.1 How we use the information collected: To create and operate your account, and to verify your phone number, email, professional identity (advocates) and government identity (runners). To provide the Service, matching tasks to approved runners, enabling document upload and download for a task, and tracking task completion. To process payments, settle runner earnings, and apply the platform commission, the one-time runner registration fee, and cancellation penalties. To send you essential service communications and notifications about your tasks. To keep the Platform secure; preventing fraud, impersonation and abuse, including the manual review of runner Aadhaar documents before approval. To respond to your queries and grievances and to comply with our legal obligations. For any other purpose disclosed to you at the time of collection and to which you consent.

2.2 Lawful grounds of processing (DPDP Act): We process personal data only on the following lawful grounds recognised under the DPDP Act: (a) Consent, for processing that is not strictly necessary to the core Service (for example, optional communications). (b) Certain legitimate / voluntary uses (s.7(a)), where you voluntarily provide data to obtain a specific Service, such as posting a task or applying to be a runner, and have not indicated that you do not consent to that use. (c) Legal necessity (s.17(1)), processing of court documents and case data necessary to complete a court-related ministerial task or to enforce a legal right, or in connection with a function of a court or tribunal. (d) Legal obligation, processing necessary to comply with applicable law or a valid request from a court, tribunal or law-enforcement authority.

2.3 Consent: Where consent is our basis for processing, we seek consent through a clear affirmative action (for example, an unticked checkbox), never through a pre-ticked or bundled option. Consent is sought separately for each distinct purpose, in clear and plain language, together with the contact details of the Grievance Officer (Section 16). Your consent is free, specific, informed, unconditional and unambiguous. You may withdraw consent at any time, with the same ease with which it was given, through the Platform or by writing to the Grievance Officer. Withdrawal does not affect the lawfulness of processing carried out before withdrawal, and you bear the consequences of withdrawal (for example, an active task may not be completed, or a runner who withdraws identity-verification consent can no longer accept tasks). On withdrawal, we will, within a reasonable time, stop processing your personal data for that purpose and direct our Data Processors to do the same, unless further processing is required or authorised by law.

3. Data Retention and Erasure

We retain personal data only for as long as necessary to fulfil the purpose for which it was collected, or as required by law.

Runner Aadhaar / identity-verification documents: retained only while the runner account is active and required for ongoing fraud-prevention, and erased when the runner account is deleted or verification consent is withdrawn, subject to any legal-retention requirement below. These documents are access-restricted to authorised administrators.

Advocate Bar Council enrolment / Bar ID: retained only while the advocate account is active and required to verify professional identity and eligibility to post tasks on the Platform, and erased when the advocate account is deleted or verification consent is withdrawn, subject to any legal-retention requirement below.

Court documents and case data: retained for the duration of the task and a limited period thereafter for dispute resolution and audit, then erased.

Consent-based processing: where processing is based on your consent, we erase the relevant personal data within 30 days of your withdrawing consent, unless retention is required by law.

Dormant accounts: where you have neither used the relevant Service nor exercised any right in relation to it for a continuous period of 24 months, we treat the purpose as no longer served and erase the personal data, subject to legal-retention needs.

Legal retention: we may retain information (for example, financial, tax and KYC records) beyond the above periods where required for legal compliance, dispute resolution, fraud prevention, audit or enforcement of legal rights, and only for as long as reasonably required.

Processors: we direct our Data Processors, including runners and service providers, to erase personal data made available to them once the assigned task is complete, subject to the exceptions above.

4. Sharing and Disclosure

We do not sell your personal data. We share it only in the limited circumstances below.

4.1 Sharing with runners and service providers: We share limited information with the assigned court runner strictly on a need-to-know basis, solely to complete the specific task, under a contract requiring the recipient to process the data only on our instructions, apply equivalent safeguards, and erase the data once the task is complete (consistent with s.8(2) and s.8(7)(b)). By design, we minimise this sharing: an advocate's identity is not disclosed to a runner while a task is merely available in the feed; it is revealed only once that runner has accepted (and is assigned to) the task. Access to an advocate's uploaded case documents is withheld from a runner during the short cancellation window after they accept, so a runner cannot obtain the documents and then abandon the task. An advocate's Bar Council enrolment number / Bar ID is used solely for internal verification of professional identity and is not disclosed to runners or other users.

4.2 Third-party service providers: We engage the processors listed in Section 1.4 (Firebase, Resend, Razorpay, Cloudflare R2, Expo) to perform Service-related functions on our behalf. They may access personal data only to perform those functions and are bound by written data-processing terms.

4.3 Legal and investigation purposes: We may disclose personal data to a court, tribunal, government or law-enforcement authority where required by law, a valid legal request, or to enforce a legal right, protect the safety of any person, or prevent fraud or unlawful activity, consistent with s.17 of the DPDP Act.

4.4 Business transfers: In a merger, acquisition, restructuring or sale of assets, user information may transfer to a successor entity, provided that entity is bound by obligations substantially similar to this Policy and subject to any notice required by law.

5. Security Safeguards

We implement appropriate technical and organisational measures to protect personal data in our possession or control, including data processed on our behalf by a Data Processor, in accordance with s.8(5) of the DPDP Act. These include: encryption of data in transit and at rest; private document storage served only through an authorised, access-controlled route; role-based access control; two-factor authentication and session-revocation controls for administrative access; and restriction of runner Aadhaar / identity documents to authorised administrator review only. No method of transmission or storage is completely secure, but we take reasonable steps to protect your data and to review our practices periodically.

6. Data Breach Notification

In the event of a personal data breach, we will take prompt remedial and mitigation measures and notify the Data Protection Board of India and each affected user without undue delay, describing the nature of the breach, the personal data affected and the mitigation steps taken, in the form and manner prescribed under the DPDP Act and the rules made thereunder (s.8(6)).

7. Your Rights as a Data Principal

Subject to the DPDP Act, you have the right to: (a) Access, a summary of the personal data we process about you, the processing activities, and the identities of other Data Fiduciaries / Data Processors with whom it has been shared. (b) Correction, completion and updating of inaccurate, incomplete or misleading personal data. (c) Erasure of your personal data, subject to Section 3. (d) Withdrawal of consent at any time, as described in Section 2.3. (e) Grievance redressal, as described in Section 16. (f) Nomination, to nominate an individual to exercise your rights in the event of your death or incapacity.

To exercise any right, write to the Grievance Officer (Section 16). We will acknowledge and respond within the period prescribed under the DPDP Rules (and in any event as soon as reasonably practicable).

8. Cross-Border Data Transfer

Personal data may be stored or processed on servers located within or outside India (for example, our storage and communication partners), in accordance with s.16 of the DPDP Act. We will not transfer personal data to any country or territory that the Central Government restricts by notification. Where data is transferred outside India, we require our processors to apply safeguards consistent with this Policy.

9. Duties of the Data Principal

While using the Platform and exercising your rights, you agree to: comply with applicable law; not impersonate another person; not suppress material information when providing any document, unique identifier, proof of identity or proof of address; not register a false or frivolous grievance; and furnish only verifiably authentic information when exercising the right to correction or erasure (s.15).

10. Children's Data and Age Restriction

The Platform is intended for advocates, court runners and service providers who are 18 years of age or older. We verify age at account creation and do not knowingly collect or process the personal data of anyone under 18, nor undertake tracking, behavioural monitoring or targeted advertising directed at children (s.9). If we learn that we have inadvertently collected a child's data without verifiable parental / guardian consent, we will erase it promptly. If you believe a minor has provided us data, contact the Grievance Officer.

11. Artificial Intelligence and Automated Processing

LLevo does not currently use artificial intelligence to process your uploaded documents or personal data, and does not make any decision producing a legal or similarly significant effect on you without meaningful human review (for example, runner approval is a manual human decision). Should we introduce AI-assisted features in future, we will seek your specific, separate consent, will not use your personal data or documents to train any public or third-party AI model, and will bind any AI vendor by a data-processing agreement with equivalent safeguards.

12. Significant Data Fiduciary Readiness

LLevo is not currently notified as a Significant Data Fiduciary under s.10 of the DPDP Act. Should it be so notified, it will appoint a Data Protection Officer based in India and an independent data auditor, and undertake periodic Data Protection Impact Assessments and audits, as required.

13. Consent Manager

Where you choose to give, manage, review or withdraw consent through a Consent Manager registered with the Data Protection Board of India, we will act on instructions received through that Consent Manager in accordance with the DPDP Act (s.6).

14. Electronic Communications

You consent to receive service-related and legal notices electronically through the Platform, email, SMS or push notification. You may manage optional communication preferences in the Platform settings, except for essential service and legal notices, which we will continue to send regardless of preference.

15. Changes to this Policy

LLevo reserves the right to update, revise, or modify this Policy from time to time at its sole discretion, to reflect changes in law, the DPDP Rules, or our practices. Material changes will be notified through the Platform, email or SMS, together with the updated effective date. Continued use of the Platform after such notice constitutes acknowledgement of the updated Policy.

16. Grievance Officer and Contact Us

If you have any question, request or grievance about this Policy or your personal data, contact: Name / Designation: Rosy Bhatia, Grievance Officer, LLevo. Email: Rosy.bhatia28@gmail.com. Address: 46-D, GH-10, Paschim Vihar, New Delhi.

We will acknowledge and respond to grievances within the period prescribed under the DPDP Act and the rules made thereunder. If you are not satisfied with our response, you may approach the Data Protection Board of India after exhausting this grievance mechanism.

17. Governing Law

LLevo processes personal data in accordance with the Digital Personal Data Protection Act, 2023, the rules and amendments issued thereunder, and other applicable laws of India. This Policy is governed by the laws of India.