1. Who We Are
Zuris Digital Systems Private Limited (“Zuris”, “we”, “us”) provides the Zuris website (zuris.ai), app (law.zuris.ai) and related services. For personal data we decide how to use, we are the Data Fiduciary under India’s Digital Personal Data Protection Act, 2023 (DPDP Act).
This policy explains what we collect, why, who we share it with and the choices you have. It also follows the Information Technology Act, 2000 and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, which apply alongside the DPDP Act while its provisions come into force.
2. What We Collect
Each kind of data, and what we use it for:
- Account details — name, gender, email, mobile number, login ID, organisation and role. Used to create and run your account, sign you in and show your workspace.
- Sign-in details — your password (stored only as a one-way hash, never readable), one-time codes sent by email or SMS, and, if you choose Google sign-in, the name and email Google shares with us. Used to confirm it is you.
- Sign-ins and devices — the IP address, browser and time of each sign-in, your active devices, and failed or blocked attempts. Used to keep your account secure, let you see and sign out your devices, and investigate misuse.
- Billing and payment details — plan, invoices, amounts, billing address and GSTIN if you give it. For each payment attempt: the payment method (for example card type, the last four digits and issuing bank, or your UPI ID), the bank reference, the email and phone given at checkout, the IP address and browser used, and whether it succeeded or why it failed. Used to take payments, confirm them, issue invoices and refunds, answer billing questions and prevent fraud. Full card numbers, CVV, UPI PIN and net-banking passwords go to our payment provider and never reach us.
- Your content — documents, case records, case numbers (CNR) you look up, hearings, notes, whiteboards, drafts, research queries, translation requests and AI prompts and responses (“Customer Content”). It may include information about other people, such as clients or witnesses. Used only to provide the features you use (see section 4).
- Usage and error data — features used, usage counts against your plan (such as translation pages), and errors the app reports. Used to apply plan limits, fix problems and keep the service reliable.
- Messages — what you send us through support, sales or grievance channels, including attachments. Used to answer you.
3. How We Use It
Only for the purposes listed in section 2: to run your account and workspace, process the documents, translations and AI requests you make, manage billing and invoices, provide support, send service notices (such as sign-in codes, hearing reminders, payment confirmations and security alerts), prevent fraud and misuse, keep the service reliable, and meet our legal obligations.
We don’t use your data for advertising, and we don’t sell it. We send marketing messages only with your consent, and you can opt out at any time.
4. Your Content and Confidentiality
You keep ownership of your Customer Content. You give us a limited permission to store and process it only to provide, secure and support the service you use.
Workspaces are private by default. Access is limited to the users you authorise and to our staff only when needed to operate or support the service.
When you upload information about other people, you are responsible for having the right to do so and for your own professional duties of confidentiality and privilege.
5. AI Features
When you use an AI feature, the relevant text and documents are processed only to produce the result you asked for. Search and AI features run on models we host ourselves. Document translation is processed by Sarvam AI, in India. If we add another AI provider, we will list it here first.
We do not use your content to train AI models, and we do not allow our providers to, without your explicit, separate permission.
AI output can be wrong or incomplete. Check it before relying on it.
6. Who We Share It With
We share data only with providers that help us run Zuris, under contract and only for that purpose:
- Hosting and storage — Amazon Web Services, Hyderabad region (the app, its databases and your documents).
- Website — Cloudflare (delivers zuris.ai) and Google Fonts (fonts on zuris.ai; the app uses its own fonts).
- Payments — Razorpay, and the banks and card networks behind it, to take payments, refunds and prevent fraud.
- Email — Google Workspace, to send sign-in codes, notices and replies, and to receive your emails.
- SMS and WhatsApp — MSG91, to send sign-in codes and reminders to your mobile number.
- Google sign-in — Google, only if you choose to sign in with Google.
- Translation — Sarvam AI, for the text you ask us to translate.
- Courts — when you look up a case, we send its case number (CNR) or details to the court’s public website (such as eCourts) to fetch its status.
- Professional advisers — such as auditors and lawyers, when needed.
- Authorities — when the law, a court or a lawful government request requires it.
If Zuris is part of a merger or acquisition, data may transfer to the new owner under this policy. Links to other websites follow their own privacy policies.
7. Where Your Data Is Stored
The app, its databases and your documents are stored in India, in Amazon Web Services’ Hyderabad region. Some providers in section 6, such as Google (email) and Cloudflare (website), may process data in other countries. Transfers outside India follow the DPDP Act and any restrictions set by the Government of India. If your work needs data kept in a specific location, contact us before uploading it.
8. How Long We Keep It
- Account and content — while your account is active, then deleted within a reasonable period after closure, unless the law requires us to keep it.
- Free trials — if no plan is bought, sign-in stops when the trial ends, and 14 days later the trial workspace, its accounts and everything in it (documents, cases, notes, whiteboards) are permanently deleted. Accounts never set up after sign-up are deleted on the same schedule.
- Billing and payment records — at least 8 years, as tax and company laws require.
- Sign-in and security logs — at least one year, as the DPDP Rules, 2025 and CERT-In directions require.
- Backups — deleted data may remain in encrypted backups for a short time until they are overwritten.
9. How We Protect It
We use encryption in transit (HTTPS), encrypted storage for the files you upload, private file storage that only our servers can reach, hashed passwords, one-time-code sign-in, secure HttpOnly session cookies, device limits and session timeouts, access controls, sign-in monitoring, backups and restricted administrative access. No system is perfectly secure.
If a personal data breach occurs, we will act to contain it, tell affected users without delay through their account or email, and report it to the Data Protection Board of India and CERT-In within the times the law sets.
10. Your Data Privacy Rights
Under the DPDP Act, you have the right to:
- Access — a summary of your personal data we process and who we have shared it with.
- Correction and erasure — correct, complete or update your data, or have it erased when it is no longer needed.
- Withdraw consent — at any time, for processing based on consent. It doesn’t affect processing already done.
- Grievance redressal — raise a complaint with us and get a response.
- Nominate — name someone to exercise your rights if you die or become unable to.
- Complain to the Board — if you’re not satisfied with our response, approach the Data Protection Board of India.
To use any of these rights, including to withdraw consent, close your account or name a nominee, write to legal@zuris.ai from the email on your account, with your login ID. We may ask you to verify your identity, and we respond within 30 days. For data that a law firm or organisation uploaded to its own Zuris workspace, please contact that organisation first; we will help them respond.
11. Cookies and Local Storage
The app uses only essential cookies: a secure session cookie that keeps you signed in (until you close the browser, or 30 days with “Remember me”), short-lived cookies for the sign-in, password-reset and device-limit steps, an invite-code cookie when you join through a referral link, and a cookie that remembers your apps-page layout.
Browser storage on your device remembers display preferences (theme, text size, font, sidebar) and keeps your notebook and whiteboard working offline. Clearing it removes copies not yet synced.
We use no advertising, analytics or tracking cookies, on the website or in the app. If we ever add non-essential cookies, we will ask for your consent first. Blocking essential cookies stops sign-in working.
12. Children
Zuris accounts are for people aged 18 or over. We do not knowingly create accounts for anyone under 18; if we learn of one, we will close it. A child’s data in your case records is your Customer Content: upload it only when you have the legal authority and any consent the DPDP Act requires.
13. Public Legal Records
Judgments, statutes and court records on Zuris come from public and licensed sources. They may contain personal data published by courts and authorities. We show them for legal research; verify them against the official source before relying on them.
14. Changes to This Policy
We will post any update here with a new “Last updated” date, and tell you directly about material changes, or ask for consent where the law requires.
15. Contact and Grievance Officer
Grievance Officer — privacy, data rights and grievances:
legal@zuris.ai — subject “Privacy Request / Data Protection Grievance – Zuris”. We acknowledge each grievance and resolve it within 30 days.
Support: support@zuris.ai · Billing: billing@zuris.ai · General: info@zuris.ai
Zuris Digital Systems Private Limited
C-Block 403, Sri Venkateswara Residency, Beeramguda, Ameenpur, Ramchandrapuram, Medak – 502032, Telangana, India