Privacy Policy

This Privacy Policy explains how OmniMorph Private Limited ("OmniMorph", "we", "us") collects, uses, stores and shares personal data when you use Jurisly, including the website at jurisly.omnimorph.org, the web application at app.jurisly.omnimorph.org, and the Jurisly applications for Windows and Android (together, "Jurisly").

OmniMorph Private Limited is a company incorporated in India (CIN U62013WB2025PTC279832, GSTIN 19AAECO7446B1ZF) with its office at 4th Floor, Room 3 & 4, A/4/3, Sucharu Residency, Hussain Road, Kuikota, Medinipur, Paschim Medinipur, West Bengal 721101, India.

This Policy is written to meet the Digital Personal Data Protection Act, 2023 and the rules made under it (together, the "DPDP Act"), the Information Technology Act, 2000 and the rules made under it, and, for users in the European Economic Area and the United Kingdom, the GDPR and the UK GDPR.

1. Our role

For your account, profile, payment and usage data, OmniMorph decides why and how that data is processed. Under the DPDP Act we are the Data Fiduciary for it; under the GDPR we are the controller.

Law firms use Jurisly to store and work on their matters. The case files, documents, client details and other material a firm puts into Jurisly belong to that firm, and the firm decides how they are used. For that material the firm is the Data Fiduciary (or controller) and OmniMorph processes it on the firm's behalf as its Data Processor (or processor), under our Data Processing Addendum. If you are a client of a law firm and have questions about how the firm handles your matter, please contact the firm directly. We will help the firm respond.

2. What we collect, why, how long we keep it, and who receives it

The table below lists each category of personal data, the purpose for which we use it, how long we keep it, and the parties it is shared with. Section 3 gives details of those parties.

We do not sell personal data, use it for advertising, or build advertising profiles. We do not use your data to train artificial intelligence models.

3. The parties we share data with

We share personal data only with the following service providers, to the extent each needs it to provide its part of Jurisly:

• Amazon Web Services (India, Mumbai region): hosts the Jurisly application, database and websites.
• Cloudflare (Asia-Pacific region): stores files for firms that use Jurisly Storage, and distributes the Windows and Android app downloads.
• Google: delivers Jurisly's emails through Gmail; provides Google sign-in; provides AI services through the Gemini API, including the search index; and, if you connect them, Google Drive and Google Calendar.
• Microsoft and Dropbox: if you connect OneDrive or Dropbox for storage.
• AI providers: Groq, Mistral AI, Sarvam AI and Google. If a firm adds its own API key, its AI requests go to the provider it chooses, which may include Anthropic or OpenAI.
• Serper: receives the search terms when the AI assistant searches the web.
• Razorpay (India): processes payments.
• OpenStreetMap Foundation: provides map images when a map is shown, and receives your IP address and the area of the map displayed.

AI and document-search features use third-party AI services. Content you send to these features, such as document text and questions, is processed by those providers under their own terms. Depending on the service tier, a provider may retain this content and use it to improve its services.

We may also disclose personal data where the law requires it, for example in response to a court order or a lawful request from a government authority, or to protect the rights and safety of our users or the public.

If OmniMorph is involved in a merger, acquisition or sale of assets, personal data may be transferred to the new owner, who will be bound by this Policy.

4. Where your data is processed

Our main systems are in India (AWS, Mumbai). Some of the providers listed above process data outside India, including in the United States, the European Union, the United Kingdom and elsewhere in the Asia-Pacific region. Transfers outside India are made in line with the DPDP Act. For personal data from the European Economic Area or the United Kingdom, we rely, where required, on the European Commission's standard contractual clauses and the UK addendum to them.

5. Consent

When you first use Jurisly, and again whenever we make a material change to this Policy or the Terms of Service, we ask you to confirm that you are 18 or older and agree to the Terms of Service and this Privacy Policy. The checkbox is not ticked for you. You cannot use Jurisly without giving this consent.

Your device asks your permission separately before Jurisly can use its location. You can refuse and type an address instead, and you can withdraw that permission at any time in your device settings.

You can withdraw your consent at any time from Profile, under Privacy and consent. Because Jurisly cannot work without the data described above, withdrawing consent deletes your account (see section 7). You can also withdraw consent by writing to our Grievance Officer. Withdrawal does not affect processing that took place before it.

6. Your rights

Under the DPDP Act you have the right to:

• obtain a summary of the personal data we process about you and the processing activities, and the identities of those we have shared it with;
• have inaccurate or incomplete data corrected, completed or updated;
• have your personal data erased, unless we must keep it to comply with the law;
• withdraw consent;
• have your grievances redressed; and
• nominate another person to exercise these rights if you die or become unable to exercise them.

You can correct most data yourself in the app. For anything else, write to our Grievance Officer (section 11). We will respond within 30 days. You may also complain to the Data Protection Board of India after using our grievance process.

If you are in the European Economic Area or the United Kingdom, you also have the rights described in section 12.

7. Deleting your account

You can delete your account from Profile in the app, or from the consent screen. When you delete your account:

• your account, profile, AI conversations, Forum posts, connected-account tokens and support requests are deleted;
• if you own a firm, the firm and all of its cases, files stored in Jurisly Storage, search index and members' access are deleted. Firm owners should export anything they need first;
• files in your own Google Drive, OneDrive or Dropbox are not deleted. They stay in your account with that provider;
• if you are a client, a case that a firm has accepted stays with that firm as part of its records, which the firm controls; and
• payment and tax records are kept for the period the law requires.

Deleted data can remain in our database backups until those backups expire or are deleted.

8. Security

We protect personal data with measures that include encrypted connections (TLS), encryption of stored access tokens and API keys, role-based access controls within each firm, and restricted internal access. Jurisly staff can see account, firm and billing details to provide support and administer the service, but cannot open case files or AI conversations through our administration tools. We keep backups of our database to recover from failures.

No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

9. Personal data breaches

If a personal data breach occurs, we will inform the Data Protection Board of India and each affected person without delay, and send the Board a detailed report within 72 hours of becoming aware of the breach, as the DPDP Act requires. Where the GDPR applies, we will notify the relevant supervisory authority and affected people as it requires. Where the breach concerns data we process for a law firm, we will notify the firm as set out in the Data Processing Addendum.

10. Cookies and similar technologies

Jurisly uses only what it needs to work:

• a short-lived cookie that protects Google sign-in against forgery, which expires after ten minutes; and
• your browser's local storage, to keep you signed in and remember preferences such as your last screen.

We do not use advertising or analytics cookies, so we do not ask for cookie consent. If we add any non-essential cookies, we will ask for your consent first.

11. Grievance Officer

Our Grievance Officer handles questions, requests and complaints about personal data, as required by the DPDP Act and the Information Technology Act, 2000:

Megha Ojha, Director, OmniMorph Private Limited Email: ojhamegha5@omnimorph.org WhatsApp: +91 70291 55079 Address: as at the top of this Policy

We acknowledge complaints within 24 hours and resolve them within 15 days.

12. Users in the European Economic Area and the United Kingdom

If the GDPR or the UK GDPR applies to you, OmniMorph is the controller of the data described in section 1 and relies on the following legal bases:

• performance of our contract with you, to provide Jurisly;
• our legitimate interests, to keep Jurisly secure, prevent misuse and improve the service;
• your consent, where we ask for it (for example, device location); and
• legal obligation, to keep payment and tax records.

You have the rights of access, rectification, erasure, restriction of processing, data portability and objection, and the right to withdraw consent at any time. You can exercise them by writing to our Grievance Officer. You may also complain to the data protection supervisory authority where you live or work.

13. Google user data

If you connect a Google account, Jurisly asks only for:

• Google Calendar (calendar.events): to add the events you create in Jurisly to your primary Google Calendar, update or delete them when you change them in Jurisly, and show your upcoming Google Calendar events so you can choose which to import into a case. Jurisly only edits or deletes events it created.
• Google Drive (drive.file): to create, read and update the case files Jurisly stores in your Drive. Jurisly can see only files it created or that you open with it, not the rest of your Drive.
• Basic profile (name, email address): to sign you in and show which Google account is connected.

Google user data is used only to provide these features to you. We do not sell it, use it for advertising, or use it to train AI models. Text from Drive files is processed through Google's Gemini API to provide document search and AI features, as described in section 3.

Jurisly's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

You can disconnect Google Calendar or Google Drive in Jurisly at any time, or remove Jurisly's access at myaccount.google.com/permissions.

14. Children

Jurisly is only for people aged 18 or older. We do not knowingly process the personal data of anyone under 18. If you believe a child has used Jurisly, contact our Grievance Officer and we will delete the account.

15. Changes to this Policy

We will update the date at the top of this Policy whenever we change it. If we make a material change, we will tell you by email or in the app and ask you to accept the updated Policy before you continue using Jurisly.