Legal
Privacy Policy
Draft for review by counsel before the public launch.
Who we are
PetitionOS is operated by Tavra Labs Private Limited, Rajarajeshwarinagar, Bangalore, Karnataka, India ("Tavra Labs", "we", "us"). We are the Data Fiduciary for the personal data described here, under the Digital Personal Data Protection Act, 2023 ("DPDP Act").
The short version
- Case facts, party details, paragraphs and scanned documents you put into PetitionOS stay in your browser on your device. They are not sent to our servers.
- We process a small amount of personal data to let you sign in and to answer enquiries.
- We do not sell personal data, show advertising or use advertising trackers.
Case data stays on your device
Typesetting, page numbering and PDF assembly run inside your browser. Drafts are autosaved in your browser's storage (IndexedDB) on that device, and you can download a project file. We cannot see, access or recover this data. Clearing your browser data deletes drafts that you have not saved as a project file, so keep project files for cases you need.
You are responsible for the case data you handle in PetitionOS, including any duty of confidentiality you owe to your clients.
What we collect and why
| Data | Purpose | Kept for |
|---|---|---|
| Google account email, name and profile picture, received when you sign in with Google | To check that your account is invited, keep you signed in, and allow one active session per account | Session: up to 12 hours or until you sign out. Invitation list: while you have pilot access |
| Demo and enquiry form: name, email, phone (optional), role, chamber, city, message | To reply to you and arrange a demo or pilot access | Up to 24 months after our last exchange, unless you ask us to delete it sooner |
| Aggregated visit statistics via Cloudflare Web Analytics (no cookies, no cross-site tracking) | To understand which pages are used | As retained by Cloudflare in aggregate form |
| Technical logs (IP address, browser type) kept by our hosting provider | Security, abuse prevention and fixing faults | Short-term, as set by the provider |
We process this data on the basis of your consent (the enquiry form and signing in) and for legitimate uses permitted under the DPDP Act, such as keeping the service secure.
Cookies and browser storage
We set one essential cookie, pos_session, after you sign in. It is HttpOnly, secure and expires within 12 hours. Signing in with Google and the enquiry form's spam check (Cloudflare Turnstile) are provided by Google and Cloudflare and may set their own cookies under their policies. Drafts are kept in your browser's IndexedDB storage, as described above. We use no advertising or analytics cookies.
Service providers
We share personal data only with providers that help us run PetitionOS: Cloudflare, Inc. (hosting, sign-in sessions, enquiry storage, spam protection and analytics) and Google LLC (sign-in). Some of them may process data outside India. When we turn on enquiry emails, an email delivery provider will carry the email to our inbox. We may disclose data where the law requires it.
Your rights
Under the DPDP Act you may ask to access a summary of your personal data, correct or update it, have it erased, withdraw consent, and nominate another person to exercise your rights. Withdrawing consent for sign-in means we will remove your access. Write to the Grievance Officer below; we will respond within the time the law requires.
Security
Sessions are signed and checked on every request to the app, connections use HTTPS, and access to stored enquiries is limited to our team. No system is perfectly secure; if a breach affecting your personal data happens, we will notify you and the Data Protection Board of India as the law requires.
Children
PetitionOS is meant for legal professionals. We do not knowingly collect personal data from anyone under 18.
Grievance Officer
Adv. Krishna Kashyap, Tavra Labs Private Limited, Rajarajeshwarinagar, Bangalore, Karnataka, India. Email: advocatekrishnakashyap@gmail.com. Phone: +91 74834 53561. If you are not satisfied with our response, you may approach the Data Protection Board of India.
Changes
We will update this page when our practices change and revise the date above. For material changes we will tell signed-in users in the app.