Pundora Legaltech Private Limited

Privacy Policy

Last updated 12 November 2026

1. Introduction and scope

1.1 Pundora is built for advocates. The product exists so that you can use modern AI on client matters without compromising them. This policy says, in plain language, what we collect, where it lives, who can touch it, how long it stays, and what we will never do with it. If anything here is unclear, write to us and a person answers.

1.2 This policy applies to everyone who visits our website, joins the waitlist, or uses the Pundora application at app.pundora.in and the services offered through them (together, the “Services”), wherever they are located. It does not apply to third-party websites we link to, which have their own privacy notices.

1.3 This policy and our Terms of Use (linked in the footer of every page) are read together. At each point where we collect personal data (signing in, joining the waitlist, connecting WhatsApp), we show a short notice that links to this policy; that notice and this policy apply together.

2. Who we are, our role, and how to contact us

2.1 Pundora is operated by Pundora Legaltech Private Limited, a company incorporated in India (CIN: U74900DL2026PTC470096), with its registered office at Vasant Kunj, New Delhi. In this policy, “we”, “us” and “Pundora” mean that company; “you” means the advocate, chamber or firm using Pundora, and the people they invite into their workspace.

2.2 Our role depends on the data. For your account details, waitlist details, communications and technical records, we decide why and how the data is processed, and we are responsible for it under Indian data protection law. For the client content in your workspace (your case files and the work produced from them), we act only on your instructions and only to provide the Services to you, and you remain responsible for your professional and confidentiality obligations to your clients (see clause 18).

2.3 Contact: contact@pundora.in for the company; support@pundora.in for anything about your workspace, your data or your rights.

2.4 Grievance Officer: Abhijeet Dagar, Chief Executive Officer, Pundora Legaltech Private Limited, Plot No. B-154/5, Kh. No. 1922B, Vasant Kunj Enclave, New Delhi – 110070; email: support@pundora.in. Clause 17 explains how complaints are handled.

3. Definitions

3.1 “Personal data” means any data about an individual who is identifiable by or in relation to that data.

3.2 “Processing” means any operation performed on personal data, including collection, recording, storage, use, sharing, disclosure and erasure.

3.3 “Service provider” means a third party that processes personal data on our behalf and under our instructions.

3.4 “Child” means an individual below 18 years of age.

3.5 “Applicable law” means the Information Technology Act, 2000 and the rules made under it (including the Reasonable Security Practices and Procedures and Sensitive Personal Data or Information Rules, 2011 and the directions of the Indian Computer Emergency Response Team (CERT-In)), the Digital Personal Data Protection Act, 2023 and the rules made under it as their provisions come into force, and any other law of India that applies to our processing.

4. What we collect, and what we deliberately do not

4.1 Account details. Your name and email address as provided by the Google account you sign in with, your chamber or firm name, and your city. Pundora has no passwords of its own. Access is by invitation from a waitlist: a workspace is opened for your chamber when its turn comes.

4.2 Waitlist details. If you join the waitlist: your name and email address, and, if you give them, your WhatsApp number and your chamber and city. These are used only to write to you when your chamber can be let in, and are deleted on request.

4.3 Your work. The case files, documents, scanned pages and photographs you upload; the chronologies, calendar entries, deadlines, research answers, drafts, citation checks, exports and notes Pundora produces from them; the questions you ask about a matter; and anything you add by hand. This is your professional work product and your clients’ confidential information, and everything in this policy is written around that fact. It may contain personal data of your clients, opposing parties, witnesses and others, including sensitive personal data. You are responsible for having the right to upload it, and we process it only to provide the Services to you. We treat everything in your workspace as confidential and protect it as described in clause 14.

4.4 WhatsApp, if you connect it. Your WhatsApp number; the messages we send you (the evening digest, the evening check-in, and the short notices described in clause 9); and the messages, photographs and documents you send to Pundora’s number. If you change or disconnect the number, we keep a record of each number your workspace has used, when it was connected, changed or disconnected and by whom, and what our messages to it cost; that record is deleted with your workspace.

4.5 Communications. The contents of emails and support requests you send us, and our replies.

4.6 Technical records. Sign-in events, requests to our servers, IP address, browser type, device and operating system information, dates and times of access, errors, and the operational records needed to run the service safely and to meet Indian law (see clause 13). To improve Pundora we also count which screens are opened and whether a search or an answer found anything. These are counts only, never the question, the document or the answer; they are kept for 30 days and then summarised by week.

4.7 What we do not collect. We do not collect your date of birth, home address, identity documents, or anything else we do not need. We collect no payment details: Pundora is free to use until further notice (see the Terms of Use). We keep no advertising trackers, use no advertising cookies and no social-media pixels, and use no third-party analytics on client content.

4.8 Required and optional information. Signing in with a Google account, and your chamber or firm name and city, are needed to open a workspace; without them we cannot provide account-based features. Joining the waitlist, connecting WhatsApp and giving us your WhatsApp number on the waitlist are optional.

4.9 Contributors. If you write for Pundora: your name, email address, professional details and photograph that you choose to give, the articles and drafts you submit, and our correspondence with you. Your name, byline and biography are published with your articles, and published articles are public (see clause 11.6).

5. Why we use your data, and on what basis

5.1 We use personal data only for the purposes below.

5.2 We will not use your personal data for a purpose unrelated to those above without first telling you and, where required, obtaining your consent.

5.3 We do not train any model on your content. We do not use one chamber’s content for another chamber. Your files improve your own workspace (your formats, your vetted drafts), never another chamber’s and never a shared model. Where Pundora suggests a draft based on your earlier drafts, only the form of those drafts is reused across your matters, never the facts of one matter in another.

6. Consent and withdrawal

6.1 Where we rely on consent, we ask for it through a clear statement and an affirmative action, such as creating or joining a workspace, joining the waitlist, or connecting WhatsApp. Consent for one purpose is never bundled with consent for an unrelated purpose.

6.2 You may withdraw consent at any time, as easily as you gave it, by: (a) disconnecting WhatsApp from the profile menu in Pundora; (b) switching off the evening digest or the evening check-in on Today in Pundora; (c) deleting a draft, a matter or your whole workspace in Pundora; or (d) writing to support@pundora.in.

6.3 Withdrawal does not affect processing carried out before you withdrew. After withdrawal we will stop the relevant processing, and ask our service providers to stop, within a reasonable time, unless applicable law requires or permits us to retain or process the data.

6.4 If you withdraw consent needed for a core feature, such as holding a workspace, we may be unable to continue providing that feature to you.

7. Where your data lives, and what leaves India

7.1 Your workspace (documents, matters, calendars, drafts, research and WhatsApp messages) is stored on servers in India (Mumbai region), in your own encrypted, isolated workspace. Isolation means one chamber’s data is walled off from every other chamber’s by controls enforced in the database itself. Uploaded files are encrypted with a key that belongs to your workspace before they are written to storage. Scanned pages and photographs are read (turned into text) on a machine we operate ourselves in Mumbai, never by a cloud reading service.

7.2 In this version Pundora keeps no backup copy of its own. Our database provider keeps daily copies of the database for seven days, in the same Mumbai region, and those copies do not include the files you upload. Keep your own copy of every document you upload.

7.3 Three things leave India in the course of the service, and we say so plainly:

• AI processing. When an AI feature runs, the relevant text is sent to our AI provider, Anthropic, to produce the result (see clause 8). Anthropic stores what it receives on its systems in the United States, and under its standard settings, which Pundora uses, the processing itself may run in any of the regions where Anthropic operates.
• WhatsApp. Messages pass through Meta’s systems. The number is registered so that message content and media persist only in Meta’s India data centres (see clause 9).
• Error reports. When something in Pundora breaks, a report of the error, with your content removed, goes to our error-monitoring service, which stores it in the European Union (see clause 11).

7.4 We transfer personal data outside India only where it is necessary to provide the Services or you have consented, and where the recipient is bound to protect it. We will not transfer personal data to any country or territory to which transfers are restricted by notification of the Government of India.

8. How the AI part works: please read this section

8.1 When you use an AI feature (reading a case file into a chronology, asking a question about a matter or a research question, drafting a document, reviewing a draft, or checking what a draft says about the authorities it cites), the relevant text is sent to our AI provider, Anthropic, to produce the result, and the result comes back to your workspace.

8.2 Everything else Pundora does runs on our own systems without any AI provider: the calendar, the digest and every WhatsApp notice, exports, anonymising a draft, searches of the judgment corpus, and the verification that a cited judgment, section or quotation exists in the source text. Where the corpus comes from, and what a corpus lookup may send outside, is set out in clause 10.

8.3 Anthropic does not use content sent through its API to train its models. Under Anthropic’s standard terms, inputs and outputs are deleted from its systems within 30 days. We have applied for Anthropic’s zero-data-retention terms for Pundora’s account, under which nothing is retained after the result is produced. Until that is approved for our account, the 30-day standard applies, and this policy will be updated on the day it changes.

8.4 One exception, stated because you deserve to see it: if content is flagged by the provider’s automated trust-and-safety systems (for example, suspected abuse of the service), the provider may retain the flagged material for up to two years under its published policy. Apart from that, the provider keeps content beyond the periods above only where the law requires it; neither is an ordinary part of processing a legal matter.

8.5 AI outputs may be inaccurate or incomplete, including in ways that look convincing. They are prepared for your professional review and are not legal advice. We do not make decisions that produce legal or similarly significant effects about you solely by automated means: you review and confirm Pundora’s work, and no date reaches your calendar without your confirmation.

9. WhatsApp

9.1 You connect WhatsApp by typing your number in Pundora and typing back a one-time code that WhatsApp delivers to it; the code is never typed on WhatsApp. Once connected, Pundora sends you: an evening digest of tomorrow’s hearing cause-list and deadlines (or, on a court holiday, the deadlines still running); an evening check-in asking whether anything happened in a matter; and, at most a few times and each only once, a short notice (that yesterday’s hearing has no order filed yet, that tomorrow’s listings fall in two different courts, or that a newly published judgment cites an authority filed under one of your matters; Pundora says only that it cites it, never how). You can send Pundora photographs of orders, documents and typed updates, which are filed under the right matter for your confirmation. The evening digest and the evening check-in can each be switched off on Today in Pundora; switching off the digest also stops the short notices, which are sent with it. The number can be changed or disconnected from the profile menu at any time. Each notice is sent once and never repeated.

9.2 Messages between you and Pundora on WhatsApp pass through Meta’s WhatsApp Business Platform. That is how every business on WhatsApp works: Meta decrypts and forwards messages on the business’s behalf, and WhatsApp tells you inside the chat that the business uses Meta’s hosting. For that reason, we do not describe this channel as end-to-end encrypted. We use Meta directly, with no intermediary provider, so no third company sees your messages. Under Meta’s terms Meta acts as our processor, uses messages only on our instructions, keeps them for a maximum of 30 days, and does not use them for advertising.

9.3 Our own handling rules for this channel: the number is registered with India as its storage region; every photograph or document you send is fetched once, encrypted into your workspace, and a deletion request is sent to Meta the same minute, with Meta’s answer recorded in your workspace’s audit trail; nothing is ever sent back out over WhatsApp as a document or as extracted content. The digest and the notices name your matters by their titles, so choose a number you are comfortable receiving them on. Your own WhatsApp backups (Apple or Google) are outside everyone’s control unless you switch on encrypted backups in WhatsApp.

10. The judgment and statute corpus

10.1 Pundora’s research answers come from a corpus we assemble from public sources: judgments of the Hon’ble Supreme Court of India, the Hon’ble High Courts and other courts and tribunals published as open data, and Acts and other legislation published by the Government of India, with additional legislation datasets published under open licences and credited on the relevant pages. These are public documents; they are not your data. We make no promise that the corpus is complete, and every answer says so when nothing is found.

10.2 Some judgments, citation links and older statute texts are obtained through the Indian Kanoon API under a commercial licence and kept in our corpus with Indian Kanoon’s written permission. When Pundora needs to look something up there, it sends only the citation itself, or the legal terms of a search (an act, a section, a phrase from a judgment, a court, a date range). To find the court’s own copy of a public order whose file Pundora does not hold, it may also send that order’s case number and year, its court and its date, taken from the public court record, never from anything you type. It never sends your documents, a party’s name you entered, or anything that identifies a matter. When Pundora’s own judgments give no answer to a research question, it may send a few ordinary legal words from that question — only words that Pundora’s list of the words used in judgments shows are common and are not names; never a name, a number, a date, a place or a rare word — and it shows you on screen exactly which words were sent. Documents obtained this way are stored on our servers in India and are shown to you from there, marked with their source. The full account of where the corpus comes from is on Pundora’s About page (app.pundora.in/about).

10.3 Some judgments and citation links in Pundora’s corpus are obtained through the Indian Kanoon API under licence: powered by IKanoon.

11. Who else can touch your data

11.1 We do not sell your personal data. We share it only with those who are needed to run the service, each bound by contract to use your data only to provide the service to us:

• Supabase: the database and encrypted file storage, in the Mumbai region.
• Vercel: hosting of the application and this website; the application runs in the Mumbai region. On this website only, Vercel Web Analytics counts page visits without cookies (clause 12.1).
• Anthropic: the AI provider, as described in clause 8.
• Meta Platforms: the WhatsApp Business Platform, if you connect WhatsApp, as described in clause 9.
• Amazon Web Services: the machines we operate ourselves in Mumbai for reading scanned pages and for assembling the public corpus. No client content is stored on them.
• Indian Kanoon: a licensed source of judgments, citation links and statute text for the public corpus. It receives citations and legal search terms from Pundora’s own systems and, when Pundora’s own judgments give no answer to a research question, a few ordinary legal words from it, as described in clause 10; it never receives your documents, a name, number or other detail of your questions, or your matter details.
• Google: sign-in with your Google account, and our company email.
• Sentry (Functional Software, Inc.): error monitoring, with data stored in the European Union (Frankfurt). When something in Pundora breaks, it receives the kind of error, the error’s own message, where in our code it happened, and the address of the page without anything after it. It never receives what you typed or uploaded, form input, cookies or files, and it sees you only as an anonymous number. It does not record your screen and does not track performance.

11.2 Our source code is kept on GitHub; no client content is stored there. Client content never enters third-party analytics or error-tracking tools. We will keep this list current on this page and update it before any change.

11.3 Pundora’s own staff do not read your documents. Our operational view shows counts, spend and system health, not content. We access content only with your express permission to resolve a support request, or where Indian law requires it.

11.4 We may also share personal data, but never your workspace content except as stated in this clause and clause 11.3, in these limited cases:

• with professional advisers such as lawyers, auditors and accountants, under duties of confidentiality, limited to business and account information;
• with government and law enforcement agencies where we are required to do so by applicable law or a lawful order, including for verification of identity or the prevention, detection, investigation or prosecution of offences; and
• with a successor business, if Pundora is involved in a merger, acquisition or sale of assets, subject to the recipient being bound by this policy or equivalent protections. We will tell you before your data becomes subject to a different policy.

11.5 No third party that receives personal data from us is permitted to disclose it further except as permitted by applicable law.

11.6 Published articles. Pundora publishes articles by invited contributors only after editorial review; contributors cannot publish directly. An article, and the byline and biography shown with it, is public as soon as it is published: anyone can read it, search engines may index it, and we cannot recall copies that others have made. You can ask us at any time to correct your byline or biography, and we will, unless the law requires otherwise. Requests to take an article down are handled under your contributor agreement and clause 17.4.

12. Cookies and similar technologies

12.1 We set only strictly necessary cookies and similar technologies: those that keep you signed in, protect your session against misuse, and remember settings you choose. The Services cannot work without them. The cookies and similar technologies currently set are listed below.

Our error-monitoring service (clause 11.1) stores nothing on your device. Our public website, pundora.in, sets no cookies and stores nothing on your device. It does load one analytics tool, Vercel Web Analytics, provided by our hosting provider Vercel: it counts page visits without cookies, recognises a returning visitor only by a code worked out from the visit itself that is discarded after 24 hours, and records the page, the site you came from, your country and region, and your browser, operating system and type of device. It is not loaded in the Pundora application.

12.2 We set no advertising cookies and no analytics cookies, and we use no Meta Pixel or similar tracker. The usage counts described in clause 4.6 are counts only. You can block or delete cookies through your browser settings, although you will then be unable to stay signed in.

12.3 Articles and resource pages may link to external websites and sources. We are not responsible for their privacy practices; please read their privacy notices before giving them personal data.

13. How long we keep things, and how deletion works

13.1 Your data stays as long as your workspace does; that is the point of a workspace. What you delete inside Pundora (a draft, a saved check, a kept answer, a whole matter, or your whole workspace) is gone from active systems at once, the encrypted files with it. A matter or a workspace is deleted only after you type to confirm, and only a workspace’s owner can delete the workspace. You can also ask us to delete data, and we do it promptly and confirm in writing.

13.2 Deleted records can remain in the database provider’s daily copies for up to seven days, after which they are gone; deleted files are not in those copies at all. What remains is the record that a deletion happened, by whom and when, which the law expects us to keep; it does not hold your content. Records you remove from a chronology or a calendar stay visible to you as removed, so nothing silently disappears; they are deleted with the matter.

13.3 Before you delete, export what you want to keep, free: a List of Dates, drafts and citation checks export from Pundora in Word, and for a full export of everything, including the original files, write to support@pundora.in and we prepare it free before anything is deleted.

13.4 Retention periods:

13.5 When a retention period ends, we erase the data or anonymise it so that it no longer identifies you. We may keep data for longer where applicable law requires it, or where it is needed to establish, exercise or defend legal claims.

14. How we protect your data

14.1 We take reasonable security measures appropriate to the nature of the data. The measures in place include:

• encryption of uploaded files with a key that belongs to your workspace, before they are written to storage;
• isolation of each chamber’s data by controls enforced in the database itself;
• sign-in through your Google account, so that Pundora holds no password of its own;
• reading of scanned pages on a machine we operate ourselves in Mumbai, never by a cloud reading service;
• an audit trail of deletions and of the handling of WhatsApp media;
• no reading of your documents by our staff except with your express permission or where Indian law requires it;
• encryption of all data in transit: every connection to pundora.in, app.pundora.in and our page-reading machine uses HTTPS (TLS), and browsers are told to reach the application only over HTTPS;
• two-step (multi-factor) sign-in on the administrator accounts of our Amazon Web Services account and of our database provider;
• a record of administrative actions taken in our Amazon Web Services account;
• a page-reading service with no internet access of its own, so a page it reads can go nowhere but back to your workspace;
• daily limits for each workspace on downloads, searches and judgment pages opened, so that the library cannot be copied in bulk;
• an operational view open only to a named administrator account; and
• an automated test, run before any change to our code is released, that checks one chamber cannot read another chamber’s data.

14.2 No method of transmission over the internet or of electronic storage is completely secure. We cannot guarantee absolute security, but this does not limit any obligation we have under applicable law.

15. If something goes wrong

15.1 If we become aware of a security incident or a breach affecting your data, we will act promptly to contain it, assess its impact and take remedial steps.

15.2 We will report cybersecurity incidents to the Indian Computer Emergency Response Team (CERT-In), and notify the authorities and the Data Protection Board of India, in each case where and within the time required by applicable law. We will tell you plainly and promptly what happened, what was affected, and what we are doing about it.

16. Your rights

16.1 You can ask us to:

• give you a summary of the personal data we process about you and the processing activities;
• correct inaccurate or misleading data, complete incomplete data, or update your data;
• erase personal data we no longer need, unless we must retain it under applicable law;
• tell you who we have shared your personal data with;
• export your data, which is free, forever;
• withdraw any consent you have given (clause 6); and
• nominate another person to exercise your rights if you die or become incapable.

16.2 India’s Digital Personal Data Protection Act, 2023 gives rights to notice, to access and correction, to erasure, to grievance redressal and to nominate a person to exercise your rights. We honour these rights as commitments regardless of the Act’s enforcement timeline, and they will apply as statutory rights from the date the relevant provisions come into force.

16.3 To exercise any of these rights, write to support@pundora.in from the email address linked to your account, or write to the Grievance Officer (clause 2.4). We may ask for information needed to verify your identity. We acknowledge a rights request within 24 hours and respond within 15 days.

16.4 If you are located outside India, you may also have rights under the data protection laws of your country. Pundora is a professional tool built for advocates practising in India and is not directed at users in other jurisdictions; write to support@pundora.in if you wish to raise a right you believe you have.

17. Complaints and the Grievance Officer

17.1 Complaints go to the Grievance Officer at the contact details in clause 2.4, or to support@pundora.in, and a person answers. We acknowledge a complaint within 24 hours and resolve it within 15 days of receipt, or within any shorter timeline Indian law prescribes.

17.2 If you are not satisfied with our response, you may escalate to the authority designated under applicable law. Once the relevant provisions of the Digital Personal Data Protection Act, 2023 are in force, this includes the Data Protection Board of India, and you must first use our grievance process before approaching the Board.

17.3 Pundora publishes articles written by its own team and by invited contributors, each reviewed by us before publication, and we treat ourselves as the publisher of those articles. The Services have no public comments and no way for visitors to post content. If that changes, we will update this policy and meet the obligations that apply to intermediaries under Indian law.

17.4 If you believe an article or other content published by Pundora is unlawful, inaccurate or infringes your rights, write to the Grievance Officer at the contact details in clause 2.4, saying where it appears and why. We acknowledge within 24 hours and resolve within 15 days of receipt, and we act promptly on any order of a court or notice from a government authority that the law requires us to follow.

18. Your clients’ data

18.1 You bring your clients’ information to Pundora in your professional capacity. We process it only on your instructions and only to provide the service to you; we never mine it, profile it, sell it, or use it for advertising or for anything else. Your professional and confidentiality obligations to your clients remain yours; our job is to be infrastructure worthy of them.

18.2 You are responsible for having the right to upload what you upload. Please do not upload material that you have no right to hold.

19. Children

19.1 Pundora is a professional tool for adults. You must be at least 18 to join the waitlist or hold an account, and we do not knowingly collect personal data from anyone under 18. We do not track or monitor the behaviour of children or direct advertising at anyone.

19.2 If we learn that we have collected personal data of a child, we will delete it. A parent or guardian who believes this has happened may write to support@pundora.in or to the Grievance Officer.

20. Changes to this policy

20.1 If we change this policy, we will say so on this page with a new date and version number, and for material changes we will tell you directly, by email to the address on your account, before they take effect. Where a change requires your consent, we will ask for it and will not treat your continued use of the Services as consent. Earlier versions are available on request at support@pundora.in.

20.2 We will review this policy when the substantive provisions of the Digital Personal Data Protection Act, 2023 come into force.

21. Contact

• Company: contact@pundora.in
• Your workspace, your rights and complaints: support@pundora.in
• Grievance Officer: Abhijeet Dagar, Chief Executive Officer, support@pundora.in (as in clause 2.4)
• Pundora Legaltech Private Limited (CIN: U74900DL2026PTC470096), Plot No. B-154/5, Kh. No. 1922B, Vasant Kunj Enclave, New Delhi – 110070

Pundora’s Privacy Policy and Terms of Use are read together. Questions: support@pundora.in.

Pundora’s Privacy Policy and Terms of Use are read together. Questions: support@pundora.in.