Privacy Notice

This Privacy Notice describes how Adv. Sankalp Agarwal (“we”, “Lily”, “Data Fiduciary”) collects, uses, stores, shares, and protects personal data when you use Lily, including the Telegram bot and web portal at https://diary.sankalpagarwal.in (together, the “Service”).

It applies together with our Terms of Service. This notice is designed to comply with the Digital Personal Data Protection Act, 2023 (India) and the DPDP Rules, 2025.

1. Who this notice covers

Client advocates (tenant owners) who subscribe to Lily
Users linked to a tenant via Telegram (e.g. staff with read-only access)
Platform administrator (operator) using admin features

Individuals whose names appear in your case docket (parties, opponents) are not our direct users; you, as their advocate, are responsible for lawful processing of their data in your practice.

2. Personal data we collect

2.1 Account & identity

Advocate name, office address, mobile number, email
Telegram chat ID and role (owner / client / admin)
Tenant slug, subscription status, invite/join history

2.2 Case docket data

Case numbers, titles/party names, courts, case types, hearing dates, notes, CNR (where saved)
Portal sync metadata (last refresh, scope HC/DC/DRT)
Google Calendar event IDs if calendar sync is enabled

2.3 Billing (client advocates)

Plan amount, amounts paid, due dates, billing notes, reminder timestamps

2.4 Technical & security

OTP request logs (mobile, timestamp, purpose — OTP codes stored as hashes only)
Session tokens (JWT in HttpOnly cookies on web; not exposed to JavaScript)
Privacy consent timestamp and policy version accepted
Privacy request log (access, correction, erasure, grievance)
Minimal erasure audit (hashed tenant/mobile identifiers after account deletion — no case content)

2.5 What we do not collect

We do not sell personal data
We do not require Aadhaar, PAN, or payment card data on the portal (UPI/billing is recorded as amounts only)
We do not intentionally collect special category data unless you enter it in free-text notes

3. How we collect data

Directly from you — registration, Telegram messages, web forms, case entry
Automatically — session cookies, OTP/security logs, calendar OAuth tokens
From public court portals — when you request status/cause list lookups
From Google — when you authorise Calendar connection

4. Purposes & legal basis

We process personal data for:

Providing and operating the case diary Service
Authentication (mobile + Telegram OTP)
Hearing reminders, cause lists, PDF exports
Court status queries you initiate
Calendar synchronisation (with consent)
Billing, payment reminders, and account administration
Security, fraud prevention, and rate limiting
Compliance with law and responding to Data Principal rights

Processing is based on your consent, performance of the service contract (Terms of Service), and legal obligations where applicable under Indian law.

5. Sharing & processors

We share data only as needed to run the Service:

Telegram (Telegram FZ-LLC) — messaging, OTP delivery; subject to Telegram’s policies
Google — Calendar API if you connect; subject to Google’s policies
Cloud hosting — servers may process data in India (current deployment on GCP)
Court websites — queries you request are sent to official portals with data you supply

We do not share your docket with other advocates. Platform admin may access tenant metadata for support, billing, and compliance.

6. International transfers

Primary storage and processing are intended to remain in India. If Telegram or Google processes data outside India, their cross-border safeguards apply. Contact us if you need transfer details.

7. Retention

Active accounts: data retained while you use the Service and your subscription is active
Security logs: up to 12 months
After erasure: case and account data deleted; minimal hashed audit row retained for compliance
Billing records: may be retained where required by tax/accounting law even after erasure
Legal holds: we may retain data if required by court order or applicable law

8. Your rights (Data Principal)

Under the DPDP Act 2023 and Rules 2025, you have the right to:

Access — obtain information about personal data we process about you
Correction & updating — fix inaccurate or incomplete account data
Erasure — request deletion when data is no longer necessary (subject to legal retention)
Withdraw consent — stop consent-based processing; may suspend the Service
Grievance redressal — lodge a complaint with us; we respond within 90 days
Nominate — appoint another person to exercise your rights in death/incapacity (contact us)

You must provide verifiably authentic information when exercising rights.

9. How to exercise your rights

Web: Sign in → Privacy tab → download data, update profile, withdraw consent, delete account
Telegram: /privacy · /mydata · /deletedata · /terms
Email: lily-bot@sankalpagarwal.in
Mobile: +91 88900-73580

Erasure and delete-account actions require Telegram OTP verification.

10. Consent

On first use of the web portal (and when we update this notice materially), we ask you to accept this Privacy Notice and confirm consent to processing. You may withdraw consent via the Privacy tab or by contacting us; withdrawal may limit or end Service availability.

11. Children

The Service is not directed at children under 18. We do not knowingly collect children’s personal data.

12. Security measures

HTTPS (TLS) on the web portal; HSTS where configured
HttpOnly, Secure, SameSite session cookies
OTP rate limits and hashed OTP storage
Tenant-isolated SQLite dockets for client advocates
Role-based access (owner, client read-only, platform admin)
Server-side ownership checks on all case APIs

No system is perfectly secure. Report suspected incidents to lily-bot@sankalpagarwal.in promptly.

13. Grievance & Data Protection Contact

Adv. Sankalp Agarwal — Data Protection / Grievance Contact
Email: lily-bot@sankalpagarwal.in
Mobile: +91 88900-73580
Address: Lucknow, Uttar Pradesh, India

If you are not satisfied with our response within 90 days, you may approach the Data Protection Board of India under the DPDP Act.

14. Governing law

This notice is governed by the laws of India. Disputes relating to privacy are subject to the exclusive jurisdiction of the courts at Lucknow, Uttar Pradesh, India, unless otherwise required by applicable law.

15. Changes to this notice

We may update this notice from time to time. The version and date at the top will change. Material updates will be communicated via Telegram, the web portal, or email where appropriate. Continued use after the effective date constitutes acknowledgement of the updated notice.