§ Legal
Privacy Policy
What we hold, why we hold it, who else sees it and how to make us stop.
The three answers most people want. Your case documents are not used to train any AI model. They are sent to our AI provider only to produce the analysis you asked for, under an agreement that forbids training on them. You can delete a matter, and its documents, at any time.
Clause 1Who we are
Rank First Technologies Private Limited, CIN U58201PB2026PTC068900, of S.A.S. Nagar (Mohali), Punjab 160055, India, operates Litora AI.
For privacy questions write to privacy@litoraai.com. Our Grievance Officer can be reached at grievance@litoraai.com.
Clause 2Controller and processor
The distinction matters here more than it does on most services, so it is worth being exact.
- We are the controller of your account data
- Your name, email, organisation, billing details and how you use the platform. We decide why and how that is processed.
- We are a processor of your case material
- The documents you lodge against a matter belong to you and, usually, describe your clients. You decide what goes in and why. We process it on your instructions, to produce the analysis you asked for, and for nothing else.
If you need a data processing agreement for your own compliance file, ask us at privacy@litoraai.com and we will provide one.
Clause 3What we collect
| Category | What it includes |
|---|---|
| Account | Name, email address, password (stored only as a bcrypt hash), organisation name and type, role, telephone number and bar or roll number where you give one. |
| Authentication | Session records, sign-in timestamps, IP address at sign-in, two-factor secret (encrypted), recovery codes (hashed). |
| Billing | Purchases, credit ledger entries, invoices, billing address and tax identifiers. Card details are handled by the payment gateway and never reach our servers. |
| Case material | Documents you upload, matter titles, party names, notes, and everything the analysis derives from them. |
| Usage | Which features were used, how many agents were run, token counts for cost accounting, and error logs. |
| Technical | IP address, browser and device type, and timestamps, kept in server logs. |
| Correspondence | What you send us through the contact form or by email, and our replies. |
Clause 4Case material specifically
Case files routinely contain other people's personal data, and often sensitive categories of it: health information, criminal allegations, financial details, family circumstances. We treat the whole of a matter as sensitive by default rather than trying to classify it.
- Documents are encrypted in transit and at rest.
- They are readable only within the matter they were lodged against, by users of your organisation who have been given access to it.
- They are not indexed for search across organisations, not aggregated, and not analysed for any purpose of our own.
- Our staff do not read them as a matter of routine. See clause 8.
Whether you are permitted to upload a given client's material, and whether doing so affects privilege in your jurisdiction, is a matter for you and your own advisers. We have set out the facts here so that you can decide on an accurate basis.
Clause 5Why we process it
- To create and run your account, and to authenticate you.
- To perform the analysis you instruct: reading documents, running agents, producing reports.
- To take payment, issue invoices and maintain the credit ledger.
- To provide support when you ask for it.
- To keep the platform secure, detect abuse and enforce rate limits.
- To meet our legal, accounting and tax obligations.
- To improve the platform — using aggregate usage statistics, never the content of your matters.
Clause 6Lawful basis
Where data protection law requires a lawful basis, ours are: performance of our contract with you (running the account and the analysis); our legitimate interests (security, abuse prevention, aggregate product improvement), balanced against your rights; legal obligation (tax and accounting records); and consent, where we ask for it and only for what we asked.
For case material we act on your instructions as processor, and your own lawful basis for holding that material is the one that governs.
Clause 7The AI provider
The analysis is performed by a third-party large language model provider. To produce it, the relevant portions of your matter are transmitted to that provider over an encrypted connection.
Our agreement with that provider prohibits the use of material sent through our account to train or fine-tune models. The provider retains material only transiently for the purpose of returning a response, and for a limited abuse-monitoring window under its own policy. We do not enable any feature that would permit training on customer content.
The identity of the current provider and its published data policy are available on request, and are listed in the data processing agreement.
Clause 8Who else we share with
We do not sell personal data. We share it only with:
- Our AI provider
- As described in clause 7, to perform the analysis.
- Our hosting provider
- Which stores the application and its data.
- Our payment gateway
- Which handles card details directly, so that we never hold them.
- Our email provider
- To deliver verification, reset and notification emails.
- Professional advisers
- Accountants and lawyers, where necessary and under a duty of confidence.
- Authorities
- Where we are legally compelled. Where we are lawfully able to tell you first, we will.
- A successor
- If the business is transferred, subject to the same protections. You would be told.
Our own staff access case material only where you have asked us to investigate a specific problem, where it is strictly necessary to keep the platform running, or where we are compelled by law. Every such access is written to the audit log.
Clause 9International transfers
We are established in India. Our AI provider and some infrastructure providers are established outside India, which means your data may be transferred and processed abroad.
Where such a transfer takes place we rely on appropriate safeguards, including contractual protections with each provider requiring a standard of protection equivalent to that which applies here. If you need the specifics for your own compliance assessment, ask and we will give them to you.
Clause 10How long we keep it
| Data | Retention |
|---|---|
| Case documents and matters | Until you delete them. Deleted matters are removed from live systems immediately and purged from backups within 30 days. |
| Account data | For as long as the account is open, then 90 days after closure. |
| Billing records and invoices | 8 years, as required by Indian tax and company law. |
| Credit ledger | 8 years, because it forms part of the billing record. |
| Audit and security logs | 12 months. |
| Server and error logs | 90 days. |
| Support correspondence | 24 months. |
Clause 11How we protect it
Encryption in transit and at rest; passwords stored as bcrypt hashes and never recoverable; two-factor authentication available on every account; access to a matter restricted by role within your organisation; document storage placed outside the web root and blocked from direct URL access; every significant action written to an audit log; rate limiting and lockout on authentication. The security statement sets this out in more detail.
No system is perfectly secure, and we do not claim otherwise. What we can say is what we actually do.
Clause 12Your rights
Depending on where you are, you may have the right to: obtain a copy of your data; correct it; delete it; restrict or object to processing; receive it in a portable format; withdraw consent where consent was the basis; and complain to a supervisory authority.
Exercise any of them by writing to privacy@litoraai.com. We respond within 30 days. We may ask you to verify your identity first, which is a protection for you rather than an obstacle.
Where a request concerns case material for which you are the controller and we are the processor, we will act on your instruction rather than deciding the question ourselves.
Clause 13Cookies
We use the small number of cookies necessary to keep you signed in and to protect forms against cross-site request forgery. We do not use advertising cookies and we do not run third-party trackers. See the cookie policy.
Clause 14Children
The platform is not for anyone under 18 and we do not knowingly collect their data as account holders. Case material may of course concern minors; it is handled with the same protections as all other case material, and you remain responsible for the lawfulness of uploading it.
Clause 15If something goes wrong
If a personal data breach occurs that is likely to result in a risk to affected people, we will notify the relevant authority within the period the law requires, and tell affected customers without undue delay. We will tell you what happened, what data was involved, what we have done and what you should do.
To report a suspected vulnerability or breach, write to security@litoraai.com. We will not pursue researchers who act in good faith and give us a reasonable opportunity to fix the problem.
Clause 16Changes to this policy
We may update this policy. Material changes are notified by email to account holders at least 14 days before they take effect, and the date at the top of this page always shows the current version.
ContactHow to reach us about this document
Access requests, deletion requests, data processing agreements and anything else about privacy.
- By email
- privacy@litoraai.com
- By post
- Rank First Technologies Private Limited (CIN U58201PB2026PTC068900)
S.A.S. Nagar (Mohali), Punjab 160055, India - Grievance Officer
- Grievance Officer —
grievance@litoraai.com
Appointed under the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021. Complaints are acknowledged within 24 hours and resolved within 15 days.
This document is governed by the laws of India, and the courts referred to in the terms of service have exclusive jurisdiction over any dispute arising from it.