Privacy Policy

This Privacy Policy explains how MECGURA Digital Growth Studio (“MECGURA”, “we”, “us”) handles personal data on the MECGURA Advocate Platform — the advocate dashboard, the Super Admin console, advocate websites hosted by us, online appointment booking, enquiry forms and shared document links (together, the “Platform”).

We follow the Digital Personal Data Protection Act, 2023 and the rules made under it, and the Information Technology Act, 2000 and its rules, as they apply to us.

We handle two different kinds of data, and our responsibility is different for each:

• Data about our customers (advocates, law firms and their staff) — account, profile, subscription and usage data. For this data, MECGURA decides why and how it is processed, so we are the data fiduciary.
• Data that advocates put into the Platform about their own clients and visitors — leads, clients, cases, hearings, appointments, notes, documents and website enquiries. For this data, the advocate is the data fiduciary and MECGURA is a data processor: we store and process it only to provide the Platform to that advocate, following the advocate’s instructions.

If you are a client of an advocate or you contacted an advocate through their website, please contact that advocate first about your data. We will help the advocate answer your request.

From advocates and their staff

• Account details: name, email address, mobile number and role. Passwords are stored only as a one-way hash — we cannot see them.
• Professional profile: name as shown on the website, photo, address, city, state, Bar Council, enrolment / registration number, courts, languages, experience, education and practice areas.
• Subscription records: plan, billing cycle, trial and renewal dates, amounts and payment status.
• Settings and connected services, for example a Google Calendar connection (access tokens are stored encrypted).

Entered by advocates about their clients (processed on the advocate’s behalf)

• Leads, client names, phone numbers, email addresses, addresses, case details, hearing dates, follow-ups, notes, appointments and legal documents with their versions.

From visitors to advocate websites

• What you type into an enquiry or booking form: name, phone number, email, the subject of your matter, your message and the appointment slot you choose.

Collected automatically

• Security and activity logs: sign-in times, IP address, actions taken in the dashboard (the audit log), and failed sign-in attempts.
• For shared document links: when the link was opened or downloaded, IP address and browser type — so the advocate can see who accessed the document.
• Records of messages the Platform sends (email / WhatsApp): recipient, time and delivery status.

We do not knowingly collect more data than the Platform needs, and we do not buy personal data from anyone.

• To provide the Platform: advocate websites, appointments, CRM, cases, the Legal Library, document generation and sharing.
• To send messages the advocate has enabled — booking confirmations, reminders, enquiry acknowledgements and alerts — by email and, where connected, WhatsApp.
• To manage subscriptions, trials, renewals and support requests.
• To keep the Platform secure: preventing unauthorised access, abuse and fraud, and investigating incidents.
• To meet legal obligations, such as tax records or lawful requests from authorities.

• We do not sell or rent personal data.
• We do not use advocates’ client data or case data for advertising, marketing or profiling.
• We do not show advertisements on the Platform or use third-party advertising or tracking cookies.
• We do not read an advocate’s client or case data except when needed to provide support the advocate asked for, to keep the Platform secure, or when the law requires it.

We process our customers’ data to perform our agreement with them and, where required, on the basis of consent. Advocates are responsible for having a valid legal basis (such as consent or a legitimate use) for the client data they enter, and for giving their clients any notice the law requires.

Website forms tell visitors that their details will be shared with the advocate so the advocate can respond. Visitors can ask the advocate to delete their enquiry at any time.

We share personal data only with service providers that help us run the Platform, and only as much as they need:

• Hosting and database provider — to store the Platform and its data.
• Email delivery provider — to send emails the Platform generates.
• WhatsApp messaging provider — only if WhatsApp messaging is enabled for the advocate.
• Google — only if the advocate connects Google Calendar, to check busy times and create appointment events.

We may also disclose data when required by law, by a court order or by a government authority with lawful power, or to protect the rights and safety of users and the Platform. If MECGURA’s business is transferred, data will move only under the same protections described here.

Data is stored on servers operated by our hosting provider. Each advocate’s data is kept strictly separate from every other advocate’s data. Our security measures are described on our Security page.

If we ever need to transfer personal data outside India, we will do so only as permitted under Indian law.

• Active accounts — for as long as the subscription is active.
• After an account is closed — the advocate can request an export of their data. We keep the data for up to 90 days after closure so the account can be restored or exported, then delete it, unless the advocate asks us to delete it sooner.
• Billing and tax records — for the period required by Indian tax and accounting laws.
• Security and audit logs — for as long as needed to protect the Platform and meet legal requirements.
• Client data inside an advocate’s account — the advocate decides; the advocate can delete records at any time.

Subject to applicable law, you can ask us to:

• tell you what personal data we process about you and how;
• correct, complete or update your personal data;
• erase your personal data when it is no longer needed or you withdraw consent (unless the law requires us to keep it);
• withdraw consent you have given — this does not affect processing already done;
• nominate another person to exercise your rights if you die or become incapable.

Advocates can update most profile data themselves in the dashboard. For any other request, write to support@mecgura.tech. We may ask you to confirm your identity first. Clients of an advocate should contact the advocate, who controls that data.

We use only cookies that are needed for the Platform to work:

• Sign-in cookie — keeps you signed in (expires after 8 hours).
• Support access cookie — used only when MECGURA support opens an advocate account at the advocate’s request (expires after 1 hour).
• Shared document cookie — remembers that you entered the correct password for a protected document link.

Advocate websites also remember, only in your browser tab (session storage, not a cookie), that you accepted the Bar Council disclaimer. It is cleared when you close the tab and is never sent to us.

We do not use advertising, social-media or cross-site tracking cookies.

To solve a problem an advocate has reported, authorised MECGURA staff can open the advocate’s dashboard using a “view as advocate” function. Every such session is time-limited, shown on screen with a banner, and recorded in the audit log.

The Platform is meant for advocates and law firms and is not directed at children. Advocates may need to record information about minors as part of legal work; in that case the advocate is responsible for obtaining verifiable consent from a parent or lawful guardian where the law requires it.

If a personal data breach affects data on the Platform, we will act to contain it, inform affected advocates without undue delay, and notify the Data Protection Board of India, CERT-In and affected people when and as required by law.

We may update this policy. The effective date at the top will change, and we will inform advocates of important changes by email or in the dashboard.

For questions, requests or complaints about personal data, contact our Grievance Officer, at support@mecgura.tech. We will acknowledge your complaint and try to resolve it within the time required by law.

If you are not satisfied with our response, you may approach the Data Protection Board of India.