nyay Start asking →

Privacy Policy

Last updated: August 2025

1. Data We Collect

We collect minimal data to provide the service:

  • Account data: Email address, name, birth month/year, state/UT, language preference.
  • Usage data: Questions asked, responses generated, citations clicked, drafts generated.
  • Technical data: IP address, browser type, device info, timestamps (for security and analytics).

We do not collect: credit card details, government IDs, location data, contacts, or microphone/camera access.

2. How We Use Your Data

  • Provide and improve the nyay service (chat, drafts, citations)
  • Personalize responses (state-specific laws, language preference)
  • Enforce rate limits and prevent abuse
  • Security monitoring and fraud prevention
  • Service announcements (infrequent, opt-out available)

We do not sell your data. We do not use your conversations to train AI models.

3. Data Storage & Security

  • Data stored on Cloudflare (US/EU) with encryption at rest and in transit (TLS 1.3)
  • Sessions: 30-day JWT in HttpOnly, Secure, SameSite=None cookies
  • Rate limiting via Cloudflare KV (ephemeral, auto-expiring)
  • Vector embeddings stored in Cloudflare Vectorize (no PII in vectors)

4. Data Retention

  • Account data: Retained while account is active
  • Chat history: 30 days (free tier), 90+ days (Pro, coming soon)
  • Rate limit counters: Auto-expire after 24 hours (daily) / 1 hour (burst)
  • OTP codes: 10-minute TTL in KV

5. Your Rights

  • Access: Export all your data (Settings → Export, coming soon)
  • Deletion: Delete account anytime (Settings → Delete Account)
  • Correction: Update profile anytime (Settings → Profile)
  • Opt-out: Unsubscribe from emails anytime

6. Third Parties

We use minimal third-party services:

  • Cloudflare (hosting, Workers, KV, Vectorize, D1, AI)
  • NVIDIA API (LLM inference)
  • Google Fonts (Inter font, loaded with preconnect)
  • Resend (transactional email for OTP)

All subprocessors have DPAs and meet GDPR/adequacy standards.

7. Children's Privacy

nyay is not directed to children under 18. We do not knowingly collect data from minors. If you believe a child has provided data, contact us for deletion.

8. International Transfers

Data may be processed in the US (Cloudflare, NVIDIA). Cloudflare participates in EU-US Data Privacy Framework. For users outside India, standard contractual clauses apply.

9. Changes to This Policy

We'll notify you of material changes via email or in-app banner at least 30 days before they take effect. Continued use constitutes acceptance.

10. Contact

Questions? Email privacy@nyay.ai or write to:

nyay Legal Team
Email: privacy@nyay.ai