This Data Processing Agreement ("DPA") forms part of the Terms of Service between Archana Info Solutions Pvt Ltd ("Processor" / "LegalEase AI") and the customer ("Controller"). It governs how personal data is processed within LegalEase AI.

1. Roles

Under the DPDP Act 2023, Customer acts as Data Fiduciary and LegalEase AI acts as Data Processor for personal data uploaded into the workspace. LegalEase AI processes such data only on documented instructions from Customer.

2. Scope of processing

Subject matter: provision of the LegalEase AI platform.
Duration: for the term of the subscription plus the 90-day read-only retention window.
Nature: storage, processing, AI-assisted drafting/review, and analytics.
Categories of data: names, contact details, contract content, matter metadata, documents uploaded by Customer.

3. Security measures

AES-256 encryption at rest, TLS 1.3 in transit.
2FA on all accounts, SSO for Business and Enterprise plans.
Role-based access control and IP allowlisting.
Indian data residency.
Tamper-proof audit logs of all data access.
Regular vulnerability scanning and third-party penetration testing.
ISO 27001 implementation in progress.

4. Sub-processors

LegalEase AI uses the following sub-processors: Anthropic (Claude API, AI inference), Razorpay (payments), 1msg.io (WhatsApp), Microsoft Azure India / AWS Mumbai (cloud hosting), SendGrid (email). A current list is maintained at LEA_Status.aspx.

5. Data breach notification

We will notify Customer without undue delay (and within 72 hours where feasible) after becoming aware of a personal data breach, with details sufficient to enable Customer to meet its own DPDP notification obligations.

6. Data subject rights

LegalEase AI provides self-service tools inside the app for Customer to action data subject rights (access, correction, deletion, export). We will assist Customer promptly for any request that cannot be fulfilled via self-service.

7. Return or deletion of data

On termination, Customer can export all data in one click. After the 90-day read-only retention window, all Customer data is permanently deleted from production and backups within an additional 30 days.

8. Audits

LegalEase AI will provide summary audit reports, security documentation, and responses to standard due-diligence questionnaires. Enterprise customers may request on-site audits under a signed NDA.

9. Contact

Data Protection Officer: dpo@legalease.ai.