01In short
This policy explains what personal data LegalUtility ("we", "us") collects when you use https://legalutility.in, why, and the choices you have. It is written to meet the Digital Personal Data Protection Act, 2023 and the Information Technology Act, 2000 and its rules.
02Information we collect
a) When you create an account
- Your name and email address
- Your mobile number, if you choose to give it
- Your password. We only keep a one-way secure hash, so nobody (including us) can read your password.
b) When you sign in with Google
Google shares your name, email address, whether the email is verified, and a Google account ID that lets us recognise you next time. We do not get your Google password, contacts, Drive files or any other Google data.
c) Login and security records
Each time you sign up or log in we record the date and time, how you logged in (email, Google, or "kept logged in"), your IP address and your browser/device type. We also briefly record failed login and reset attempts to block password-guessing.
d) Files you process
- PDF Tools, Image Tools, Bank Statement to Excel: processed entirely in your browser. The files are not uploaded to our server.
- GST E-commerce: the Amazon, Flipkart and Meesho reports you upload, and the GSTIN and return period you enter, are sent to our server over an encrypted connection, processed in memory to prepare the GSTR-1 preview and JSON, and discarded straight away. We do not save the reports or the generated JSON.
- ITR Computation: the ITR JSON you choose is used only to prepare the computation shown to you. We do not keep a copy.
These files can contain personal data of other people, such as your clients or their customers. Please process them only where you are allowed to.
e) Technical information
Like every website, our hosting provider's servers automatically record basic request logs (IP address, browser, page requested, date and time) to keep the site running and secure.
03How we use your information
- To create and run your account, log you in, and keep you logged in when you ask us to
- To give account holders the features that need an account (for example combining marketplaces in GST E-commerce, and ITR Computation)
- To send password-reset emails you request
- To protect accounts and the website: detect misuse, block password-guessing, and investigate problems
- To understand, in total numbers, how many people sign up and use the tools, so we can improve them
- To show ads that keep the tools free (served by Google; see Advertising)
- To meet legal obligations
We do not sell or rent your data, and we never share your account details or your files with advertisers. To keep the tools free, pages show ads from Google (see Advertising).
04Advertising
To keep LegalUtility free, our public pages show ads served by Google AdSense. Ads are not shown on the account pages.
- Third-party vendors, including Google, use cookies to serve ads based on your previous visits to this website or other websites.
- Google's use of advertising cookies lets Google and its partners serve ads to you based on your visits to our site and/or other sites on the internet.
- You can turn off personalised advertising in Google's My Ad Center. You can also opt out of some third-party vendors' cookies at aboutads.info/choices.
- See how Google uses information in advertising.
Advertisers never receive your name, email, mobile number or the files you process. Visitors from the European Economic Area, the UK and Switzerland are asked for consent before personalised ads are shown.
05Cookies
We use two of our own cookies for logging in. Google sets its own cookies for sign-in and for ads.
| Cookie | Purpose | Duration |
|---|---|---|
LUSID | Keeps you logged in while you use the site (session) | Until you close the browser |
LUREM | "Keep me logged in". Stores a random code, not your password. | Up to 30 days, or until you log out |
| Google sign-in cookies | Set by Google only if you use "Continue with Google" | Under Google's policy |
| Google advertising cookies | Set by Google AdSense to show and measure ads, and to personalise them unless you opt out (see Advertising) | Under Google's policy |
Some tools also keep small preferences in your browser's own storage (for example your last chosen setting). This never leaves your device.
06Who we share it with
We share personal data only with service providers that help us run the website, and only as much as they need:
- Our web hosting provider stores the website, the account database and the server logs.
- Google provides "Sign in with Google", serves the fonts used on our pages, and shows ads through Google AdSense. When a page loads these, your browser connects to Google, which receives your IP address and browser details and may set cookies.
- Code library networks (cdnjs and jsDelivr) deliver open-source code some tools use. Your browser connects to them in the same way.
- Email delivery through our hosting provider sends password-reset messages.
We may also disclose information if the law requires it, for example to comply with a valid order from a court or government authority, or to protect the rights and safety of our users or the public.
07Storage and security
- All pages use encrypted HTTPS connections.
- Passwords are stored only as secure hashes (bcrypt).
- Logins are rate-limited to stop password-guessing, and changing or resetting your password logs out your other devices.
- "Keep me logged in" codes are random, stored only in hashed form, and replaced every time they are used.
- Only authorised administrators can see the list of registered users.
Our servers may be located in India or in another country, depending on our hosting provider. No method of storage or transfer is completely secure, but we take reasonable steps to protect your data. If a breach affects your personal data, we will inform you and the authorities as the law requires.
08How long we keep it
| Data | Kept for |
|---|---|
| Account details (name, email, mobile, password hash) | While your account exists. Deleted on request. |
| Login records | While your account exists, for security and support. Older records may be deleted earlier. |
| Failed-login and reset-attempt records | About 24 hours |
| Password-reset links | Valid for 1 hour |
| GST E-commerce reports and generated JSON | Not stored. Discarded as soon as the result is returned. |
| Files used in PDF, Image and Bank Statement tools | Never reach our server |
09Your rights
Under the Digital Personal Data Protection Act, 2023 you can:
- Access: ask for a summary of the personal data we hold about you
- Correct or update your details
- Erase: ask us to delete your account and personal data
- Withdraw consent: stop using the account features at any time. We then delete your account data unless the law requires us to keep it.
- Nominate someone to exercise these rights if you die or become unable to
- Raise a grievance with us, and, if unresolved, with the Data Protection Board of India
To use any of these rights, email support@legalutility.in from the email address of your account. We may ask you to confirm your identity, and we will reply within 30 days. You can change your password yourself on the My account page.
10Children
LegalUtility is meant for professionals and adults. Accounts are not intended for anyone under 18. If you believe a child has created an account, contact us and we will delete it.
11Changes to this policy
If we change this policy, we will update the "Last updated" date at the top. If a change materially affects how we use your personal data, we will show a notice on the website or email account holders before it takes effect.
12Contact and Grievance
For any question, request or complaint about your personal data:
We aim to acknowledge complaints within 24 hours and resolve them within 15 days.