When you create an account or use Dharaa, we collect:

• Account Information: Phone number (used for OTP login via Firebase Authentication), and optionally name, email address, and business details you choose to add to your profile.
• Counterparty Details: Name, email address, phone number, and signing role of any other party you add to an agreement so they can receive and sign it.
• Communication Data: Support tickets, in-app feedback, and emails you send us.
• AI Prompts and Review Inputs: When you choose to use Dharaa AI, we collect the prompts, instructions, uploaded or selected document context, clause text, and conversation history needed to draft, edit, review, or answer questions about an agreement.
• Payment Information: When you pay for an eSign or premium feature, the payment is processed by Razorpay (and, where applicable, Apple In-App Purchase or RevenueCat). Card numbers, UPI IDs, and bank credentials are entered directly with the payment processor — Dharaa receives only a transaction reference, masked instrument metadata (e.g., last four digits, network), amount, and status.
• Aadhaar (only if you choose Aadhaar eSign): Your Aadhaar number and Aadhaar OTP are entered on the gateway of our licensed eSign Service Provider, C-DAC e-Hastakshar. Dharaa does not see, log, or store your Aadhaar number or biometrics; we receive only the resulting signed PDF and signature certificate.

When you use the app or website we collect a limited set of technical data needed to operate the service:

• Device & App Diagnostics: Device model, OS version, app version (via package_info_plus), language, timezone, network connectivity status (connectivity_plus), crash and error logs.
• Usage Data: Features used, screens visited, agreements created/signed (counts and timestamps, not content) — used to keep the service reliable and to debug issues.
• Approximate Location (server-side): Coarse country/region inferred from your IP address for routing, fraud prevention, and to confirm you are accessing an India-only service.
• Push Notification Token: A Firebase Cloud Messaging (FCM) device token via awesome_notifications_fcm so we can deliver counterparty-signed and document-status alerts.

We do not use any third-party advertising SDKs, ad identifiers (IDFA/IDFV), or cross-app/cross-site tracking. Per Apple's App Tracking Transparency framework, Dharaa does not "track" you as defined by Apple, and we do not present an ATT prompt because we have nothing to ask.

The Dharaa app requests the following device permissions. Each is optional for ordinary use of the app, requested only at the point of use, and explained in the iOS prompt:

• Camera (NSCameraUsageDescription) — used only if you enable Face Liveness Check on a signing ceremony, to capture a short live-capture confirming a real person is signing. Frames are sent through Dharaa's backend to Microsoft Azure AI Face/Liveness for verification, and the intermediate frames are discarded. The pass/fail result and a single reference still are kept as evidence in the document's audit trail: Dharaa retrieves that one still from Azure immediately after the check and stores it in its own encrypted storage alongside the signing record, where only the document's owner can view it. Azure deletes its own copy of the session, including that image, within 48 hours. Disabled by default.
• Location — When In Use (NSLocationWhenInUseUsageDescription) — used only if you enable Location Proof at Signing, to capture GPS coordinates at the moment you sign. The coordinates and a reverse-geocoded city/state (via geolocator / geocoding) are embedded in the Certificate of Execution as evidentiary metadata. We do not track your location in the background.
• Photo Library (NSPhotoLibraryUsageDescription) — used only when you tap to attach an image (e.g., a property photo or supporting document) or save an executed contract to your library.
• Notifications — to deliver "counterparty signed", "document executed", and similar transactional alerts. You can disable notifications at any time in iOS Settings.

You can revoke any of these permissions at any time in iOS Settings → Dharaa.

When you draft, edit, or sign an agreement we process:

• Agreement Content: The natural-language prompt you give the AI, the resulting draft, every clause edit you make, and the final document.
• AI Context: If you use AI chat, drafting, review, or document-assistance features, Dharaa may include relevant agreement descriptions, selected document excerpts, clause IDs, clause text, document status, tool results, and recent conversation context so the AI can respond to your request.
• Signer Information: Names, email addresses, phone numbers, and signing status of all parties.
• Document Metadata: Creation, edit, and signing timestamps; document state (draft/signing/executed); state-wise stamp duty selection.
• Signing Audit Trail: OTP verification logs, signature certificate(s), face-liveness pass/fail and its reference still (if enabled), GPS + reverse-geocoded location (if enabled), IP address, device fingerprint, and a tamper-evidence hash. This audit trail is what makes the executed contract legally defensible under the IT Act, 2000 and the Indian Evidence Act, 1872.

A copy of every executed contract is also emailed to each signer at the time of execution.

We use your information to:

• Run the Dharaa app and website and deliver the service you signed up for.
• Generate, store, review, and let you edit your agreements, including through AI-assisted drafting and chat when you choose to use those features.
• Initiate and complete digital signatures via Digital Sign, and via Aadhaar eSign when it is available.
• Authenticate logins and maintain account security.
• Process payments via Razorpay / Apple In-App Purchase / RevenueCat as applicable.
• Send transactional emails and push notifications (counterparty signed, document executed, payment receipt, etc.).
• Show an in-app AI data-sharing disclosure and ask for your permission before sending your first AI prompt or document context to third-party AI processors.

We will contact you about:

• Security alerts, account changes, and policy updates.
• Counterparty actions on your agreements.
• Payment receipts and refund status.

These are essential service communications and cannot be turned off while your account is active. Marketing emails are opt-in only; if we ever send them, every message will include an unsubscribe link.

We use crash logs, error reports, aggregated usage counts, and high-level product analytics to find and fix bugs and to improve Dharaa. Our analytics providers are Google Analytics 4 and PostHog, which record page views, clicks, and technical details such as browser and device type — see our Cookie Policy for what each one is used for. Once you sign in, this activity is associated with your account so we can tell a completed journey from an abandoned one.

Analytics never captures the contents of your agreements. We do not use the content of your legal agreements to train generalised AI models, and we do not sell or share that content with any party for advertising.

We process your information to comply with applicable Indian law, to enforce our Terms of Service, to detect and prevent fraud or abuse, and to respond to lawful requests from courts or authorised regulators.

The controls we operate:

• Encryption in transit: TLS 1.2 or higher on every Dharaa endpoint, with TLS 1.3 negotiated where your browser or device supports it. HTTPS is enforced, and the signing and app origin sends HSTS.
• Encryption at rest: AES-256, applied by our cloud platform to database, blob and log storage
• Access controls: Role-based access control on cloud resources and least privilege by default. Administrator sign-in requires multi-factor authentication. Your own sign-in is a one-time password to your phone or email, which is a single factor.
• Key custody: Signing and integration keys are held in a managed key vault with audited access, not in application configuration
• Application security: Per-endpoint rate limiting, an allow-list of permitted browser origins, request size limits, and security response headers
• Independent testing: From September 2026, an annual security assessment by a CERT-In empanelled agency, with findings tracked to closure and re-tested. Before that date we had not been independently assessed.
• Data segregation: Logical separation of each customer's records, enforced in the data layer
• Monitoring and alerting: Centralised application and audit logging held in India, with alerts raised to our Director and a documented incident-response procedure (§4.3)

We would rather be exact than impressive, so here is what we do not have. We run no managed web application firewall, no intrusion detection or prevention system, and no distributed-denial-of-service mitigation of our own beyond the protection our cloud platform applies at its network edge. We have no round-the-clock security operations centre and no dedicated security staff; alerts reach a person, not a monitoring desk. Our cloud provider holds ISO/IEC 27001 and SOC 2 certification for the infrastructure it runs; Dharaa itself is not certified.

Where a control is planned rather than in place, it is recorded in our internal risk register with a named owner and a date.

Dharaa is operated by a very small team, and at our present size every access to production data sits with the Director. Our practice:

• Access to production data is limited to the named people whose work requires it, and is granted per person rather than through a shared login
• Everyone with such access is bound by a confidentiality undertaking in their employment or contractor agreement
• Access is through individual cloud accounts protected by multi-factor authentication, and the cloud platform records administrative actions
• Access is withdrawn when a person leaves or their role changes

We do not carry out background verification on personnel, and we do not run a formal security training programme. Administrative actions are logged by the platform, but we do not operate a periodic review of data-access patterns as a separate control. We say so plainly rather than imply otherwise; both are recorded in our risk register as things to revisit as the team grows.

If we suffer a data breach affecting your personal information we will:

• Report qualifying incidents to CERT-In within 6 hours as required by the CERT-In directions of 28 April 2022.
• Notify the Data Protection Board of India and affected users without undue delay, as required by §8(6) of the DPDP Act, 2023.
• Tell affected users what happened, what we are doing about it, and what they can do to protect themselves.

We do not sell, rent, or trade your personal information to third parties for their marketing purposes. We will never monetise your data without your explicit consent.

We rely on the named providers below to operate Dharaa. Each receives only the data it needs to do its job. Our major platform providers are engaged under a data processing agreement; for the smaller ones we rely on their published terms, which cover confidentiality and security.

This table lists the providers that are switched on in production today. We build integrations before we enable them, so our code contains connections to services that receive nothing at all. Those are not listed here, and we will update this policy before any of them is enabled.

| Provider | Purpose | Data shared | Where it is processed | | --- | --- | --- | --- | | Microsoft Azure (serverless compute, Cosmos DB, blob storage, Key Vault, Application Insights) | The Dharaa backend, our record store, document storage, key custody and logging | All server-side data: your account, your agreements, signing and consent records, documents and audit trail | Central India | | Microsoft Azure Communication Services | Transactional email: signing invitations, executed documents, one-time passwords | Recipient email address, message body, attached document where required | India | | Microsoft Azure Container Apps (Gotenberg) | Rendering a document to PDF, in an isolated container | Document content during rendering; nothing is retained afterwards | Central India | | Microsoft Azure Static Web Apps | Serving the website and the web app's static files | Static files only — no personal data is stored here, and every data request goes to our Central India backend | East Asia (Azure Static Web Apps has no India region) | | Microsoft Azure OpenAI | AI-assisted drafting, review, clause editing and chat | Your prompt; selected agreement and clause context; recent conversation context; generated output; session and technical metadata | Account in South India. Our model deployments are of the "global standard" type, so inference may be served from outside India | | Microsoft Azure AI Face | Optional face liveness check during signing | Liveness session identifier, live-capture frames, verification result. Aadhaar data is not sent. Azure deletes the session and its reference within 48 hours; Dharaa retrieves one still beforehand and keeps it with the signing record | Central India | | C-DAC e-Hastakshar (Government of India) | Aadhaar eSign | The document hash and your signing consent. Your Aadhaar number and one-time password are entered on C-DAC's own gateway and never reach Dharaa. | India. Aadhaar eSign is integrated and under security assessment; it is not currently available to users. We will update this policy before it is made available. | | Google Firebase Authentication | Signing in with a phone or email one-time password | Phone number, email address, authentication identifier, device token. No document, signature, verification or Aadhaar data | Outside India — see §8.2 | | Razorpay | Payments in India | Order amount, masked instrument metadata, transaction reference. Card, UPI and bank credentials are entered on Razorpay's own surface and never reach us | India | | RevenueCat | Validating subscription and purchase receipts from the mobile stores | Receipt identifiers, entitlement status, an application user identifier | Outside India | | Apple (App Store, In-App Purchase) | Distribution and in-app purchase on iOS | Receipt data. Apple returns a hashed identifier, not your personal details | Outside India | | Google (Play Store, Play Billing) | Distribution and in-app purchase on Android | Purchase token and order identifiers | Outside India | | Zoho | Electronic stamping only. Zoho procures the e-stamp; it does not carry out signing for Dharaa | Stamp order details, the party names printed on the stamp certificate, and the document to be stamped | India | | eDrafter | Electronic stamp paper procurement in supported states | Stamp order details, party names | India | | DigiLocker (Government of India, via MeriPehchaan) | Fetching your issued documents for identity verification, on your own authorisation each time | Your DigiLocker authorisation and the documents you choose to share | India (Government of India) | | UIDAI Aadhaar app | Identity confirmation through UIDAI's own Aadhaar app, as an alternative to DigiLocker | An identity assertion. No Aadhaar number is retained | India (UIDAI) |

Before Dharaa sends AI prompts or document context to Microsoft Azure OpenAI/OpenAI-compatible services, the mobile app displays a plain-language AI data-sharing disclosure and asks for your permission. If you decline, the AI chat/review feature will not open and Dharaa will not send your prompt or document context to that AI processor.

Separately, you may choose to connect Dharaa to an AI assistant of your own through our connector. If you do, whatever you ask that assistant to read or write in Dharaa is also processed by that assistant's provider under their terms, not ours. That connection is yours to make and yours to revoke.

AI providers do not receive your Aadhaar number, Aadhaar OTP, biometric identifiers, payment credentials, or complete signing audit trail unless you deliberately type or attach that information in a prompt. Microsoft's terms for Azure OpenAI require confidentiality and security safeguards, and do not permit your content to be used to train their foundation models or for advertising.

We will update this list when we add or remove a provider.

When you use Aadhaar eSign:

• Your Aadhaar number and Aadhaar OTP are entered directly on the licensed Aadhaar eSign provider's secure gateway and are governed by their privacy policy and the regulations of the Controller of Certifying Authorities (CCA) and UIDAI.
• Dharaa does not see, log, or store your Aadhaar number, biometrics, or OTP.
• We receive only the resulting signed PDF, the digital signature certificate, and a signing reference — these are stored as part of the document's audit trail because they are required for the document to be legally enforceable under the IT Act, 2000.

We may disclose your information when:

• Required by law, court order, subpoena, or legal process
• Necessary to protect our rights, property, or safety, or that of our users or the public
• Involved in a merger, acquisition, bankruptcy, or sale of assets (with notice to affected users)
• Requested by law enforcement or regulatory authorities with proper legal authorisation

We may share aggregated, anonymised, or de-identified data that cannot reasonably be used to identify you:

• Industry benchmarks and trends
• Product usage statistics
• Research and development insights

We retain your data for as long as necessary to provide our services and fulfil the purposes outlined in this policy:

• Account Data: Retained while your account is active and for up to 90 days after account closure
• Billing Records: Retained for 7 years to comply with tax and accounting regulations
• Agreement Documents: Retained according to your subscription plan settings, with options for export and deletion
• eSign Audit Trails: The non-personal eSign transaction trail (transaction identifiers, timestamps, response codes — no names or Aadhaar data) is retained for 24 months. The executed document and its signature certificate are retained separately, for as long as the document itself is kept, because they are what make it enforceable under the IT Act, 2000
• Communication Logs: Retained for up to 2 years for customer support and quality assurance
• Analytics Data: Aggregated and anonymised data may be retained indefinitely

You can request deletion of your data at any time. Upon request, we will:

• Delete your account and associated personal information within 30 days
• Remove data from active systems and backups within 90 days
• Provide confirmation of deletion upon completion
• Retain only data required for legal compliance (e.g., financial records for tax purposes, eSign audit trails as required by law)

As a Data Principal you have the right to:

• Access — a summary of the personal data we process and the processing activities.
• Correction & Erasure — correct inaccurate data and request deletion of data that is no longer required.
• Portability — export your agreements and metadata in standard formats (PDF for documents, JSON for metadata).
• Withdraw Consent — withdraw consent at any time; this does not affect lawful processing carried out before withdrawal.
• Nominate — nominate another individual to exercise your rights in case of death or incapacity.
• Grievance Redressal — raise a grievance with our Grievance Officer (Section 12) and, if unresolved, with the Data Protection Board of India.

You can delete your Dharaa account and personal data directly from inside the app:

Settings → Profile → Delete account

When you delete your account:

• Drafts, in-progress agreements, profile data, and your FCM token are removed from active systems within 30 days and from backups within 90 days.
• Executed contracts and their audit trails are retained as required by Indian evidentiary law (a copy is also emailed to you at execution time, and you may export them before deletion).
• Payment records are retained for 7 years to satisfy Indian tax and accounting law.

You may also email support@dharaa.ai from your registered address to request deletion.

We send marketing messages only if you have opted in. Every marketing email contains an unsubscribe link, and you can also manage preferences in Settings → Notifications inside the app. Essential service communications (security alerts, signing notifications, payment receipts) cannot be opted out of while your account is active.

Dharaa is an India-only service. Personal data, account data, agreement content, and audit trails are stored and processed in India, on Microsoft Azure regions located in India.

Your agreements, your signing records and your audit trail are stored in India. Three things cross the border, and we would rather name them than leave you to discover them.

Sign-in and the app stores. Google Firebase Authentication holds your phone number or email address and the identifier that represents your session; it is hosted outside India. It receives no document, no signature, no verification result and no Aadhaar data. Apple's App Store and Google Play, and RevenueCat, process purchase receipts outside India.

AI drafting, review and chat. If you use these, the prompt and the document excerpts needed to answer it go to Microsoft Azure OpenAI, after you have granted permission in the app. Our Azure AI account is in South India, but our model deployments are of the "global standard" type, which means Microsoft may serve the inference from a data centre outside India. We are moving to a deployment pinned to an Indian region; until then, this is the accurate position. We do not send your Aadhaar number, Aadhaar OTP, biometric identifiers or payment credentials to any AI provider.

Static hosting. The website and the web app's files are served from Azure Static Web Apps in East Asia, because the service has no India region. Only static files live there — HTML, styles, scripts, images. No personal data is stored at that edge, and every request for your data goes to our backend in Central India.

Separately, if you choose to connect Dharaa to an AI assistant of your own through our connector, that assistant's provider processes whatever you ask it to read or write, wherever they operate. That connection is yours to make and yours to revoke.

The Government of India has not, as of the effective date above, notified a list of restricted countries under §16(1) of the DPDP Act, 2023; if such a list is notified we will update our sub-processor arrangements to comply.

When data is processed by a sub-processor we require encryption in transit and at rest and least-privilege access controls. Our major platform providers are engaged under a data processing agreement; for the smaller ones we rely on their published terms.

The Dharaa mobile app does not use third-party advertising SDKs and does not access the iOS Advertising Identifier (IDFA). It does not present an App Tracking Transparency (ATT) prompt because it does not track you across apps or websites owned by other companies. The app stores limited data on your device using shared_preferences and a local database (realm) for offline access to your drafts and account state — this data never leaves your device unless you sync it.

The dharaa.ai website uses only strictly necessary cookies (session, CSRF, login) and a small number of first-party preference cookies (theme, language). We do not use advertising cookies, do not embed third-party advertising pixels, and do not share data with advertising networks.

You can clear cookies via your browser settings, and you can clear local app data by uninstalling the app or by tapping Settings → Profile → Delete account inside the app.

Dharaa's AI engine processes your input (natural language descriptions, clause preferences, and agreement parameters) to generate legal agreements. This processing is necessary for service delivery and is performed with appropriate safeguards:

• Transparency: Clear identification of AI-generated content
• Permission Before Sharing: Before the first AI request, the mobile app asks your permission to send AI prompts and relevant agreement context to our AI processors. If you decline, no AI prompt or document context is sent and the AI chat/review feature remains unavailable.
• Named AI Processors: Current AI processors are Dharaa's AI backend hosted on Microsoft Azure and Microsoft Azure OpenAI/OpenAI-compatible services as the model provider. An AI assistant you connect yourself through our connector is your processor, not ours.
• Data Sent for AI: AI requests may include your prompt, selected agreement descriptions, clause text, document excerpts, recent conversation history needed for context, generated outputs, user/session identifiers, timezone, and technical request metadata.
• Data Not Sent for AI: Aadhaar numbers, Aadhaar OTPs, biometric identifiers, payment credentials, and full signing audit trails are not sent to AI processors unless you deliberately include them in your own prompt or attachment.
• Human Control: Full ability to review, edit, and modify any AI-generated clause before finalising
• Data Minimisation: Processing only data necessary for the specific agreement
• Limited AI Retention: Chat sessions and messages may be stored by Dharaa for continuity, support, debugging, and abuse prevention, normally for short operational periods unless they become part of a saved agreement or legal record. AI providers may temporarily process and retain requests under our enterprise provider terms, but they may not use your content for advertising or general model training under those terms.

Dharaa does not use automated decision-making that produces legal effects or similarly significant effects on individuals without human oversight. All agreements require explicit human review and signing.

We do not use your personal data, agreement content, or document data to train generalised AI models that are sold, shared for advertising, or used to build profiles across customers.

Any internal improvement of our AI systems relies on synthetic data, separately-licensed datasets, and high-level aggregated metrics that cannot reasonably be used to identify an individual person or a specific agreement.

• Name: Mohit Garg
• Email: support@dharaa.ai
• Response time: within 30 days of receiving a verifiable request.

• Account support: support@dharaa.ai

Dharaa
Attn: Grievance Officer
New Delhi, India

We may update this Privacy Policy periodically to reflect:

• Changes in our data practices or services
• New legal or regulatory requirements
• Improved privacy protections or security measures
• User feedback and industry best practices

When we make material changes:

• We will update the "Last Updated" date at the top of this policy
• We will notify you via email at least 30 days before changes take effect
• We will display a prominent notice on our platform
• We will maintain an archive of previous policy versions

Your continued use of Dharaa services after policy updates constitutes acceptance of the revised terms. If you do not agree with the changes, you may close your account and discontinue use of our services.