Privacy Policy

LEGALWEBSITE.in, available at https://www.legalwebsite.in, is operated by WIN Legal Advisors, a division of World of Willpower Private Limited, A1/202, Samruddhi CHS, Kumbhare Park, Kothrud, Pune, Maharashtra, India 411038 (Registered Office). For the purposes of the DPDP Act, we are the Data Fiduciary for the personal data described below. You can reach us at vrushali@winlegaladvisors.com, at care@worldofwillpower.com, or on WhatsApp at +91 8808748088.

• • Account data — your name, email address, Indian mobile number (required at sign-up) and, if you provide it, your organisation. Purpose: to create and secure your account, show you your saved reports, send report, invoice and compliance alerts, and — with the consent you give at sign-up — contact you by WhatsApp, SMS or call about your account, reports and legal advisory from WIN LEGAL ADVISORS. We do not send promotional calls or messages to numbers registered on the National Customer Preference Register beyond what you have expressly consented to, consistent with the TRAI Telecom Commercial Communications Customer Preference Regulations, 2018. You can withdraw this consent at any time by writing to us; your account remains usable.
• • Authentication data — the password you choose, which our authentication provider stores only as a salted one-way hash and never in readable form. A password is 'sensitive personal data or information' under Rule 3(i) of the SPDI Rules, 2011, so we treat it as such. Accounts created earlier through Google sign-in hold the name, email address and Google account identifier received from Google at that time.
• • Consent records — the date, time and version of the notice you accepted at sign-up, kept as evidence of your consent.
• • Purchase and invoice data — when you buy a package, we use your contact details, website, selected package, any coupon, amount, payment reference, status and date to process the payment, activate the service and issue the tax invoice. Card, UPI and netbanking details are entered directly with our payment provider and never reach us; we do not receive or store your card number, UPI PIN or netbanking password.
• • Audit data — the website or app addresses you submit, the publicly available pages we fetch from those addresses, and the report we generate. Purpose: to deliver the audit you asked for and to let you revisit it later.
• • Legal assistance requests — the contact details and message you send when you ask for a legal opinion or remediation help. Purpose: to respond to your request.
• • Technical and security logs — IP address, browser type and timestamps generated when you use the service. Purpose: keeping the service secure, preventing fraud and abuse of the free trial, debugging faults, and meeting the log-retention duty in the CERT-In directions of 28 April 2022.
• • Optional analytics — aggregated page-usage measurement, collected only if you accept optional cookies, and stopped the moment you withdraw that consent.

Apart from the password described above, we do not ask for sensitive personal data such as financial account credentials, health information or biometric data, and you should not send it to us.

For account creation, audits, legal-help requests and optional analytics we rely on the free, specific, informed and unambiguous consent you give at the point of collection, and we keep a record of each consent. Security and fraud-prevention logging is carried out to protect the service and, where applicable, to comply with the CERT-In directions, which is a legal obligation rather than a general "legitimate interest" — Section 7 of the DPDP Act is a closed list of specified uses and we do not claim any broader exemption under it. Invoice and tax records are kept because the law requires us to keep them.

You may withdraw consent at any time: use the "Cookie preferences" control in the footer for analytics, write to vrushali@winlegaladvisors.com, or delete your account. Withdrawal is as easy as giving consent and does not affect processing already carried out.

The DPDP Act, 2023 and the DPDP Rules, 2025 come into force in phases. The Board-related provisions commenced on 13 November 2025; the consent-manager provisions commence on 13 November 2026; and the principal notice, consent, fiduciary-duty and Data Principal rights provisions commence on 13 May 2027. Until a provision is operative, the corresponding statement on this page is our readiness commitment rather than a claim that the duty is already in force.

We do not sell personal data and we do not share it for advertising. Some parties act only on our instructions under contract (processors); others decide their own purposes and are independent recipients. Both are listed below.

• • Processor — cloud hosting, database and authentication provider, which runs the service and stores your account record and hashed password.
• • Processor — web-crawling service, which fetches only the public pages of the address you submit.
• • Processor — AI model provider, which analyses the fetched page content to produce your report. Page content and personal data are not used to train third-party models.
• • Processor — email delivery provider, which sends your reports, invoices and alerts.
• • Processor — analytics provider, used only if you accept optional cookies.
• • Independent recipient — the bank or payment service named in the payment instructions you confirm, which processes the payment under its own privacy and regulatory obligations.
• • Independent recipients — the advocate you ask for help, who owes you separate professional duties of confidentiality.
• • Disclosure to a court, a regulator or a lawfully authorised government agency, where the law requires it.

Where a processor operates infrastructure outside India, the transfer is made only to countries not restricted by the Central Government under Section 16 of the DPDP Act, and only under a written contract that requires the same level of protection as we provide, confidentiality, purpose limitation, security safeguards and deletion or return on termination, as Rule 7 of the SPDI Rules, 2011 requires. Sharing with an advocate or a payment service happens only on your own instruction to use that service.

Your report is produced by a large language model that reads the public pages we fetch from the address you submit. It is an automated assessment and not legal advice; a human advocate reviews a site only when you ask for a legal opinion or remediation help. We do not use AI to make any decision that produces a legal effect for you, we do not generate synthetic images, audio or video, and we do not offer any tool that creates or alters such media, so the synthetic-content duties in Rule 3(3) of the IT Rules, 2021 (as amended by G.S.R. 120(E) dated 10 February 2026) do not arise on this site. Personal data you enter is not used to train third-party models. If you would rather not have a page analysed, do not submit it. The AI features on this site, what data they receive and the limits of their output are described in full on our legal disclaimer page, consistent with the MeitY India AI Governance Guidelines (5 November 2025), which are guidance rather than binding rules.

• • Account and profile data — while your account is active; erased when you delete the account.
• • Audit reports — while the account remains active. Historical reports cannot be individually deleted because they support the purchased audit record. When the account is deleted, reports are erased; only the payment, invoice and legal-request records described below are moved to the restricted archive first. We do not keep raw crawled page content as a separate archive once the report is produced; the crawling provider fetches pages only to read them and handles that transient content under its own retention policy.
• • Legal opinion and remediation requests — 3 years from closure, so the advocate and we can answer any question about the advice given.
• • Security and technical logs — 180 days on systems located in India, as the CERT-In directions of 28 April 2022 require. These logs survive account deletion for the remainder of that period and are then deleted.
• • Consent records — for the life of the account plus 1 year, as evidence of the choice you made.
• • Invoices, payment references and tax records — 8 years, as required by tax and company law.

When you delete your account, removable live records — your profile, audit reports, monitoring settings, certificates, free-check records and open legal-help requests — are erased, and we instruct our processors to delete their removable copies; routine encrypted backups age out within 30 days. Before anything is erased, the records the law requires us to keep are moved to a restricted archive: every payment and invoice record (eight years, including a payment that was initiated but not completed, so a late gateway notification can always be reconciled), closed legal-help matters (three years), and unexpired security records (up to 180 days). The archive is not accessible through any customer login, is not linked to the deleted account for sign-in purposes, and is used only for the stated legal, tax, dispute or security purpose. Everything else is erased, not anonymised — where information is retained it is because a specific law requires the record itself.

• • Right to access a summary of your personal data and how it is processed (Section 11).
• • Right to correction, completion, updating and erasure of your personal data (Section 12).
• • Right to grievance redressal through our Grievance Officer (Section 13).
• • Right to nominate another individual to exercise your rights in the event of death or incapacity (Section 14).

Write to care@worldofwillpower.com to exercise any right, in English or in Marathi or Hindi if you prefer; we will reply in the language you write in. As our own service commitment we respond within 30 days, and usually much sooner — the DPDP Act does not itself fix a 30-day deadline. You can also delete your account and all associated data yourself from the Delete your account page.

If our answer does not satisfy you, first raise it with our Grievance Officer, whose details and timelines are on the Grievance Officer page. The Data Protection Board of India was established on 13 November 2025. The statutory route for a Data Principal's complaint becomes available in accordance with the phased commencement of the relevant provisions and the Board's prescribed electronic process.

The service is not intended for anyone under 18. We do not knowingly process the personal data of children, and we do not carry out tracking, behavioural monitoring or targeted advertising directed at children, as prohibited by Section 9 of the DPDP Act.

We use encryption in transit, access controls, row-level database isolation so that each customer can read only their own records, least-privilege credentials, and a documented internal security policy that we review at least once a year. These are reasonable security practices within the meaning of Rule 8 of the SPDI Rules, 2011; we do not claim any certification we do not hold, and ISO certification is not the only way to meet that rule.

• • Server logs are retained for 180 days on systems located in India and system clocks are synchronised to NIC or NPL time, as the CERT-In directions of 28 April 2022 require.
• • A named point of contact is designated for CERT-In, and reportable cyber security incidents are reported within 6 hours of our noticing or being told of them.
• • For a personal data breach we tell affected users without delay, in plain language, what happened, what data was involved, what we are doing and what they should do, and we report to the Data Protection Board of India, with the detailed report following within 72 hours, in the manner the DPDP Rules prescribe once that provision is in force.
• • We test this response with our processors, who are contractually required to tell us of any incident immediately.

Vrushali Thorat, Attorney and Solicitor, Grievance Officer, A1/202, Samruddhi CHS, Kumbhare Park, Kothrud, Pune, Maharashtra, India 411038 (Registered Office). Email: vrushali@winlegaladvisors.com. We acknowledge every complaint within 24 hours and resolve it within 7 days.

We will post any change on this page and, where the change is significant, notify you by email before it takes effect.