DPDP Compliance

Where a client firm uploads matter content, that firm is the Data Fiduciary and ALC acts as a Data Processor, processing only on the firm’s documented instructions. Where we collect data directly, such as an enquiry through this site, ALC is the Data Fiduciary.

Matter content is processed for one purpose: producing the output the professional asked for. It is not repurposed for analytics, product research or model training.

Direct personal identifiers in matter content are pseudonymised before any call to a third-party language model, so identifiable personal data is not exposed to the model provider in the ordinary course.

Each firm’s data is ring-fenced. There is no shared index across firms, and no firm’s content contributes to another firm’s results.

We support client firms in responding to access, correction, erasure and grievance requests from data principals within the timelines the Act sets. Requests reaching us directly are routed to the relevant firm where the firm is the Fiduciary.

We maintain an incident process covering detection, containment and notification, and will notify affected firms and the Data Protection Board as the Act requires.

Matter content is retained for the term of the firm’s agreement and deleted or returned on termination at the firm’s instruction. We do not retain copies beyond what that agreement and applicable law allow.

Data protection queries and grievances go to hello@alclegalai.com, which reaches the founders directly. We can provide a full data-flow walkthrough and a processing agreement to firms under NDA.

See also our Privacy Policy.