1. Data Fiduciary
LexStreak is an independent legal technology platform operating under the Digital Personal Data Protection Act 2023. Contact: grievance@lexstreak.in
2. Data collected and purposes
Email address (account identification), full name (display), Bar Council enrollment number (verify advocate status), State and district (personalised Madras HC coverage), subject matter preferences (curate daily headnote feed), reading progress and streak data (gamification), bookmarked cases (personal library), and voluntarily: leaderboard participation and anonymous usage analytics.
3. Lawful basis
Consent (DPDPA Section 6). You may withdraw consent at any time. Withdrawal will result in account closure and data erasure within 30 days.
4. Data storage and security
All data is stored on AWS Mumbai (ap-south-1) infrastructure via Supabase. Data does not leave India. Supabase provides encryption at rest and in transit (TLS 1.3). Row-level security ensures no user can access another user's data.
5. Retention
Account and profile data: retained until erasure request. Reading progress: anonymised after 24 months. Consent audit logs: retained for 7 years per legal obligation.
6. Third-party processors
Supabase Inc. (database and authentication — contractually bound). Razorpay (payments when activated — PCI-DSS compliant). No advertising networks. No data brokers.
7. Children
LexStreak is an advocate-only platform. Bar Council enrollment requires a law degree and cannot be issued to persons under 21 years of age. We do not knowingly process data of persons under 18.
8. Your rights
Under DPDPA 2023: Right to access (Section 11), right to correction and erasure (Section 12), right to grievance redressal within 30 days (Section 13), right to nominate a representative. Exercise via Profile → Data Rights or email grievance@lexstreak.in.
9. Grievance Redressal
Grievance Officer: The Grievance Officer, LexStreak. Email: grievance@lexstreak.in. All grievances will be acknowledged within 72 hours and resolved within 30 days. If unsatisfied, you may approach the Data Protection Board of India.
10. Breach notification
In the event of a personal data breach, affected data principals and the Data Protection Board of India will be notified within 72 hours per DPDP Rule 7.