Privacy Policy
Last updated 29 October 2026. Version 4.
Who we are
This Privacy Policy explains how Principal Lens ("we", "us", "our") collects, uses, keeps and protects personal data when you use this website or engage our services. Principal Lens decides why and how your personal data is processed, so it is the data fiduciary under the Digital Personal Data Protection Act, 2023.
Information we collect
- When you ask us to contact you about a free tool result: your name, email address and, if you give them, your company name and phone number, the tool you used and a short summary of your result.
- When you request a paid service (an assessment, a contract review, a retainer or protection support): your contact details, your organisation's details, what you need, and the names of other people or organisations involved so that we can check for conflicts of interest.
- When you become a client: the email addresses and names of the people at your organisation who sign in, including team members your administrator adds, your engagement letter and acceptance, the payment reference and date, your questionnaire answers, files you upload, messages and replies, and incident records.
- When you use the website: technical information our hosting providers record to deliver and protect the site, such as your browser, the pages requested and your network address. To limit abuse of our forms and sign in, we keep a count of recent attempts from each connection. We store a coded form of the network address, never the address itself, and delete the count within one day.
We do not need an account for our free tools, and we never ask for card details. Clients pay by bank transfer or UPI, and we record only the payment reference and date.
Our free tools
Our free tools (the DPDP Readiness Check, the ISO 27001 and GDPR Coverage Quiz and the Contract Risk Quick Check) run entirely in your browser. Your answers and any text you paste are processed on your own device. They are not sent to us or stored by us.
If you choose to ask a lawyer to contact you about your result, we collect your name and email address and, if you give them, your company name and phone number. We also record which tool you used and a short summary of your result, for example your indicative readiness band or the number of red flags found. We do not collect your answers or the text you pasted.
We use these details only to contact you about your result and any services you ask about. We rely on your consent for this, and we keep a record of when and how you gave it.
Why we use your data
- To reply to your enquiry and contact you about the services you asked about, with your consent.
- To check for conflicts of interest, prepare your engagement letter and carry out the work you engage us for. You give us this data for that purpose.
- To send the emails the service needs: sign in codes, notices that a document or request is waiting, and the reminders described below.
- To keep the records our professional obligations and the law require, and to protect the website and our clients' data.
- To understand how visitors use the website, only if you accept analytics.
We do not sell personal data, use it for advertising, or send marketing emails.
How we use AI tools
At this stage, any AI assistance on your matter (for example help with document analysis, preliminary findings or contract clause review) is used by your reviewing lawyer by hand, through Claude, provided by Anthropic. Nothing on this website sends your data to an AI service automatically.
Before any material is reviewed with AI assistance, we remove names and other identifying details. We keep an internal record of each time AI assistance was used on a matter, what it was used for and the lawyer who reviewed the output. No AI system reaches a final legal conclusion on your matter: a qualified lawyer reviews and confirms all AI assisted work before it is shared with you.
Where your data is held and who helps us
Our database and the files you upload are held by Supabase in its Mumbai, India region. Other services help us run the website. Some of them process data outside India:
| Service | What it does for us | Data it handles | Where |
|---|---|---|---|
| Supabase | Database, sign in, file storage | All client and enquiry records, uploaded files | India (Mumbai) |
| Netlify | Hosts the website and runs its server code | Data passes through while each page or form is handled; short technical logs | Global network; server code runs in the United States |
| Resend | Sends our emails, including sign in codes | Recipient address and email content (no files or matter details) | Japan (sending region) and United States |
| Our Gmail inbox, Analytics (with consent), Search Console | Emails you send us; analytics data as described above | Global | |
| Anthropic (Claude) | AI assistance used by hand | Extracts with identifying details removed | United States |
| Sanity | Manages our website articles and pages | No client data | European Union (Belgium) |
| GoDaddy | Our domain name | No personal data beyond our own account | Global |
We keep a register of these services, with what each one handles, where, and on what terms. We will show it to you on request. The Act allows personal data to be transferred outside India except to countries the Government restricts. No country is restricted at the date of this policy, and we will review this list if that changes.
How we protect your data
- All traffic to the website is encrypted, and data is encrypted where it is stored.
- Files are kept in private storage. Only your organisation's signed in users and the lawyers on your matter can open them, through links that expire after one minute.
- Each person sees only what their role allows. Lawyers see only the matters assigned to them, and internal notes are never shown to clients.
- We limit repeated attempts on our forms and sign in, and we check that every uploaded file is the type it claims to be.
- We do not scan uploaded files for viruses. Please upload only files you have received from a source you trust and checked on your own system.
- We keep backups of our database, encrypted and under our control.
If a personal data breach affects you, we will tell you and the Data Protection Board as the law requires.
Evidence you share with us
When you are a client, your lawyer may ask you to upload documents that show how your organisation handles personal data. We use these files only to carry out the engagement you asked for.
The files are kept in private storage in India. Only people at your organisation with access to your dashboard and your reviewing lawyer can open them. We ask you to remove personal data we do not need before you upload.
We delete the files 90 days after we deliver the final report for that engagement. If implementation work under the same engagement continues, we delete them 90 days after that work ends. We keep a record of what was reviewed, when and by whom as part of our engagement records.
If you start an annual review, we fill in your new questionnaire with the answers you gave in your previous review, so that your team only needs to check and update them.
Reminders we send
We email the main contact of a client organisation to remind them of a retainer fee that is due or overdue, and, for DPDP assessment clients, that an annual review is coming up. These reminders contain no bank details and no matter content. If you would rather not receive annual review reminders, tell us and we will stop them.
Breaches, complaints and notices you report to us
If you report a data breach, complaint or Board notice through our protection form, we collect your contact details, your organisation, the kind of matter, when you became aware of it, whether personal data may be involved and the names of other people or organisations involved, so that we can check for conflicts of interest and contact you.
Once you engage us, you give us a structured record of the incident on your dashboard. We ask you to keep personal data in that record to the minimum we need. We keep it for as long as the engagement lasts and as long as we need it to meet our professional obligations. If we do not take the matter on, we delete the request 12 months after our last contact with you, as for other enquiries.
How long we keep data
| Data | How long |
|---|---|
| Enquiries and free tool contact requests from people who do not become clients | 12 months after our last contact, or sooner if you withdraw consent |
| Engagement records: letters, payment reference and date, questionnaire answers, findings, reports, final documents, incident records, notes and the record of who did what | 8 years after the matter ends |
| Contracts and other files you upload for review | 90 days after we deliver the final document |
| Evidence files | As described under "Evidence you share with us" |
| Sign in accounts of people at your organisation | Until your administrator or you ask us to remove them, or the engagement records are deleted |
| Counts of recent attempts on forms and sign in | Up to 1 day |
| Technical logs held by our hosting providers | The short periods those providers set |
When a period ends, we delete the data or remove what identifies you. We may keep data longer only where the law requires it or to deal with a legal claim, and only for that purpose.
Your rights
You can ask us to:
- give you a summary of the personal data we hold about you, how we use it, and who we have shared it with;
- correct, complete or update your personal data;
- erase your personal data, unless we need to keep it for the purpose you gave it for or to meet a legal or professional obligation;
- withdraw a consent you gave us, as easily as you gave it. This does not affect what we did before you withdrew it. For analytics, use Cookie settings; for anything else, write to us;
- nominate another person to exercise your rights if you die or become unable to do so.
Where you are a client's employee or team member, we may need to involve your organisation, because it engaged us and decides who has access to its matter.
To use any of these rights, contact us as set out below. We will confirm who you are, and then reply within 30 days.
Questions and complaints
Our Grievance Officer answers questions and complaints about how we handle personal data. Email principallens.team@gmail.com, or write to us through our Contact page. We aim to resolve complaints within 30 days, and within 90 days at most.
If you are not satisfied with our answer, you can complain to the Data Protection Board of India.
Children
Our services are for businesses and the people who work for them. We do not knowingly collect personal data of anyone under 18. If we find that we have, we will delete it.
Changes to this policy
We will update this policy when the way we handle personal data changes, and change the date and version above. If a change affects clients in a significant way, we will tell them by email before it takes effect.