Privacy Policy

1. Information We Collect

We collect the following categories of information to provide our Islamic estate planning services:

1.1 Personal Information

• Full name, email address, phone number, and date of birth
• Residential address and state of residence (Karnataka, Kerala, Tamil Nadu, Telangana, or Andhra Pradesh)
• Identity verification details as required for estate planning purposes
• Islamic doctrine preference (Hanafi, Shafi'i, Maliki, Hanbali, or Ja'fari)

1.2 Family Information

• Names and relationships of family members and potential heirs
• Familial relationships required for Islamic inheritance calculations (e.g., spouse, children, parents, siblings)
• Heir eligibility status based on Islamic jurisprudence rules

1.3 Financial Information

• Asset details: real estate, bank accounts, investments, insurance policies, business interests, and other assets
• Liability details: mortgages, loans, debts, and other financial obligations
• Asset valuations as provided by you for inheritance calculation purposes

1.4 Encrypted Vault Items

• Documents uploaded to your secure vault (wills, deeds, certificates, policies)
• Notes, instructions, and bequests (wasiyyah) you create within the platform
• All vault items are encrypted at rest using AES-256-GCM encryption

1.5 Usage & Technical Data

• IP address, browser type, device information, and operating system
• Pages visited, features used, and session duration
• Error logs and performance data for service improvement

2. How We Use Your Data

2.1 Inheritance Calculations

Your family and financial data are processed by our deterministic calculation engine to compute Islamic inheritance shares according to your selected doctrine. These calculations are performed entirely on our servers using rule-based algorithms and do not involve AI processing.

2.2 AI Advisory — ORIS

ORIS (Our Reasoning and Insight System) is our AI advisory feature powered by Anthropic Claude. When you use ORIS features (chat, scenario analysis, document drafting), your data is sent to Anthropic's API with the following safeguards:

• PII redaction: Personally identifiable information (names, addresses, phone numbers, account numbers) is redacted before data is sent to Anthropic
• Purpose limitation: Data sent to Anthropic is used solely for generating advisory responses and is not used to train AI models
• No data retention by Anthropic: Anthropic does not retain your data beyond the duration of the API request as per our data processing agreement

2.3 Document Generation

We use your family, financial, and bequest data to generate estate planning documents including inheritance summaries, will drafts, and distribution reports.

2.4 Communication

We use your contact information to send transactional emails (via SendGrid), OTP verification messages (via MSG91), subscription notifications, and, with your consent, marketing communications.

2.5 Payment Processing

Subscription payments are processed through Razorpay. We do not store your full payment card details on our servers. Razorpay handles payment data in accordance with PCI-DSS standards.

3. Data Storage & Security

We implement robust security measures to protect your data:

• Database: User data is stored in MySQL 8.x with encryption at rest and in transit (TLS 1.2+)
• Vault encryption: All vault items (documents, notes, wills) are encrypted using AES-256-GCM before storage. Encryption keys are managed securely and are never stored alongside the encrypted data
• Session management: User sessions are managed via Redis with secure, httpOnly cookies and configurable expiry
• Document storage: Uploaded documents are stored in AWS S3 with server-side encryption (SSE-S3) and access restricted via signed URLs with limited time-to-live
• Access controls: Role-based access controls ensure that only authorized personnel can access production systems
• Monitoring: We continuously monitor for unauthorized access attempts and security anomalies

4. Third-Party Services

We share data with the following third-party service providers, each bound by data processing agreements:

We do not sell, trade, or otherwise transfer your personal data to third parties for marketing purposes.

5. Consent & Consent Types

We operate on a consent-based model. You are asked to provide specific consent for different processing activities. The following consent purposes are defined:

• Estate Planning: Consent to process your family and financial data for inheritance calculations and will generation
• Document Storage: Consent to store your uploaded documents in our encrypted vault
• ORIS AI Processing: Consent to send PII-redacted data to Anthropic Claude for AI advisory features
• Professional Referral: Consent to share limited information with vetted estate lawyers and Shariah scholars for professional consultations
• Marketing: Consent to receive promotional emails and product updates
• Analytics: Consent to collect usage analytics to improve our services

You may grant or withdraw consent for each purpose independently through your account settings. Withdrawing consent for Estate Planning or Document Storage may limit your ability to use core platform features.

6. Data Retention

• Active accounts: Your data is retained for as long as your account is active and you maintain an active subscription
• Inactive accounts: If your subscription expires and is not renewed, your data is retained for 12 months in a read-only state to allow for reactivation
• Account deletion: Upon account deletion request, all personal data, family data, financial records, vault items, and generated documents are permanently deleted within 30 days
• Backup data: Encrypted backups may retain deleted data for up to 90 days before being purged from backup systems
• Legal obligations: We may retain certain records as required by applicable Indian law, including tax and financial regulations

7. Indian Data Protection Compliance

Wasiyat is committed to compliance with applicable Indian data protection legislation:

7.1 Information Technology Act, 2000

We comply with the Information Technology Act, 2000 and its associated rules, including the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011. We implement reasonable security practices including encryption, access controls, and regular security audits.

7.2 Digital Personal Data Protection Act, 2023 (DPDPA)

In accordance with the DPDPA, we:

• Obtain clear, informed, and specific consent before processing personal data
• Process data only for the specific purposes for which consent was obtained
• Provide you with the right to access, correct, and erase your personal data
• Appoint a Data Protection Officer to handle data-related queries and complaints
• Implement appropriate technical and organizational security measures
• Notify the Data Protection Board of India and affected users in the event of a data breach

8. Your Rights

As a user of Wasiyat, you have the following rights regarding your personal data:

• Right to Access: Request a copy of all personal data we hold about you, delivered in a commonly used electronic format
• Right to Correction: Request correction of any inaccurate or incomplete personal data
• Right to Deletion: Request deletion of your personal data, subject to any legal retention obligations
• Right to Data Portability: Export your data (family tree, asset/liability records, calculations, vault items) in a structured, machine-readable format
• Right to Withdraw Consent: Withdraw consent for any specific processing purpose at any time through your account settings
• Right to Grievance Redressal: Lodge a complaint with our Data Protection Officer or, if unresolved, with the Data Protection Board of India

To exercise any of these rights, please contact us at privacy@wasiyat.in. We will respond to your request within 30 days.

9. Cookies

Wasiyat uses only essential session cookies required for the proper functioning of the platform:

• Session cookie: Used to maintain your authenticated session. This cookie is httpOnly, Secure, and SameSite=Lax
• We do not use third-party tracking cookies, advertising cookies, or analytics cookies that track individual users across websites
• No cookie consent banner is required as we only use strictly necessary cookies as defined under applicable regulations

10. Children

Wasiyat is intended for users who are 18 years of age or older. We do not knowingly collect personal data from individuals under 18. If we become aware that we have inadvertently collected data from a minor, we will take steps to delete that information promptly. If you believe a minor has provided us with personal data, please contact us at privacy@wasiyat.in.

11. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or applicable law. Material changes will be communicated via email notification and a prominent notice on the platform at least 30 days before they take effect. Your continued use of Wasiyat after the effective date constitutes acceptance of the updated policy. We encourage you to review this page periodically.

12. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

• Email: privacy@wasiyat.in
• Data Protection Officer: dpo@wasiyat.in