Privacy Policy
Headnote Private Limited ("Headnote", "we") respects your privacy. This Privacy Policy explains what we collect, why we collect it, how we use it, and the rights you have over your data. It applies to https://headnote.in and all associated services.
1. What we collect
1.1 Information you provide
| Data | Source | Why |
|---|---|---|
| Name, email, profile picture | Google OAuth sign-in via Supabase | Authenticate you, address you in the UI |
| Phone number (optional) | Onboarding form | Cashfree requires it during payment; WhatsApp support |
| Referral code (optional) | Onboarding form | Track who recommended Headnote |
| Search queries, drafts, FIR images | Your use of the Service | Generate AI output, save your drafts |
1.2 Information collected automatically
- Usage counters (drafts created, deep searches done) — to enforce plan limits
- Approximate request location and IP (held briefly by our hosting provider Railway for security)
- Browser type, OS, page load timing (basic diagnostics)
We do not use third-party analytics (Google Analytics, Hotjar, Mixpanel, etc.) at this time. If we add any analytics in future, we will update this policy and post a notice.
2. How we use your data
- Provide the Service: authenticate you, generate research/drafts, enforce quotas, save your work.
- Process payments: share the minimum needed (name, email, phone, amount) with Cashfree to charge you.
- Improve the product: aggregated usage statistics (number of searches, common error types). We never inspect individual queries unless you explicitly send us feedback or report a bug.
- Comply with law: respond to lawful court orders, tax filings, etc.
We do not use your queries, uploads, or drafts to train AI models.
3. Who we share data with
We share data only with the providers that make Headnote work, and only the data each one needs:
| Provider | What they receive | Why |
|---|---|---|
| Supabase (auth + database) | Your email, name, phone, drafts, usage counters | Account + draft storage |
| Cashfree Payments | Name, email, phone, amount, plan | Process subscription payments |
| Anthropic (Claude) | Your search query + retrieved case excerpts | Generate research output |
| Groq (Llama / Whisper) | Your draft answers, voice audio, FIR images | Drafting, voice transcription, OCR |
| Indian Kanoon | Search keywords from your queries | Fetch authoritative case text |
| Railway (hosting) | HTTP request metadata | Serve the website |
Each provider is bound by their own privacy and security commitments. None is permitted to use your data for advertising or any purpose other than delivering their specific service to Headnote.
4. Data retention
- Account & profile data: retained while your account is active, and for up to 12 months after closure (for legal/tax records).
- Drafts and search history: retained for as long as your account is active. Deleted within 30 days of account closure.
- Payment records: retained for 7 years per Indian tax regulations.
- Server logs: rotated and deleted within 30 days.
5. Security
- All traffic is encrypted in transit (HTTPS / TLS 1.3).
- Authentication uses industry-standard OAuth 2.0 and JWT with ES256 signatures.
- Server-side secrets are stored in Railway's encrypted environment, never in code.
- Row-Level Security policies on Supabase ensure one user cannot read another user's drafts or queries.
No system is perfectly secure. If you discover a security issue, please email hello@headnote.in with details. We treat security reports with priority.
6. Your rights
Under Indian and applicable data protection law, you have the right to:
- Access the personal data we hold about you.
- Correct any inaccurate or incomplete data.
- Delete your account and associated data ("right to be forgotten").
- Export your drafts and search history in JSON format.
- Withdraw consent for any specific use of your data (note: this may limit your ability to use the Service).
To exercise any of these rights, email hello@headnote.in from the email address associated with your account. We respond within 30 days.
7. Children
Headnote is not intended for users under 18 years of age. We do not knowingly collect personal data from children. If you believe a child has used the Service, please contact us so we can delete the account.
8. International transfers
Some of our service providers (Anthropic, Groq, parts of Supabase infrastructure) are based outside India and your data may be processed in the United States, European Union, or Singapore. By using Headnote you consent to these international transfers, which are protected by the contractual and security commitments of the respective providers.
9. Cookies & local storage
We use the following only:
- localStorage: to keep you signed in across sessions, save your draft autosave, and remember your language preference.
- sessionStorage: for one-time UI states (e.g. version-check flags).
We do not use third-party advertising cookies, retargeting pixels, or fingerprinting.
10. Changes to this Privacy Policy
We may update this Privacy Policy from time to time. Material changes will be announced on the website at least 14 days before they take effect. The "Last updated" date at the top of this page reflects the most recent revision.
11. Contact us
Email: hello@headnote.in
Or visit our Contact page for WhatsApp support.
Grievance Officer: Ayush Shivhare, Founder
Headnote Private Limited, Bhopal, Madhya Pradesh, India