Trust & Compliance / Subprocessors
Subprocessor List
Version 1.0 · Effective 8 May 2026
What this document is
A "Subprocessor" is a third-party service provider engaged by LegalInk AI ("LegalInk") to process Customer Personal Data on our behalf in the course of delivering the LegalInk service. This list identifies every Subprocessor we currently engage, what they do for us, the categories of data they receive, and where that data is hosted.
We publish this list in keeping with industry-standard transparency practices and to support our customers' obligations under the Digital Personal Data Protection Act, 2023 ("DPDP Act") and other applicable privacy regimes. Where the DPDP Act is in force, LegalInk acts as a Data Processor in respect of Customer content and the Subprocessors below act as further processors under our contractual oversight.
How this list is maintained
- Enterprise customers receive a minimum of 30 days' written notice before any new Subprocessor begins processing their data. Notice is sent to the primary billing contact on file.
- Enterprise customers may object to a new Subprocessor in writing within the 30-day notice period. We will work in good faith to address objections and, where unresolved, the customer may terminate the affected service for that cause without penalty.
- The current list and prior versions are available at legalink.co.in/trust/subprocessors and on request via support@legalink.ai.
- An update history is maintained at the bottom of this page.
Active Subprocessors
3.1 AI Reasoning & Drafting
| Subprocessor | Purpose | Data Categories | Hosting Region |
|---|---|---|---|
| Anthropic (Claude) | Conversational AI (Inka chat) and deep reasoning tools — Brief Generator, Case Strength, Counter-Argument, Research Deep Analysis. | Prompts, uploaded document text, chat transcripts. | United States (enterprise API, no training on customer data). |
| Google (Gemini via Lovable AI Gateway) | Drafting engine — Gemini Pro for paid plans, Flash for free tier. | Prompts, structured fields, uploaded document text. | United States / global (no training on customer data). |
| Groq (Whisper) | Voice transcription (Hindi + English). | Audio recordings transcribed in real time, not retained after transcription. | United States. |
3.2 Infrastructure & Storage
| Subprocessor | Purpose | Data Categories | Hosting Region |
|---|---|---|---|
| Supabase | Primary database, authentication, file storage, edge function runtime. | Account data, drafts, uploads, chat history, billing records. | Tokyo (ap-northeast-1). Mumbai (ap-south-1) on Q4 2026 roadmap. |
| Lovable | Application hosting and edge function orchestration layer. | Static frontend assets, runtime requests in transit. | Global edge network. |
3.3 Payments & Billing
| Subprocessor | Purpose | Data Categories | Hosting Region |
|---|---|---|---|
| Razorpay | Payment processing for subscriptions, top-ups, and invoicing. | Name, email, billing address, GSTIN, payment metadata. Card details processed by Razorpay; LegalInk does not store card numbers. | India. |
3.4 Communications
| Subprocessor | Purpose | Data Categories | Hosting Region |
|---|---|---|---|
| Resend | Transactional email — auth, receipts, support replies, broadcast notices. | Email address, name, message content. | United States / EU. |
3.5 Legal Research
| Subprocessor | Purpose | Data Categories | Hosting Region |
|---|---|---|---|
| IndianKanoon | Public case-law lookups invoked by Inka research tools. | Search queries (no customer document content sent). | India. |
3.6 Analytics & Marketing Attribution
| Subprocessor | Purpose | Data Categories | Hosting Region |
|---|---|---|---|
| Google Analytics + Google Ads | Website analytics and paid-acquisition attribution. | Pseudonymous device/session identifiers, page paths, referrer. No draft content. | United States / global. |
Important Disclosure
Hosting Region
Today, all production customer data is stored on Supabase's enterprise infrastructure in the Tokyo (ap-northeast-1) region. Some Subprocessors above (Anthropic, Google Gemini, Groq, Resend, Google Analytics) process data in the United States, the European Union, or globally distributed edge networks.
India (Mumbai, ap-south-1) data residency is on our Q4 2026 roadmap and will be planned alongside our ISO 27001 readiness work. Until that migration is complete, customers with strict India-residency requirements should evaluate this constraint as part of their own compliance review.
We will not silently change hosting regions. Any change to the primary production region will be notified to Enterprise customers under the same 30-day notice process described above.
Services NOT engaged for customer data
For clarity, the following services are used internally by LegalInk but do not process customer Personal Data or draft content:
- OpenAI (GPT Image generation) — used only by our internal brand and marketing image pipeline. No customer data is ever sent.
- GitHub — source code hosting for LegalInk engineering. No customer data is stored in the repository.
- Internal productivity tools (notes, docs, task tracking) used by the LegalInk team — no customer data is uploaded.
Customer rights regarding Subprocessors
- Right to advance notice. Enterprise customers receive at least 30 days' written notice before a new Subprocessor begins processing their data.
- Right to object. Enterprise customers may object in writing during the notice period. If a good-faith resolution cannot be reached, the affected service may be terminated without penalty for that cause.
- Right to information. Customers may request additional detail about any Subprocessor — purpose, data flows, contractual safeguards — by writing to support@legalink.ai.
- Right to audit responses. Enterprise customers may submit security and compliance questionnaires; we respond honestly, in writing, within 48 hours.
Update history
| Date | Version | Change | Reason |
|---|---|---|---|
| 8 May 2026 | 1.0 | Initial publication of Subprocessor List. | Trust & Compliance program launch. |
Contact
Questions about this Subprocessor List, objections to a new Subprocessor, or compliance documentation requests should be sent to support@legalink.ai.
Suggested subject lines: "Subprocessor objection — [Customer name]", "Subprocessor information request — [Subprocessor]", "Compliance questionnaire — [Customer name]".