Privacy policy
Last changed on 13 October 2026.
In short. A deed writer's office uses Bharatlekh to keep its clients' papers and draw their deeds. Those papers belong to the client and are the office's responsibility; we hold them for the office, in India, encrypted, apart from every other office's, and we do nothing with them except what the office asks.
We do not sell data, show advertisements, or use anybody's documents to train anything.
Who we are
Bharatlekh is run by Arvind Tyagi, proprietor, trading as Tyagi Tech Consulting, Flat No. 108, First Floor, Tower-J, Amrapali Silicon City, Plot No. GH-01A, Sector-76, Noida, Gautambuddha Nagar, Uttar Pradesh 201301, India (GSTIN 09AJKPT3455F1ZU). "We" in this policy means that firm.
Two kinds of people, two kinds of data
The office and its staff. The deed writer or property dealer whose office is signed up, and the people who work for them. We hold their names, mobile numbers, what role they have, when they last signed in, and the firm's billing details. For this we decide what is collected and why, and the law calls us the data fiduciary.
The office's clients. The buyers, sellers, landlords and tenants whose deeds the office draws. The office collects their papers to do the work the client came for, and puts them into Bharatlekh. The office decides what is collected and why; we process it on the office's instructions, and the law calls the office the data fiduciary and us its data processor. If you are a client, the office you went to is who answers for your papers, and we help it do so.
What is held about a client
- Name, relation (son, daughter or wife of), date of birth, gender, address, mobile number and PAN, as read from the cards the client gave the office or as typed by the office.
- The last four digits of the Aadhaar number, and no more. The full number is never kept as data. Where a number is read from a picture it is checked, reduced to four digits, and the rest is discarded at once.
- The pictures and PDFs of the cards and deeds themselves, as the office uploaded them. A picture of an Aadhaar card shows the full number, which is one reason these files are encrypted. On screen, the service covers all but the last four digits of it; the picture is printed in full only for the copy of the card that goes with a deed to the sub-registrar. To find where a card prints its number, the picture is sent once to the same reading service in Mumbai that reads cards.
- Details of the property and of the transaction, and the deeds drawn from them.
- For each document read by a machine: that it was read, when, for which firm, and where.
- For a scanned property document, such as a registered deed: the text of each page as it was read, kept with the scan so that the two can be checked against each other and the deed is not read again. Any full Aadhaar number in it is reduced to its last four digits before it is kept. For a card, what it said is not kept beyond the client's details above.
We do not collect biometrics, do not use Aadhaar authentication, and do not ask UIDAI anything. An Aadhaar QR code is checked on our own server against UIDAI's published certificates.
What it is used for
To let the office keep its records, quote costs and draw documents, and for nothing else. We do not look at client data except where the office asks us to help with a problem, or where we must to keep the service working and secure.
When an office asks us for help
Anybody in an office can raise a support ticket from any screen of Bharatlekh. A ticket carries what they write or say in a voice note, any files they add, and a picture of the screen they were on, which they see before it is sent and can leave out. That picture may show a client's details. It also carries the size of the screen, the browser, and the names of the last few things done in the service before it was raised, such as which screen was opened and whether a step failed; never what was typed into a form.
A voice note is written down as the ticket is sent, in Hindi and in English, by the same service in Mumbai that reads cards, and what it says is kept on the ticket for the office and support to read. Where the ticket's few words do not say what it is about, it takes a title from what was said. A ticket is kept with the office's own records, encrypted like them, and only Bharatlekh support at Tyagi Tech Consulting reads it. Each time support opens a ticket or one of its files, that is written in the office's activity log. The office may also tell us about a ticket on WhatsApp, from its own phone to our support number; that is a message like any other the office chooses to send.
When an office asks to join
An office signs up from a form in Bharatlekh. It gives the office's name and address, the owner's name, mobile number and, if it likes, email, its GSTIN if it has one, and, if somebody told it about Bharatlekh, that person's name and mobile number. Before the request is sent, a code goes to the owner's mobile number on WhatsApp and is typed into the form, to show that the number is theirs. We use these to decide on the request, to speak to the owner, to open the account and to make out invoices; and the mobile number of the person who told the office about us, to know whom to thank, and to give them any credits we offer for it. The request is a support ticket, read only by Bharatlekh support at Tyagi Tech Consulting.
Where it is kept, and how
- On servers in Mumbai, India.
- Every uploaded card, scan and drawn deed, and the text read from a scan, is stored encrypted, under a key kept apart from the data.
- Each firm's records are in a database and a folder of their own, which no other firm's requests can open.
- Everything travels over encrypted connections.
- Each person in an office signs in as themselves, with a one-time code sent to their own WhatsApp. The owner of the firm decides who has access and can remove it at once.
The companies that handle the data for us
We use these and no others. None of them may use the data for purposes of their own.
| Company | What it does | What it sees | Where |
|---|---|---|---|
| Utho Cloud | Runs the server the service and its data live on | The encrypted files and the database, as stored | Mumbai, India |
| Google Cloud (Vertex AI) | Reads a picture of a card, or a page of a scanned deed, when it cannot be read from a QR code or from the document's own text; and writes down a voice note left on a support ticket | That one picture, page or voice note, to read it. Caching is switched off for our account, so Google keeps no copy to answer later requests. Google may keep a record of a request for up to 30 days to detect abuse of its service, and does not use it to train its models. | Mumbai, India |
| Cloudflare | Stands in front of the service to protect it from attack | Traffic passing through. It is encrypted on the way in and on the way out, and Cloudflare opens it at its edge to screen it for attacks; it stores none of it. | The nearest of its locations, which for a visitor in India is usually in India and may be abroad |
| Meta (WhatsApp Business) | Delivers the one-time sign-in code | The mobile number of the office's own staff member, and the code. Never anything about a client. | As WhatsApp operates |
| Razorpay | Takes payment from the office | The office's payment details, which we never see or hold | India |
How long it is kept
- An office's records are kept while its account is open, because a deed writer is asked about a deed for years afterwards. The office's owner can delete a client, a property or a transaction at any time. Anybody in the office can archive one, which only takes it out of the everyday list: an archived record and its papers are still held, until the record is deleted.
- Nothing an office keeps is deleted by the service on its own: a client, a property, a transaction and the papers kept against them stay until the office deletes them, or leaves.
- Every file handed over is first kept as an upload. What is kept is copied from there into a client's or a property's papers, a format or a ticket. A card read from its picture and not yet saved to a client is kept, with what was read from it, until the office saves it or throws it away. Any other upload, being a copy of something kept elsewhere or a file the office did not keep, is removed after seven days, with any text read from it.
- The owner of an office can download a copy of all its records at any time, from Settings, and a copy of what is held about one client from that client's page. Deleting a client, a property or a transaction deletes the papers kept against it, the files and the text read from them as well as the record.
- When an office leaves, its records are erased within 30 days, except what the law requires us to keep, such as invoices.
- The service writes down who in an office signed in, any sign-in to the office that was turned away, and who opened, changed, took a copy of or deleted which record, with the time and the internet address it came from. The office's owner can read it, nobody can change it, and each line is removed after a year. A line names the client or property concerned, so a client who has been deleted is still named in the line that says who deleted them, until that line is a year old.
- A request to join that does not lead to an account has the details it gave erased six months after it was made; the ticket that carried it keeps only the name and mobile number of whoever sent it. Where an account is opened, the details are kept as the office's own, with who told it about us.
- Support tickets are kept with the office's records. The picture of the screen and any files added to a ticket are removed 30 days after the ticket is closed. What was written on it, any voice note, and what the voice note was heard to say are kept with the office's records, so that what was said can be checked if it is ever in question, and go when those records do.
- When the owner of an office sends a drawn document back to be drawn again, they may leave a voice note for whoever drew it. It is kept encrypted with the document, heard only by the office, and removed as soon as the document drawn again is checked.
- Sign-in codes stop working after five minutes. The record of whether each was delivered is kept for 30 days.
Your rights
You may ask what is held about you, have it corrected, have it erased, withdraw a consent you gave, and name somebody to act for you. If you are a client of an office, ask the office, which can do all of these directly; if you are a member of an office, ask us. Either way you may complain to us at the address below, and if we do not settle it, to the Data Protection Board of India.
Children
The service is for offices and is not offered to children. A deed sometimes names a minor as an owner; the office must have the parent's or guardian's consent before it records a minor's details.
If something goes wrong
If personal data is lost, seen by somebody who should not have seen it, or otherwise breached, we will tell the offices affected and the Data Protection Board without delay, with what happened, what it affects and what we are doing about it.
This website
This website sets no cookies, runs no scripts and carries no trackers or advertisements. The service itself, at https://app.bharatlekh.com, sets one cookie when you sign in, to keep you signed in, and nothing else.
Changes
When this policy changes, the date at the top changes, and offices are told of anything that matters before it takes effect.
Contact, and the person responsible
Arvind Tyagi, proprietor, Tyagi Tech Consulting
[email protected] · +91 98341 73568
Flat No. 108, First Floor, Tower-J, Amrapali Silicon City, Plot No. GH-01A, Sector-76, Noida, Gautambuddha Nagar, Uttar Pradesh 201301, India
We acknowledge within two working days and answer within fifteen days.