What we do with your information

Version 2026-08-31

To prepare your claim documents, Mera Hissa collects and processes personal data about you, the person who has died, and the other legal heirs— including a death certificate and details of a family member’s money. This notice explains what we collect, why, who processes it on our behalf, and how you can have it deleted. We have tried to design the service so that as little of it exists, in as few places, for as short a time, as the job allows.

Mera Hissa is the data fiduciary for this information under the Digital Personal Data Protection Act 2023. We process it only to prepare and review your documents and to contact you about your case — never to advertise to you, and never for any purpose you have not agreed to.

What we collect, and why

• The deceased’s name and date of death. Printed on every claim form. Without them there is nothing to file.
• Each heir’s name and relationship. The relationship decides the legal share; the name goes on the affidavit.
• Institution names, and the last four digits of an account. We never ask for a full account number. The bank already knows it.
• A value range, not a balance. Ranges are all the document rules need, and a range tells anyone who saw it far less than a balance would.
• PAN or Aadhaar, only where a form requires it. Stored encrypted, shown to you masked, and never sent to any AI system.

Documents you upload

Text is read from your scans on your own device, in your browser. Nothing is sent anywhere during that step. You see what we extracted, correct it, and only then does the file itself reach us.

Stored files sit in a private bucket. They are reachable only through a link we generate for you that stops working after ten minutes.

How we use AI, and what it never sees

We use an AI model to draft covering letters and affidavit wording. The model is run by a third-party inference provider (currently Groq or OpenRouter, depending on availability), so the tokenised prompt described below leaves our servers and is processed by them. Before anything is sent, every name, account reference and institution is replaced with a placeholder such as {{HEIR_1}}. The model receives the shape of your case — which law applies, what kinds of asset there are — and never a single real name. Real values are put back on our own servers afterwards.

PAN and Aadhaar are not even placeheld. They are simply never included.

A check runs on every outbound request and blocks it outright if it detects anything resembling an identifier. If that check fires, your case stops and a person looks at it. It never quietly sends anyway.

Your information is not used to train any AI system, ours or anyone else’s.

How long we keep it

Documents are deleted 90 days after your case closes, automatically. You can delete everything sooner, at any time, from your case page — it is a real deletion, not a hidden flag, and we cannot recover it afterwards.

We keep a record of actions taken on a case — that a pack was approved, that a document was downloaded. That log holds no names and no case contents.

Who else processes it

We use a small number of third-party service providers, who process your data only on our instructions and only to run this service:

• The Mera Hissa reviewer who checks your pack before it reaches you.
• Supabase — hosts the database, the file storage, and sends your sign-in link by email.
• Vercel — hosts and serves the website itself.
• Groq / OpenRouter — the AI inference provider, which receives placeholder tokens only, as described above.
• Razorpay — for payment. We never see or store your card or UPI details.
• An advocate, only if you ask us to introduce you, and only what you agree to share.

Some of these providers may process data on servers outside India. We do not sell your data to anyone, we do not share it for anyone else’s advertising, and there are no advertising or analytics trackers on this site.

Your rights

Under the Digital Personal Data Protection Act 2023 you can ask us what we hold about you, ask us to correct it, and ask us to erase it. The erase button is on your case page and works immediately. For anything else, write to us and we will answer within 30 days.

If something goes wrong

If your information is exposed, we will tell you and the Data Protection Board — what happened, what was affected, and what we are doing. We would rather tell you awkwardly than not tell you.