What we do with your information

Version 2026-08-31

To prepare your claim documents, Mera Hissa collects and processes personal data about you, the person who has died, and the other legal heirs— including a death certificate and details of a family member’s money. This notice explains what we collect, why, who processes it on our behalf, and how you can have it deleted. We have tried to design the service so that as little of it exists, in as few places, for as short a time, as the job allows.

Mera Hissa is the data fiduciary for this information under the Digital Personal Data Protection Act 2023. We process it only to prepare and review your documents and to contact you about your case — never to advertise to you, and never for any purpose you have not agreed to.

What we collect, and why

• The deceased’s name and date of death. Printed on every claim form. Without them there is nothing to file.
• Each heir’s name and relationship. The relationship decides the legal share; the name goes on the affidavit.
• Institution names, and the account, folio or policy number. We ask for this in full because the institution’s own claim form has to carry it. It is stored encrypted with a key held outside the database, shown back to you masked, never sent to any AI system, and deleted with your case.
• A value range, not a balance. Ranges are all the document rules need, and a range tells anyone who saw it far less than a balance would.
• PAN or Aadhaar, only where a form requires it. Stored encrypted, shown to you masked, and never sent to any AI system.

If you ask us to email your free-check checklist

The free check runs in your browser and its answers stay there, unless you press Email me this checklist. Then we receive your email address and the shape of your answers — the succession law, how many relatives and how they are related, the kinds of holding, and whether there was a nominee. No names, no institutions, no amounts. We use them to send that one email and, only if you ticked the separate box, three follow-up emails over the following ten days, each with a link that stops them. We never share your address, and delete it after a year if you do not become a customer.

Documents you upload

Text is read from your scans on your own device, in your browser. Nothing is sent anywhere during that step. You see what we extracted, correct it, and only then does the file itself reach us.

Stored files sit in a private bucket. They are reachable only through a link we generate for you that stops working after ten minutes.

How we use AI, and what it never sees

We use an AI model to draft covering letters and affidavit wording. The model is run by a third-party inference provider (currently Groq or OpenRouter, depending on availability), so the tokenised prompt described below leaves our servers and is processed by them. Before anything is sent, every name, account reference and institution is replaced with a placeholder such as {{HEIR_1}}. The model receives the shape of your case — which law applies, what kinds of asset there are — and never a single real name. Real values are put back on our own servers afterwards.

PAN and Aadhaar are not even placeheld. They are simply never included.

A check runs on every outbound request and blocks it outright if it detects anything resembling an identifier. If that check fires, your case stops and a person looks at it. It never quietly sends anyway.

Your information is not used to train any AI system, ours or anyone else’s.

How long we keep it

When you tell us a case is finished, you close it from your case page. That starts a 90-day clock, and it is the only thing that does.

For those 90 days everything stays exactly as it is, so that you can come back for another copy — which families regularly need, because an institution mislays a form. After 90 days the following are deleted automatically:

• every document you uploaded, from the database and from file storage;
• every pack we prepared for you, including the account numbers printed in it;
• the details of the estate — the heirs, the holdings, the account references;
• the name and date of death of the person who died.

What is left afterwards is deliberately thin:

• that a case existed, that it closed, and on what date — so we can answer you if you write to us about it later;
• your payment record, which we are required to keep for tax and accounting. It holds an amount and an order number, not the estate;
• the feedback you chose to leave, if you left any;
• your email address, which is your sign-in identity.

We only write to you after a case closes if you ticked the box saying we may. That is a separate permission from the one you gave when you signed up, it is recorded with the date you gave it, and you can withdraw it by writing to us.

You do not have to wait for any of this. Delete this case on your case page removes everything immediately — it is a real deletion, not a hidden flag, and we cannot recover it afterwards.

We keep a record of actions taken on a case — that a pack was prepared, that a document was downloaded. That log holds no names and no case contents.

Who else processes it

We use a small number of third-party service providers, who process your data only on our instructions and only to run this service:

• A Mera Hissa reviewer, where your case is held for manual preparation rather than prepared automatically.
• Supabase — hosts the database, the file storage, and sends your sign-in link by email.
• Vercel — hosts and serves the website, and counts page views for us. That counting is cookieless and aggregate: it sets no cookie, stores no IP address, and cannot identify you or follow you to other sites. It tells us that a guide was read, not who read it.
• PostHog — product analytics, which shows us which parts of the site people actually find useful. Unlike the page-view count above, PostHog sets a cookie in your browser so a returning visitor can be recognised, and processes that data on servers in the United States. It records how the site is used — pages visited and buttons pressed — not the contents of your case. On the free check it records only which step you reached, never your answers.
• Groq / OpenRouter — the AI inference provider, which receives placeholder tokens only, as described above.
• Razorpay — for payment. We never see or store your card or UPI details.
• An advocate, only if you ask us to introduce you, and only what you agree to share.

Some of these providers may process data on servers outside India. We do not sell your data to anyone, we do not share it for anyone else’s advertising, and there are no advertising trackers on this site — the measurement described above is used only to improve the service.

Your rights

Under the Digital Personal Data Protection Act 2023 you can ask us what we hold about you, ask us to correct it, and ask us to erase it. The erase button is on your case page and works immediately. For anything else, write to us and we will answer within 30 days.

If something goes wrong

If your information is exposed, we will tell you and the Data Protection Board — what happened, what was affected, and what we are doing. We would rather tell you awkwardly than not tell you.