Privacy Policy

1. Our Commitment to Your Privacy

At GST Comply ("Company", "we", "our"), we understand that financial, business, and invoicing records are sensitive and confidential. We are deeply committed to protecting the privacy of our users, business owners, and tax professionals.

This Privacy Policy details how we collect, process, store, protect, and disclose personal and commercial data when you interact with our website, cloud platform, and compliance tools, following the provisions of the Digital Personal Data Protection Act, 2023 (DPDP Act) and the Information Technology Act, 2000.

2. Information We Collect

We collect only the data necessary to provide accurate invoicing and tax filing assistance:

• Account Credentials: Full name, authorized mobile number, email address, password hash.
• Business Registration Data: GSTIN (Goods and Services Tax Identification Number), registered business trade name, PAN, constitution of business, and principal place of business.
• Invoicing & Transaction Details: Customer name and GSTIN, item descriptions, HSN/SAC codes, invoice numbers, tax values (CGST, SGST, IGST), and dates of sale.
• Filing & GSTN Tokens: Encrypted GSTN authentication session tokens (created via OTP authorization from the taxpayer) used exclusively to upload returns to the government portal upon your explicit command.
• Technical Metadata: IP address, browser type, operating system, device identifiers, and platform audit logs for security defense.

3. How We Use Your Data

We process your data strictly under lawful bases to fulfill our software commitments to you:

1. Generating valid, downloadable, and compliant GST tax invoices;
2. Compiling transaction summaries into GSTR-1 and GSTR-3B return schedules;
3. Enabling qualified Chartered Accountants empanelled on our platform to review your books of account;
4. Dispatching critical tax compliance reminders, filing due dates, and security notifications;
5. Preventing fraudulent use, unauthorized logins, and cyber intrusions.

4. Bank-Grade Security & 256-bit Encryption

We treat security with the utmost seriousness. The safeguards implemented include:

• Encryption in Transit: All communications between your browser and our servers are encrypted using modern TLS 1.3 / 256-bit SSL protocols.
• Encryption at Rest: All database records, client backups, and invoice records are stored in AES-256 encrypted volumes.
• Role-Based Access Control (RBAC): Empanelled CAs and technical personnel access data strictly on a need-to-know basis through multi-factor authentication (MFA).
• Continuous Security Auditing: Regular vulnerability scans and penetration testing performed by certified Indian cybersecurity firms.

5. Data Sharing & Third-Party Disclosures

We disclose your data only to the following trusted entities to execute your requested services:

• Government GSTN Portal: Uploading tax schedules to the official GST portal upon your verified approval and OTP authorization;
• Empanelled Chartered Accountants: Independent certified professionals reviewing your return filings;
• Payment Processors: RBI-licensed payment aggregators (e.g., Razorpay, Cashfree) for secure subscription processing. We never store debit/credit card numbers or CVVs on our servers;
• Statutory Authorities: Where mandated by valid Indian court orders, statutory law, or government tax investigative notices.

6. Data Localization (Stored Within India)

All taxpayer data, customer lists, and financial logs are hosted exclusively on ISO/IEC 27001 certified cloud infrastructure physically situated within the territory of the Republic of India (Mumbai and Delhi data centre regions). Your data never leaves Indian borders.

7. Your Rights Under the DPDP Act, 2023

Under Indian data protection laws, you retain extensive control over your personal data:

• Right to Access: You can download a complete copy of all your invoices and business records at any time in CSV or PDF format.
• Right to Correction: You can amend, update, or rectify any inaccurate profile or business detail directly in your dashboard.
• Right to Erasure: You may request the deletion of your account and personal identifiers by contacting our Grievance Officer, subject to mandatory statutory tax retention obligations under the CGST Act (which requires maintaining tax records for up to 72 months).
• Right to Nominate: You have the right to nominate an individual to exercise your data rights in the event of death or incapacity.

8. Cookies & Tracking Technologies

We utilize essential cookies solely to maintain your authenticated login session, secure CSRF tokens, and remember user interface preferences. We do not use intrusive third-party cross-site behavioral tracking cookies.

9. Data Retention Policy

We retain your account profile while your account remains active. As mandated by Section 36 of the CGST Act, registered taxpayers must preserve books of accounts and records for 72 months from the due date of furnishing the annual return for the relevant year. We support you in maintaining these statutory archives securely.

10. Grievance Redressal Officer

In accordance with the Information Technology Act, 2000 and the Digital Personal Data Protection Act, 2023, the details of our designated Grievance Officer are provided below: