GST Notice ToolFor CA firms

Privacy notice

DRAFT — not legal advice. Have this reviewed by a lawyer before launch and fill in every item in [square brackets].

Last updated: [date]

This notice explains what the GST Notice Tool ("we") collects and why, in line with the Digital Personal Data Protection Act, 2023 ("DPDP Act").

1. Two kinds of data

  • Your account data. We are the Data Fiduciary for information about you as a user of the Service.
  • Your clients' data in the files you upload (taxpayer names, GSTINs, invoice details). Your Firm is the Data Fiduciary; we act only as your Data Processor, and only for the time needed to produce your results.

2. Account data we keep

  • Firm name; each user's name, email address and role.
  • A salted, one-way hash of each password (we cannot read your password).
  • Login sessions: a hash of the session token, and expiry time.
  • Usage counts per month (jobs, files, AI-drafted jobs) for billing and limits.
  • Job metadata: time, status, number of files, number of findings, whether AI drafting was used, and an error code if a job failed.
  • Technical logs: time, page route, response status and duration. Logs never contain file contents, client names, GSTINs, amounts or email addresses.

Your IP address is used briefly in memory for rate limiting and by our hosting provider for security; we do not store it in our database.

3. Client data: what happens to uploads

  • Uploaded files are processed in memory and never written to disk or to our database.
  • Results are encrypted with a key held only in memory and deleted automatically after [60] minutes (maximum 24 hours), or immediately when you click "Delete now". A server restart also makes them permanently unreadable.
  • If you choose AI drafting, masked facts (no names, GSTINs, PANs, contact details, document numbers or amounts) are sent to [Anthropic PBC] to generate explanation text. [State the provider's data-retention terms that apply to our account.]

4. Why we process account data

To provide and secure the Service, authenticate users, prevent abuse, bill for use, and meet legal obligations. We do not sell data or use it for advertising.

5. Who we share it with

  • Hosting provider: [name, region — preferably India].
  • AI provider (only for jobs where you choose AI drafting, masked facts only): [Anthropic PBC].
  • Authorities, where required by Indian law.

6. How long we keep it

Account data is kept while your account is active and deleted within [30] days of closure, unless the law requires longer. Client data: see section 3.

7. Security

Passwords are hashed with scrypt; sessions use random tokens stored only as hashes; all traffic uses HTTPS; results are encrypted at rest; access is limited to your Firm; and we apply rate limits and strict browser security headers.

8. Your rights

Under the DPDP Act you may ask to access, correct or erase your personal data, and to nominate another person to exercise your rights. Write to our Grievance Officer: [name, email, address]. We will respond within [the period the DPDP Rules require]. You may also complain to the Data Protection Board of India.

Clients of a Firm should contact the Firm, which is the Data Fiduciary for their data.

9. Changes

We will notify Firm administrators of material changes to this notice.