Privacy Policy

We collect the minimum a filing needs. We do not sell your data, we do not use it for advertising, and we do not keep Aadhaar photocopies.

This policy is written with the Digital Personal Data Protection Act, 2023 in mind. You have rights over your data and they are set out below.

Account details: your mobile number or email address, and a name if you give one. These identify you and let us tell you what is happening with your filings.

Filing details: the information a particular application requires — business name, address, turnover band, the identifiers a form asks for. What we ask for varies by service and is listed on that service's page before you start.

Payment records: the amount, the time, and the payment reference. Card and bank details are handled entirely by Razorpay, our payment processor. We never see or store them.

Usage data: basic technical logs needed to keep the service running and secure.

We do not store Aadhaar photocopies. Where a filing needs an Aadhaar reference we work from a masked number or an offline XML, held in private storage with short retention.

This is deliberate. Aadhaar copies are the single most sensitive thing a business in our position could accumulate, and the safest way to hold them is not to.

To prepare and file the applications you have asked us to file — the contract between us.

To meet our own legal and tax obligations, including keeping records of transactions for the periods the law requires.

To keep the service secure and prevent fraud.

We do not use your data to train models, and we do not sell or rent it to anyone.

The relevant government portal, when we file your application — that is the point of the exercise, and it is filed in your name.

Our infrastructure providers, who host the service under contract and process data only on our instructions.

Razorpay, for payments.

Anyone we are legally required to disclose to, on a valid order.

Filing records for as long as the relevant tax and corporate law requires us to hold them, then deletion.

Uploaded documents for as long as the filing is live plus a short period for departmental queries, then deletion.

You can ask us to delete your account and we will, except where we are legally required to retain a record.

You can ask what we hold about you, ask us to correct it, ask us to delete it, and withdraw consent where processing rests on consent.

You can also complain to us, and if we do not resolve it, to the Data Protection Board. Our grievance contact is on the Contact page.

Data is encrypted in transit and at rest. Access is restricted to the staff who need it for your filing. Documents sit in private storage reachable only through short-lived signed links, never a public URL.