This Privacy Policy explains how Bizzgyaan Private Limited ("we", "us", "GSTIVITY") collects, uses, discloses and protects personal data when you use the GSTIVITY web application, available at gstai.online and related domains (the "Service"). We are the Data Fiduciary under the Digital Personal Data Protection Act, 2023 ("DPDP Act") and comply with the Information Technology Act, 2000 and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 ("SPDI Rules").
1. Data we collect
- Account data: name, email, mobile, profession/designation, address and (optional) GSTIN provided at sign-up.
- Work product: notices, appeals, drafts, hearing entries, client matter details and files you upload.
- Usage data: IP address, device/browser metadata, log timestamps, feature usage.
- Payment metadata: transaction reference, amount, plan — collected via Razorpay. We do not store card, UPI or bank credentials.
2. Purpose & lawful basis
We process personal data to (a) provide the Service, (b) authenticate you, (c) enable AI-assisted drafting/research, (d) issue invoices and (e) comply with legal obligations. Our lawful basis under the DPDP Act is your consent at sign-up together with legitimate uses necessary for the performance of the service contract.
3. Confidentiality & multi-tenant isolation
Your matters, notices, drafts, diary entries and uploads are private to your account. Access is enforced at the database layer using row-level security policies scoped to your user ID. Administrators can manage account status (validity, plan, trial) but haveno technical access to your case files, drafts or client work.
4. AI processing
When you use AI features, the text you submit (and, where relevant, extracted content from files you upload) is transmitted to our AI gateway and large-language-model providers strictly to generate the requested output. We do not sell your inputs, and inputs are not used to train foundation models.
5. Sub-processors
We rely on the following sub-processors, each bound by contractual data-protection terms: Supabase (managed database, auth & storage), Cloudflare (edge hosting/CDN), Razorpay (payments), and third-party LLM providers accessed through our gateway for AI features.
6. Data retention
Account and work-product data is retained while your account is active and for up to90 days after account closure to allow recovery, after which it is permanently deleted. Invoices and tax records are retained for statutory periods required under Indian tax law.
7. Your rights (DPDP Act)
You may access, correct, update or erase your personal data, withdraw consent, nominate a person to exercise rights in the event of death/incapacity, and file grievances. Write to the Grievance Officer below to exercise these rights.
8. Security
See our Security Practices page for details on encryption, access control, backups and incident response.
9. Cookies
We use strictly necessary cookies/localStorage for authentication and session state. We do not use third-party advertising cookies.
10. Children
The Service is intended for tax professionals and is not directed at persons under 18.
11. Grievance Officer
Bizzgyaan Private Limited
Email: bizzgyaan@gmail.com
Phone: +91 90340 71639
12. Changes
We will notify material changes to this policy by email and by updating the "Last updated" date.