Privacy Policy

1. Overview

This Privacy Policy explains how GSTMind ("we," "us," "our") collects, uses, stores, and protects your personal data when you use GSTMind Docs at docs.gstmind.in (the "Platform").

This policy is drafted in compliance with the Digital Personal Data Protection Act, 2023 (DPDP Act) and rules notified thereunder, as well as the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011.

By creating an account, you provide your free, specific, informed, and unambiguous consent to the processing of your personal data as described in this Policy.

2. What We Collect

2.1 Information you provide

2.2 Information collected automatically

2.3 What we do NOT collect

• We do not collect payment card details (handled by payment processor when billing is enabled)
• We do not collect government identity numbers (Aadhaar, PAN, etc.)
• We do not track your activity outside our Platform
• We do not use advertising trackers or third-party analytics pixels

3. How We Use Your Data

• Account creation and management — To set up, maintain, and secure your account
• Authentication — To send OTP codes for login and verification
• Service delivery — To provide access to documents and personalised features (recently viewed, etc.)
• Communications — To send service emails including trial expiry notices, new document alerts (if opted in), and important policy updates
• Security — To detect and prevent fraud, abuse, and unauthorised access
• Analytics — To understand how the Platform is used and improve it (aggregated, non-identifiable where possible)
• Legal compliance — To comply with applicable laws, court orders, or regulatory requirements

We do not use your data for automated decision-making or profiling that produces legal or similarly significant effects.

4. Legal Basis for Processing

Under the DPDP Act 2023, we process your personal data on the following basis:

• Consent — For optional data (profession, email alerts) and marketing communications. You may withdraw consent at any time.
• Contract performance — For data necessary to provide the Platform services you have registered for
• Legitimate interests — For security monitoring, fraud prevention, and service improvement, where these interests do not override your privacy rights
• Legal obligation — Where we are required to process data to comply with applicable Indian law

5. Data Sharing & Disclosure

5.1 Service providers

We share limited data with the following service providers solely for operating the Platform:

All service providers are contractually bound to process your data only for the specified purpose and to maintain appropriate security measures.

5.2 Legal disclosure

We may disclose your personal data where required by:

• A court order, subpoena, or other legal process
• A lawful request from a government or regulatory authority
• To protect the rights, property, or safety of GSTMind, our users, or the public

We will notify you of such requests where permitted by law.

5.3 Business transfers

In the event of a merger, acquisition, or sale of assets, your data may be transferred to the acquiring entity, subject to the same privacy protections. You will be notified of any such transfer.

6. Data Retention

Upon account deletion, we will delete or anonymise your personal data within 30 days, except where retention is required by law.

7. Security

We implement reasonable technical and organisational security measures to protect your personal data, including:

• Encryption in transit — All data transmitted between your browser and our servers is encrypted using industry-standard protocols
• Encryption at rest — Database data is encrypted at rest by our hosting infrastructure
• Passwordless authentication — We do not store passwords; login is via one-time codes only
• Secure session management — Session cookies are HTTP-only and inaccessible to client-side scripts
• Abuse prevention — Authentication endpoints are protected against automated abuse
• Access controls — Database access is restricted to our application backend only and is not publicly accessible
• Administrative security — Administrative functions require multi-factor authentication

8. Your Rights Under the DPDP Act 2023

To exercise any of these rights, email us at support@gstmind.in with the subject line "Privacy Request." We will respond within 30 days.

9. Cookies & Similar Technologies

We use cookies and similar technologies solely for operational purposes:

We do not use advertising cookies, tracking pixels, or third-party analytics cookies. We do not participate in cross-site tracking of any kind.

You may disable cookies in your browser settings, but this will prevent you from logging in to the Platform.

10. Children's Privacy

The Platform is not directed at children under the age of 18. We do not knowingly collect personal data from children. If we become aware that a child under 18 has provided personal data, we will delete that information promptly. If you believe a child has registered on the Platform, please contact us at support@gstmind.in.

11. Third-Party Services

The Platform may contain links to third-party websites such as CBIC (cbic.gov.in) and ICAI (icai.org). When you leave our Platform, this Privacy Policy no longer applies. We encourage you to read the privacy policies of any third-party sites you visit.

We are not responsible for the privacy practices of third-party websites.

12. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or applicable law. When we make material changes, we will:

• Update the "Last updated" date at the top of this page
• Send an email notification to registered users
• Where required by law, seek fresh consent for any new or changed processing activities

13. Contact & Grievance Officer

Under the DPDP Act 2023 and IT Rules 2011, we have designated a Grievance Officer to address your privacy concerns:

If you are not satisfied with our resolution, you may approach the Data Protection Board of India once it is constituted under the DPDP Act 2023.