Privacy Policy

1. Company Identity & Controller

2. Information We Collect

A. Account & Identity Data

• Google OAuth profile: name, email address, profile picture, Google user ID
• Company name, GSTIN, industry, phone number (if provided in profile settings)

B. Business & Financial Data (Report Inputs)

• Financial statements, revenue figures, cost data, inventory counts, customer data you upload for analysis
• This data is processed transiently to generate your report and is not sold or shared

C. Payment Data

• Razorpay order ID, payment ID, amount, timestamp — we do NOT store card/UPI credentials
• Payment processing is handled entirely by Razorpay (PCI-DSS compliant)

D. Usage & Technical Data

• IP address, browser/device type, pages visited, timestamps, error logs
• Session cookie (abis_session) — HMAC-signed, HttpOnly, 30-day expiry

3. How We Use Your Data

• Report generation: Your uploaded business data is processed by our ML models and Gemini AI to produce reports
• Account management: Authenticate you, store your report history
• Payment processing: Verify and record transactions via Razorpay
• Service improvement: Aggregate, anonymised analytics to improve accuracy
• Legal compliance: GST invoicing, MCA record-keeping as required by Indian law

We do not sell your data to any third party. We do not use your business data for training AI models without explicit written consent.

4. Data Retention

5. Third-Party Processors

• Razorpay Financial Solutions Pvt Ltd — payment processing (PCI-DSS L1)
• Google LLC — OAuth 2.0 authentication; Gemini AI API for report insights
• Railway Corp — cloud hosting infrastructure (data stored in Singapore/India regions)

6. Your Rights (DPDP Act 2023 & IT Act 2000)

• Right to Access: Request a copy of your personal data
• Right to Correction: Update inaccurate information
• Right to Erasure: Delete your account and associated data
• Right to Grievance Redressal: Raise complaints to our DPO within 7 days response SLA
• Right to Nominate: Nominate a representative under DPDP Act 2023

To exercise any right, email theallworkss@gmail.com with subject "PRIVACY REQUEST".

7. Security Measures

• TLS 1.3 encryption in transit; AES-256 encryption at rest for sensitive fields
• HMAC-SHA256 signed session tokens; no passwords stored
• PostgreSQL with SSL-only connections; least-privilege DB roles
• Razorpay webhook signature verification on all payment callbacks

8. Cookies

We use a single first-party session cookie (abis_session) — strictly necessary for authentication. No advertising or tracking cookies are used. No third-party analytics scripts are loaded.

9. Contact & Grievance Officer