What we collect, and why — itemized

• Account data (name, email, phone): to run your account and orders. Collected at signup with your consent.
• Enquiry data (name, email, optional phone, preferred time and your message) from the “Talk to an expert” and contact forms: used only to reply to that enquiry, with your consent. Updates are sent only if you tick the separate, optional box. Kept for 12 months, then deleted; email [email protected] to have it deleted sooner.
• KYC & filing documents (PAN, business proofs, financial documents): only when an order needs them, under a separate consent, used solely to deliver that service. Never reused for marketing or analytics.
• Marketing preferences: a separate, optional consent. Off by default. Withdrawing it is one click in your account.

Aadhaar: we never store it

We do not ask for, accept, or store full Aadhaar numbers — anywhere, ever. Where a government process requires Aadhaar-based steps, they happen on the government portal with OTPs to your own phone. If a document you upload contains an Aadhaar number, use a masked copy (first 8 digits hidden); our upload guidance reminds you.

How your data is protected

• • PAN and sensitive identifiers are encrypted at rest (AES-256-GCM) and masked on screen by default.
• • Documents live in an access-controlled vault; every staff access is logged with who, what and when.
• • Passwords are hashed (bcrypt); sessions are server-side and revocable from your account page.
• • Data is stored on a server in India operated by Finotrix Global LLP. Visitors reach it through Cloudflare, which carries the encrypted connection to our server. No third-party analytics or advertising pixels run on this site.

Your rights (and the buttons that exercise them)

From your account page you can: export a copy of your data, request correction, request deletion (honoured except where law requires us to retain filing records for statutory periods), and withdraw any consent as easily as you gave it. Each request is acknowledged in-app and answered within 7 days.

If something goes wrong

In the event of a personal-data breach we notify the Data Protection Board and affected users as the DPDP Rules require (intimation without delay, detailed report within 72 hours), alongside CERT-In reporting obligations. Being honest about this possibility is part of taking it seriously.

Grievance officer

Geetha Mounika, Grievance Officer, Finotrix Global LLP — reachable via the grievance page or at [email protected] / +91 81210 26575. Acknowledgement within 48 hours, resolution target 7 days. If unresolved, you may escalate to the Data Protection Board of India.