Privacy Policy
This Privacy Policy explains how GstTracker ("GstTracker", "we", "us") collects, uses, shares, stores and protects your personal data when you use our GST accounting service on WhatsApp and our website. We act as a Data Fiduciary under India's Digital Personal Data Protection Act, 2023 (DPDP Act). By using GstTracker, you agree to this policy and our Terms of Service.
Contents
1. Who we are
GstTracker is operated by Prime Solutions. For any privacy question, contact us at support@gsttracker.in.
2. What data we collect
| Category | Examples | Source |
|---|---|---|
| Contact & identity | Your WhatsApp phone number, your name/business name as set on WhatsApp, your GSTIN and state (if you provide it) | You, via WhatsApp |
| Documents you send | Invoice photos/PDFs, bank statements, GSTR-2B files, voice notes — and the data read from them (vendor, amounts, tax, line items) | You, via WhatsApp |
| Messages | The text you send us and our replies | You, via WhatsApp |
| Usage & technical | Feature usage, timestamps, error logs, and basic website analytics | Automatically |
| Payment | Your subscription plan and payment status. Card/UPI details are handled entirely by our payment processor and are never stored by us | Payment processor |
3. Why we use it & our legal basis
We process your data on the basis of your consent (and, where applicable, the certain legitimate uses permitted by the DPDP Act), only for these purposes:
- To read your invoices and keep your GST books, registers and returns.
- To reconcile your GSTR-2B and show you the Input Tax Credit you may be able to claim.
- To answer your questions and send you the results you asked for.
- To operate, secure, debug and improve the service.
- To process your subscription and, if you opt in, send you service notifications.
We do not sell your data, and we do not use your invoice or financial content for advertising.
4. Consent & how to withdraw it
Because our interface is WhatsApp, we ask for your consent inside the chat. When you first message us, we show you a short notice with links to this policy and our Terms, and you give consent by a clear affirmative action (continuing to use the service). This is also your opt-in to receive service messages from GstTracker. You can withdraw consent or opt out at any time by messaging STOP (to stop messages) or DELETE (to erase your data). Withdrawing consent doesn't affect processing already done, and we may retain limited data where the law requires. See also how to delete your data.
5. Who we share it with
We do not sell or rent your data. We share only the minimum necessary with a small set of trusted service providers who help us run GstTracker, each bound by confidentiality and permitted to use your data only to provide their service to us:
| Category of provider | Purpose |
|---|---|
| Messaging platform | Delivering your chat (GstTracker runs on WhatsApp) |
| Cloud infrastructure & storage providers | Securely hosting the service and storing your books and files |
| Automated processing partners | Reading and structuring the data in the documents you send |
| Payment processor | Handling subscription payments |
Some providers may process data outside India; we transfer data only as permitted under the DPDP Act and applicable notifications, and require appropriate safeguards. We may also disclose data if required by law, or to protect our rights, our users or the public.
6. How long we keep it
We keep your data for as long as your account is active and as needed to provide the service, plus any period required by tax, accounting or other laws. When you ask us to delete your data (or after prolonged inactivity), we erase it, except records we must retain by law.
7. How we protect it
We use reasonable technical and organisational security safeguards, including encryption of your data in transit and access controls designed so that each user can only ever access their own data. No system can be guaranteed perfectly secure, but we work to protect your data, and in the event of a reportable personal-data breach we will notify you and the Data Protection Board of India as required by law.
8. Your rights
As a Data Principal under the DPDP Act, you have the right to:
- Access — get a summary of the personal data we process about you.
- Correction & completion — fix or complete your data.
- Erasure — have your consent-based data deleted (subject to legal retention).
- Grievance redressal — complain to us and escalate to the Data Protection Board of India.
- Nominate — nominate another person to exercise your rights in the event of death or incapacity.
- Withdraw consent — at any time, as easily as you gave it.
To exercise any right, message us on WhatsApp (e.g. data, delete) or email support@gsttracker.in. We'll respond within the timelines required by law.
9. Complaints & grievances
If you have any concern about how we handle your data, please contact us at support@gsttracker.in and we will work to resolve it. If your complaint isn't resolved to your satisfaction, you may escalate to the Data Protection Board of India as provided under the DPDP Act.
10. Children
GstTracker is a business tool intended for users aged 18 and above. We do not knowingly process the personal data of children, and we do not use anyone's data for behavioural tracking or advertising directed at minors.
11. Changes & contact
We may update this policy; we'll change the "Last updated" date above and, for material changes, notify you on WhatsApp. Questions? Email support@gsttracker.in.