Privacy Policy

1. Who this policy applies to

This policy applies to:

• Chartered Accountants, CA firms, and staff who register for Aalekh accounts;
• SME and business users onboarded directly or through their CA;
• Client portal users whose data is managed by a subscribing firm;
• Website visitors, demo requestors, and newsletter subscribers.

If you are an end-client of a CA firm using Aalekh, your CA firm is typically the primary decision-maker for how your business data is processed. We process that data on the firm's instructions to deliver the Service.

2. Information we collect

Depending on how you use Aalekh, we may collect the following categories of information:

• Account information: Name, email, phone number, firm name, role, password (stored in hashed form), billing details, and subscription preferences.
• Client and business data: GSTINs, PAN, invoices, purchase and sales records, bank statements, reconciliation data, ITR/GST filing status, ledgers synced from Tally or other systems, and documents you or your clients upload.
• Communications: Messages and files sent via WhatsApp, email, or in-app chat integrations connected to your account.
• Usage and technical data: IP address, device type, browser, log-in timestamps, feature usage, audit logs, and error diagnostics.
• Marketing and support: Demo form submissions, support tickets, and newsletter email addresses.
• Cookies and analytics: See Section 10 below.

We do not intentionally collect sensitive personal data beyond what is necessary for financial and tax compliance workflows you choose to run on the platform. Do not upload information you are not authorized to share.

3. How we use your information

We use personal data to:

• Provide, maintain, and secure the Service (including GST automation, reconciliation, client dashboards, and integrations);
• Authenticate users, enforce role-based access, and maintain audit trails;
• Process subscriptions, invoices, and customer support requests;
• Send service notifications, deadline alerts, and product updates you opt into;
• Improve features, train and evaluate AI models only in aggregated or de-identified form where feasible, and fix bugs;
• Comply with legal obligations and respond to lawful requests from authorities.

4. Legal basis and your consent

Under the DPDP Act, we process personal data based on your consent, performance of a contract (providing the Service you subscribed to), compliance with law, and legitimate uses permitted for security, fraud prevention, and service improvement.

Where we rely on consent (for example, marketing emails or optional cookies), you may withdraw consent at any time without affecting the lawfulness of processing before withdrawal.

5. How we share information

We do not sell your personal data. We may share data with:

• Service providers: Cloud hosting (e.g., AWS), payment processors, email and SMS/WhatsApp delivery partners, analytics providers, and customer-support tools — under contracts requiring appropriate security and use limitations.
• Integrations you enable: Tally, Zoho Books, GST portals, and other third parties when you connect them.
• Your CA firm or team: Other authorized users within your tenant based on permissions you configure.
• Legal and safety: Regulators, courts, or law enforcement when required by applicable law or to protect rights and safety.
• Business transfers: A successor entity in connection with a merger, acquisition, or asset sale, with notice where required.

6. Data storage and residency

We design Aalekh for India-focused financial operations. Primary production data is stored on secure cloud infrastructure with India data residency where applicable for customer workloads, as described on our Security page.

Learn more: Security & Privacy

7. Security

We implement technical and organizational measures including TLS encryption in transit, encryption at rest, tenant isolation, role-based access control, bcrypt password hashing, and immutable audit logs for sensitive actions.

No method of transmission or storage is 100% secure. You are responsible for safeguarding credentials and configuring appropriate internal access for your firm.

8. Data retention

We retain personal data for as long as your account is active and as needed to provide the Service, comply with law, resolve disputes, and enforce agreements.

• After subscription cancellation, account data may be retained for up to 90 days to allow export or reactivation, as described in our Refund & Cancellation Policy, after which it may be deleted or anonymized.
• Backup copies may persist for a limited period before automatic purging.
• We may retain anonymized or aggregated statistics that do not identify individuals.

9. Your rights under the DPDP Act

Subject to applicable law, you may have the right to:

• Access personal data we hold about you;
• Correct inaccurate or incomplete data;
• Erase data when it is no longer necessary or when consent is withdrawn (subject to legal retention needs);
• Nominate another individual to exercise rights in the event of death or incapacity;
• Grievance redressal regarding our processing practices.

To exercise these rights, contact [email protected] with the subject line "Privacy Request" and include your account email and firm name. We will respond within timelines prescribed under applicable law.

10. Cookies and analytics

Our website uses cookies and similar technologies for essential functionality, preferences, and—where you consent—analytics and marketing tags (such as Google Analytics or Google Tag Manager loaded after cookie consent).

You can manage cookie preferences through our cookie banner or your browser settings. Disabling certain cookies may limit some features.

11. Children's privacy

The Service is not directed to individuals under 18. We do not knowingly collect personal data from children. Contact us if you believe we have collected such data inadvertently.

12. Third-party links

Our website may link to third-party sites (for example, social media or partner tools). We are not responsible for their privacy practices. Review their policies before providing personal data.

13. International transfers

Where limited technical support or subprocessors involve processing outside India, we ensure appropriate contractual safeguards and only transfer data as permitted under applicable Indian law.

14. Changes to this policy

We may update this Privacy Policy periodically. The "Last updated" date at the bottom of this page will reflect the latest version. Material changes may be communicated by email or in-app notice to account administrators.

15. Grievance and contact

For privacy questions, complaints, or data requests:

• Data fiduciary: Yoursuperidea Technologies Pvt Ltd (Aalekh AI)
• Address: Gurgaon, Haryana, India, 122002
• Office: UG006, MGF Metropolis Mall, MG Road, Gurugram, Haryana, India, 122002
• Email: [email protected]
• Contact form: Contact Us
• Business hours: Monday to Friday, 9:00 AM – 6:00 PM IST (excluding public holidays)

If you are not satisfied with our response, you may escalate to the Data Protection Board of India or other remedies available under law once operational under the DPDP framework.

Related policies: Terms & Conditions · Refund & Cancellation