Privacy Policy

GSTArk® is a proprietorship firm in India, registered under Udyam No. UDYAM-UP-03-0163589 (GSTIN 09HYSPS7750A1ZQ).

For anything in this policy, write to founder@gstark.ai.

• Account details: your email address, mobile number and profession, which you give when you register with email, and your password, which is held by our sign-in provider (Supabase). We also record when you agreed to the Terms and this policy, and which versions.
• Google profile: if you sign in with Google, the basic profile Google shares through Supabase sign-in (name, email address and profile picture). We do not access your Google Drive, personal emails, contacts, or any other Google account service.
• Documents you upload: show cause notices, orders, replies, reconciliations, GSTR data and any other file you add to a case. Files are kept in a private storage bucket named ‘documents’, and the text we read out of them is kept with them.
• Your work: drafts and their versions, notesheets, notes and details you type into forms, case records (for example taxpayer name, GSTIN, tax period, deadlines and case history) and your chat conversations in the app.
• Records the service keeps: your profile and role requests, and the consent you give for documents to be sent to an AI provider.
• Technical logs: server logs, and usage records such as which AI model ran a request, how many tokens it used, how long it took, and when you exported a document.

Documents you upload often contain other people's personal data (for example a taxpayer's). Upload them only when you are entitled to (see the Terms).

We use your data to run the service and to produce the output you ask for: to sign you in, keep your cases, read your documents, draft and check your outputs, and keep your work available when you return. We use technical logs to keep the service working and to fix faults. We use your data only for the purposes described in this policy.

GSTArk's database, private file storage and sign-in service run in Supabase's Tokyo region (ap-northeast-1). The application runs from Vercel's Tokyo region (hnd1). AI requests are processed by the providers listed below and may be processed outside India.

We also use the following providers when you select or enable their relevant service:

• Google: sign-in, if you choose Sign in with Google.
• Google Gemini and xAI: AI processing. They receive your prompt, the document excerpts needed for the request and request metadata only when the corresponding model handles your request.

Uploaded documents and text are sent to an AI provider only to produce the output you ask for, under that provider's API terms. GSTArk does not use your documents or drafts to train any model. How long a provider keeps what it receives follows that provider's published API policy.

To find the full text of a judgment, our server also searches public law websites (Indian Kanoon and CaseMine) by the case name and court. Nothing you upload is sent to them.

Your data leaves India. The database and application servers are in Tokyo, Japan, and AI providers may process requests in other countries. By using GSTArk you understand that your data is transferred outside India for these purposes.

Citations in a draft are checked against GSTArk's own store of Acts, Rules, Notifications, Circulars and Judgments, and each is marked as found in that store, found by search (with the page it came from), or unconfirmed.

• Notices, orders, returns, GSTINs, financial statements, ledgers and drafts that you upload or create are treated as confidential. Financial information is handled as sensitive personal data under the Information Technology (Reasonable security practices and procedures and sensitive personal data or information) Rules, 2011 and the Digital Personal Data Protection Act, 2023.
• Each account's cases, drafts and uploads are readable only by that account (access rules in the database and in file storage).
• GSTArk does not read your files except: when you ask for support on a specific matter; to investigate misuse or a security incident; or when the law requires it (a valid order of a court or authority). We will tell you when we have done so, unless the law forbids it.
• Files go to AI providers only to produce the output you request. They are not sold, not shared for marketing, and not used by GSTArk to train models.
• Your duties: you must have the right or authority to upload what you upload. You keep your own professional duties (client confidentiality for practitioners, departmental rules for officers). GSTArk does not waive any privilege or confidentiality you owe.
• You can delete archived cases in the app, and you can ask founder@gstark.ai to delete your account and files, which we do within 30 days.

We do not sell personal data, and we never sell your authentication data. GSTArk has no advertising and no tracking tools. To understand how people find and use our website, we use Vercel Web Analytics to count visits: pages viewed, country, device type and the site that referred the visitor. It sets no cookies, keeps no IP address and does not identify you or follow you across days or other websites. See the Cookie Policy for the only cookies and browser storage we use.

• You must sign in to use the app.
• Access rules in the database let each user read only their own cases, drafts and uploads, and the file storage lets each user read only their own folder.
• Data travels over encrypted connections (TLS).
• Data stored by the hosting provider is encrypted at rest.

No online service can promise perfect security. If a personal-data breach occurs, GSTArk will notify affected users and the relevant authorities in the manner and within the time required by the Digital Personal Data Protection Rules.

More on the Security page.

• Account and billing records are kept while your account is active and for eight years after it closes, so GSTArk can meet its tax, accounting, dispute and business-record obligations.
• Technical and usage logs are kept for up to 24 months.
• Drafts and uploads are kept while your account is active and remain available for export for 30 days after the account closes. They are then deleted unless the law or a legal hold requires longer retention.
• If you ask us to delete your account or your data, write to founder@gstark.ai and we delete eligible data within 30 days of your request. Billing, account or legal-hold records that must be retained are kept only for the applicable period above.
• You can delete a case yourself in the app: archive it, then delete it. This deletes the case's uploaded files, drafts and history.
• You can export your drafts as DOCX or PDF at any time.

We give you the rights set out in the Digital Personal Data Protection Act, 2023. You can:

• ask what personal data we hold about you and how we use it (access);
• ask us to correct or complete it (correction);
• ask us to delete it (erasure);
• ask us for a portable export of data you provided and drafts available to your account;
• withdraw your consent, which stops future processing (it does not undo processing already done);
• nominate another person to exercise these rights if you die or cannot act;
• raise a grievance with us, and get an answer.

Email the GSTArk Grievance Officer at founder@gstark.ai. This is also GSTArk's DPDP grievance channel. We will reply within 30 days. If you are not satisfied after using our grievance route, you can complain to the Data Protection Board of India. See Grievance Redressal.

GSTArk is not for anyone under 18. You must be 18 or older to use it.

If we change this policy we will update this page and the “Last updated” date at the top.

If you have any questions regarding this Privacy Policy or wish to request access, correction, deletion or export, contact the GSTArk Grievance Officer at founder@gstark.ai.