Privacy Policy

Last updated 29 October 2026

This policy explains what personal data eVahi ("we", "us") handles when you use the eVahi-GST service and this website, why, and what rights you have, including under the Digital Personal Data Protection Act, 2023.

1. Two kinds of data

• Account data about the people who use the Service: name, email address, role and the companies they can access, sign-in events, and a record of changes they make. For this we decide how and why it is used.
• Your Data: the books and records you enter or import (companies, GSTINs, ledgers, vouchers, parties, bank lines, stock, returns, notices and documents). This belongs to you. We store and process it only to run the Service for you, on your instructions. It may include personal data about your own customers, suppliers and staff (for example PAN or contact details); you are responsible for having the right to enter it.

2. What we use it for

• To provide, secure and support the Service, including sign-in, access control and an audit trail.
• To take payment, issue tax invoices and manage your subscription (through Razorpay, below).
• To answer your messages and send service notices such as security or billing notices.
• To keep the Service reliable and to prevent misuse.

We do not sell personal data, and we do not use Your Data for advertising or to train models. We never ask for or store your GST or income tax portal passwords.

3. Who else handles it

• Razorpay processes payments. It collects your payment details (UPI, card or bank) under its own privacy policy; we never see your full card number or bank credentials.
• Supabase provides our database, sign-in and file storage, hosted in its Mumbai (India) region on Amazon Web Services infrastructure.
• Cloudflare hosts this website and the application's pages and delivers them securely.

These providers act under contract and only to provide their services. We may also disclose information if the law requires it, for example to a tax authority or a court.

4. Where it is kept, and for how long

Your Data and account data are stored in India. We keep data while your account is active and for 30 days after cancellation, then delete it; encrypted backups expire on their normal cycle. We keep billing records for as long as tax law requires.

5. Security

Data is encrypted in transit and at rest. Access is by password sign-in, with an optional authenticator code; the account owner assigns each person a role and limits them to specific companies, and the database enforces those limits itself. Changes are recorded. No system is perfectly secure, so use a strong, unique password and tell us at once if you suspect misuse. If a breach affects your personal data we will tell you and the Data Protection Board as the law requires.

6. Cookies and similar technologies

This website uses no advertising or tracking cookies. The application stores a sign-in token and a few display preferences in your browser; they are needed for the Service to work.

7. Your rights

You can ask for a summary of your personal data and how it is used, and ask us to correct, complete, update or erase it, or withdraw consent where we rely on it. You may nominate someone to exercise these rights for you. Write to nishaupadhyay91@gmail.com with the subject "Privacy request". For Your Data about your own customers or staff, you control it; ask us if you need help exporting or deleting it. If you are not satisfied with our answer you may approach the Data Protection Board of India.

8. Children

The Service is for businesses and is not directed at children.

9. Changes

We will update this page when our practices change and note the date above. For material changes we will tell the account owner by email.

10. Contact and grievance officer

Grievance officer and privacy contact: nishaupadhyay91@gmail.com.