GST Point Privacy Policy

1. Who we are and our role

GST Point is operated by Vaibhav Sharma under the business name NirmaanFlow (“we”, “us”). It is an app for Shopify merchants that creates Indian GST tax invoices, delivery challans and proforma invoices, keeps customer ledgers (Khata), and produces GST reports.

• Customers' data: the merchant who installs GST Point decides why and how their customers' data is used. The merchant is the controller (the “Data Fiduciary” under India's Digital Personal Data Protection Act, 2023) and we are their processor (the “Data Processor”). We process this data only on the merchant's behalf and on their instructions, to provide the app, under the data processing terms in our Terms of Service.
• Data we are responsible for: we decide how we use merchant account details, support tickets, and the security and error logs we keep to run the service. For this data we are the controller (Data Fiduciary).

2. Data we process

We collect only what GST Point needs to create compliant GST documents and run the service.

About the merchant and the store

• Shop domain, store name and the store owner's name and email, from Shopify.
• Business details entered in Settings: business name, address, phone, email, state, GSTIN, PAN, CIN, IEC, FSSAI licence, logo and signature images, and invoice terms.
• Bank details printed on invoices: account holder, account number, IFSC, bank, branch and UPI ID.
• E-invoice and e-way bill portal (GSP) username and password, if entered. The password is stored encrypted and is never shown again in the app.
• Plan, billing status and monthly invoice usage.
• Support tickets: the contact name, email and phone provided, messages, and any attached files.

About the merchant's customers

• From Shopify orders or entered manually: name, company, billing and shipping address, state, GSTIN, email and phone number. Each is needed for a specific reason:
  • Name, company and address are printed on invoices, because Rule 46 of the CGST Rules, 2017 requires the recipient's name and address.
  • State sets the place of supply, which decides whether IGST or CGST + SGST applies.
  • GSTIN is required on B2B invoices and in GSTR-1 reports.
  • Email is used to send invoices to the customer, when the merchant chooses to.
  • Phone number is printed on invoices as the customer's contact number (from the order's billing or shipping address). It is optional, the merchant can change it, and it is not used for anything else.
• Order details: items, quantities, prices, HSN/SAC codes, discounts, taxes and shipping.
• Invoices, delivery challans, proforma invoices and their PDF files.
• Customer ledger (Khata) accounts, payments and balances.

Other records the merchant enters

• Purchases and expenses, including supplier names and GSTINs.

Technical data

• Sign-in to GST Point happens through Shopify, which issues secure session tokens. We store the session Shopify provides so the app can work for your store.
• Server logs (time, page path and result of each request), security events such as support desk sign-ins (with the IP address), and filtered error reports. These are not used to track anyone.
• An access log of who opened, downloaded, emailed or exported customer data: the merchant's Shopify staff ID, the action, the record and the time. It holds record IDs, not customer details, and the merchant can see it in GST Point under Settings.

3. How we use data

• Creating GST tax invoices, delivery challans and proforma invoices, and working out IGST or CGST + SGST from the place of supply.
• Keeping invoice numbering, customer ledgers and GST reports (GSTR-1, GSTR-3B, sales registers).
• Emailing invoices to customers when the merchant sends them or turns on automatic sending.
• Verifying GSTINs, when the merchant uses that feature.
• Providing support, including the AI assistant in the help chat.
• Billing the merchant's plan through Shopify.
• Keeping the service secure and fixing errors.

We use data to provide the service the merchant signed up for, to help merchants meet their GST record keeping obligations, and to keep the service secure. We never sell personal data, and we never use it for advertising or profiling.

4. Who we share data with

We use the following service providers to run GST Point. Each receives only what it needs for its purpose and is bound by its own terms to protect the data.

Please don't paste customers' personal details into the help chat; the AI assistant doesn't need them to answer your questions.

We may also disclose data if the law requires it, for example to a court or a tax authority.

5. Where data is processed

GST Point's servers and database are in Singapore, and its files and security log archive are stored in Cloudflare's Asia-Pacific region. Some providers above process data in Japan, the United States or other countries. When data leaves India, it is protected by the providers' contractual commitments and encrypted while it travels.

6. How long we keep data

We keep data only as long as we need it to provide GST Point, or as long as the law requires. Invoice PDFs follow the same rules as the invoices they belong to.

• While GST Point is installed, we keep the store's data so the merchant can use their invoices, ledgers and reports.
• When a customer asks to be erased (Shopify sends us these requests), we delete that customer's draft invoices, proforma invoices and ledger account. We keep their finalized tax invoices on the merchant's behalf, only to the extent they form part of the merchant's tax records. Section 36 of the CGST Act, 2017 requires the merchant to keep these records until 72 months after the due date of the annual return for the year they relate to, and longer if they are involved in an appeal, revision or other proceedings. That obligation is the merchant's; we store the records for them and use them only to provide them to the merchant.
• When a merchant uninstalls GST Point, Shopify sends us a deletion request about 48 hours later. When it arrives, we permanently delete all of the store's data from our live systems, including finalized invoices, PDFs and support attachments. Uninstalling doesn't end the merchant's own duty to keep GST records, so merchants should download their invoices and reports before uninstalling. If the merchant reinstalls GST Point before that request arrives, the store is using the app again, so its data is kept; it is deleted after any later uninstall in the same way.
• One exception: whether a store has used its free trial. So that the 7-day free trial is given once per store, we keep a scrambled, one-way code made from the store's myshopify.com address, with the dates of its trial. The code can't be turned back into the address, and nothing else about the store, its customers or its staff is kept. It is used only to decide whether a reinstalled store gets a new trial.
• Server logs are deleted automatically after 14 days, error reports after 30 days, and access log entries after 12 months. A filtered copy of the server logs (with emails, phone numbers, download links and session tokens removed) is kept in our security log archive for 365 days, because Indian cyber-security rules (CERT-In) require security logs to be kept for at least 180 days.
• Deleted data may remain in encrypted database backups for up to 7 more days, until those backups expire. Backups are used only to recover from a disaster.

7. How we protect data

• All connections are encrypted (HTTPS/TLS), and our storage providers encrypt data at rest.
• GSP portal passwords are additionally encrypted with AES-256-GCM using a separate key, and are never sent back to the browser.
• Each store can only access its own data. The database cannot be reached through any public API.
• Finalized tax invoices are locked so their contents can't be altered.
• Invoice emails can include a “Download Invoice PDF” link. Each link works for one invoice only, is signed so it can't be guessed or altered, and expires after 30 days. Until then, anyone who has the link can download that invoice, so it shouldn't be forwarded to people who shouldn't see it.
• Our staff support desk requires a password, and access to production systems is limited.
• Every access to customer data is recorded in an access log that can't be edited, so merchants can see who viewed which records.
• Error reports are filtered so customer emails, phone numbers and session tokens are not sent.

No system is perfectly secure. If we become aware of a personal data breach (any unauthorised processing of personal data, or its accidental disclosure, alteration, destruction or loss of access, that compromises its confidentiality, integrity or availability), we will notify affected merchants without undue delay, as set out in section 5.6 of our Terms of Service, and report it to authorities within the time required by law.

8. Your rights and choices

Merchants

• View and correct your business details at any time in Settings.
• Download your invoices and export your reports.
• Ask us for a copy of your data, a correction, or deletion by emailing support@nirmaanflow.com. Uninstalling GST Point deletes all of your store's data as described in section 6.

Customers of a store

Please contact the store you bought from. The store can pass access and erasure requests to us through Shopify, and we act on them: for access requests we send the store a copy of the data we hold about you. Depending on where you live and which laws apply, laws such as India's Digital Personal Data Protection Act, 2023 and the GDPR may give you rights to access, correct and erase your data, to withdraw consent, and to raise a grievance. GST Point is designed with these laws in mind.

9. Cookies

GST Point doesn't use advertising or analytics cookies. Inside Shopify, sign-in uses Shopify's session tokens. Our staff support desk sets one strictly necessary sign-in cookie, for NirmaanFlow staff only.

10. Children

GST Point is a business tool and is not intended for anyone under 18.

11. Changes to this policy

When we change this policy we update the date above. If a change is significant, we will tell merchants in the app or by email before it takes effect.

12. Contact and Grievance Officer

For questions, requests or complaints about privacy, contact our Grievance Officer. We aim to respond within 30 days.