GST Point Terms of Service

1. Agreement

By installing or using GST Point (“the App”), operated by Vaibhav Sharma under the business name NirmaanFlow (“we”, “us”), you (“the merchant”) agree to these Terms, including the data processing terms in section 5, and to our Privacy Policy. If you accept on behalf of a business, you confirm you have authority to bind it.

2. What GST Point does, and your responsibilities

GST Point creates GST tax invoices, delivery challans and proforma invoices, keeps customer ledgers (Khata), and produces GST reports for Shopify stores in India.

GST Point is designed to follow Indian GST rules, including Rule 46 of the CGST Rules, 2017 on tax invoices. It is a tool, not tax or legal advice. You remain responsible for the accuracy of your GSTIN, HSN/SAC codes, tax rates, place of supply and other invoice details, and for your GST returns and filings.

3. Plans and billing

• Paid plans are billed through Shopify, and charges appear on your Shopify bill.
• A plan change takes effect once you approve it in Shopify. Shopify applies any proration or credits under its own billing rules.
• You can cancel or change your plan at any time from the Billing page, or by uninstalling the App.

4. Availability and support

We work to keep GST Point available and to fix problems quickly, but we don't guarantee uninterrupted or error-free service. Support is available through the help chat in the App and by email at support@nirmaanflow.com.

5. Data processing terms

This section applies to personal data about your customers that GST Point processes for you (“customer data”), such as names, addresses, GSTINs and email addresses on orders, invoices and ledgers. For customer data it takes precedence over the rest of these Terms.

5.1 Roles

You are the controller (the “Data Fiduciary” under India's Digital Personal Data Protection Act, 2023) and we are your processor (the “Data Processor”). You are responsible for having a lawful basis for the data and for telling your customers, for example in your store's privacy policy, that you use service providers such as GST Point for invoicing.

5.2 Your instructions

We process customer data only to provide the App: as you configure it (for example, sending invoice emails or creating invoices automatically) and as you instruct through the App. We don't use customer data for our own purposes, sell it, or use it for advertising. If the law requires us to process it in another way, we will tell you first unless the law forbids it.

5.3 Confidentiality and security

Only people who need access to provide or support the App can access customer data, and they are bound by confidentiality. We protect customer data with the measures described in section 7 of our Privacy Policy, and keep those measures up to date.

5.4 Sub-processors

A sub-processor is a service provider that processes customer data for us. You authorise us to use the sub-processors listed in section 4 of our Privacy Policy. We require each to protect the data, and we remain responsible for them. We will give you at least 14 days' notice, in the App or by email, before adding a new sub-processor. If an urgent change is needed to protect security, keep the App available or comply with the law, we may make it sooner and will tell you as soon as reasonably practicable. If you object to a sub-processor, contact us; if we can't address your concern, you may stop using the App by uninstalling it.

5.5 Requests from your customers

Shopify forwards your customers' data access and erasure requests to us, and we act on them as described in our Privacy Policy. For other requests, we will give you reasonable help when you contact us.

5.6 Personal data breaches

A personal data breach is any unauthorised processing of customer data, or its accidental disclosure, acquisition, sharing, use, alteration or destruction, or loss of access to it, that compromises its confidentiality, integrity or availability.

If we become aware of a personal data breach affecting your customer data, we will notify you without undue delay, and no later than 72 hours after becoming aware of it, with the information then available. We will give further information in stages as our investigation progresses. We will make any notifications to authorities, including CERT-In in India, within the time required by applicable law.

5.7 Retention, return and deletion

• While the App is installed, you can download your invoices and export your reports at any time.
• When a customer asks to be erased, we delete their other data but keep their finalized tax invoices for you, only to the extent they form part of your tax records. Section 36 of the CGST Act, 2017 requires you to keep these records until 72 months after the due date of the annual return for the year they relate to, and longer if they are involved in an appeal, revision or other proceedings. That obligation is yours; we store the records for you.
• When you uninstall the App, Shopify sends us a deletion request about 48 hours later, and we then permanently delete all of your store's data from our live systems. Deleted data may remain in encrypted backups for up to 7 more days, used only for disaster recovery. Uninstalling doesn't end your duty to keep GST records, so export anything you need before uninstalling.

5.8 Transfers outside India

Customer data may be processed outside India by the sub-processors listed in our Privacy Policy, with the safeguards described there.

5.9 Information and audits

On request, we will give you the information you reasonably need to show that these data processing terms are being met, such as answers to a security questionnaire, once a year or after a breach.

6. Ending your use

You can stop using GST Point at any time by uninstalling it. Your data is then handled as described in section 5.7.

7. Changes to these Terms

When we change these Terms we update the date above. If a change is significant, we will tell you in the App or by email before it takes effect.

8. Contact