Privacy Policy

What we collect

We collect three kinds of information:

• Account information — your name, email address, phone number, organization details and the GSTINs you register.
• GST portal data — notices, orders and related documents fetched from the GST portal after you authorize access with an OTP, plus documents you upload yourself.
• Usage information — actions taken in the product (views, assignments, replies drafted), which also powers the audit trail the product provides.

What we never collect

We never ask for, see or store your GST portal password. Portal access works through an OTP sent to your registered GST mobile number; only an encrypted session token is retained, and you can revoke it at any time from settings.

How we use your data

Your data is used only to provide the service:

• Fetching, analyzing and explaining your GST notices, and drafting replies for your review.
• Deadline tracking and the reminders you configure (email, push, in-app, WhatsApp).
• Team collaboration features, subject to the roles and permissions your organization sets.
• Billing, support and service communications.

AI processing

Notice text is processed by AI models to produce summaries, risk assessments and draft replies. This processing is performed by a third-party AI provider (currently OpenAI) on servers located outside India, in the United States; the relevant text is sent there transiently for that purpose. Under the provider’s API terms, data submitted through the API is not used to train their models. AI output is assistance, not professional tax advice, and is always presented alongside the original notice.

Browser extension (GST Notice Guard)

We offer a Chrome browser extension called "GST Notice Guard" that automates GST notice capture from the GST portal. This section describes data practices specific to the extension.

• Domains accessed — The extension operates only on services.gst.gov.in and www.gst.gov.in (to detect login and capture notice data), api.effortlessinsight.in (to sync notices), and effortlessinsight.in (for session sharing). No other websites are accessed.
• Data stored locally — Authentication tokens, your user profile and organization name, notification preferences, offline sync queue, due date reminder timestamps, extension configuration cache, last sync timestamp, and API environment selection are stored locally in your browser using Chrome's storage API. This data is cleared when you sign out or uninstall the extension.
• Technical information — When syncing, the extension sends browser type and version, operating system, browser language, extension version, and sync timestamps to help diagnose issues and ensure compatibility.
• Desktop notifications — The extension displays notifications for sync status, due date reminders, and overdue alerts. You can configure these in the extension settings.
• No passwords — The extension never accesses, stores or transmits your GST portal password. It uses your existing browser session cookies for portal access.
• Data transmission — All data captured by the extension is transmitted over encrypted HTTPS connections and is subject to the same storage, retention and access controls described in this policy.

Where your data lives

All storage and backups are in Indian data centres (Mumbai region). Traffic is encrypted in transit with TLS, and sensitive fields — session tokens, GSTINs, personal data — are protected with AES-256 encryption at rest. The one exception to Indian residency is AI analysis: notice text is sent transiently to the AI provider described above for processing on servers outside India (in the United States).

Who can see your data

Access inside your organization is role-based: owner, admin, manager, member, CA and view-only roles each see only what they should, and every access is logged.

We share data with service providers only as needed to run the service — cloud hosting, payment processing (Razorpay), messaging delivery — each bound to use it solely for that purpose. We do not sell your data or share it with advertisers. We disclose data to authorities only when legally required.

How long we keep it

Compliance records are retained for 8 years, in line with GST record-keeping requirements. If you close your account, you can export your data first; on request we delete personal data that we are not legally required to retain.

Your rights

In line with the Digital Personal Data Protection Act, 2023, you can request access to, correction of, or deletion of your personal data, and raise grievances about how it is handled. Write to info@effortlessinsight.in and we will respond.

Who operates this service

EffortlessInsight is operated by ARSTEG SOLUTIONS PRIVATE LIMITED (CIN U72300HR2015PTC057471, GSTIN 06AANCA9681K1ZZ), registered office Aravali Heights, Sector 24, Dharuhera, Rewari, Haryana – 123106, India. For any privacy question or grievance, contact info@effortlessinsight.in or +91 93113 91932.

Changes to this policy

If this policy changes materially, we will notify account holders by email before the change takes effect. The "Last updated" date above always reflects the current version.