Privacy Policy

1. Data We Collect

We collect only the information necessary to provide our automated data extraction, accounting and ERP integration services (including Tally Prime and ERPNext).

• User Account Information: Name, Email Address, Business Name, GSTIN, and PAN.
• Team Information: Names, email addresses and roles of users you invite to a company or to your accountant firm.
• Documents: The original files you capture or upload (invoice, bill, expense, voucher and bank statement images and PDFs). These files are stored in the Google Drive account you connect for your company (see Section 3).
• Extracted Transactional Data: Invoice/Bill numbers, Vendor/Customer names, GSTIN/PAN of parties, line items, tax breakdowns (CGST, SGST, IGST), taxable amounts, and total amounts.
• Financial Data: Bank account numbers, IFSC codes, branch names, account holder names, and transaction debit/credit amounts.
• Details of Your Business Contacts: Names, contact persons, phone numbers, email addresses, addresses, GSTIN/PAN and bank details of your vendors and customers, as entered by you or extracted from your documents.
• Integration Information: When you connect Google Drive, we store the connected Google account email address, the selected folder locations, and the access tokens needed to upload and read files on your behalf. Credentials for other integrations you configure (for example, ERPNext) are stored in the same way.
• Payment Information: When you purchase a subscription or credits, payment is processed by Razorpay. We receive and store the order and payment reference, amount, plan and payment status. We do not receive or store your card, UPI or net-banking credentials.
• Technical Metadata: We temporarily collect IP addresses and browser/device information (such as user agent strings) during email verification, email delivery logging, and related security operations to prevent abuse and verify identity. Email audit log entries containing this metadata are automatically deleted after 90 days. OTP verification records are automatically deleted after expiry and periodic cleanup (typically within 7 days of expiry).

2. Purpose of Data Collection

Your data is processed for the following specific purposes:

• To provide and secure your account, and to give you and the team members you authorise access to your companies.
• To capture documents on your mobile device and store them in your company's connected Google Drive.
• To perform AI-driven data extraction from your documents.
• To maintain your accounting records (ledgers, journal entries, invoices, bills, bank transactions and inventory) and to generate accounting vouchers compatible with Tally (XML/ODBC), ERPNext, and other integrations you enable.
• To provide you with a history of extracted data for review and export.
• To process subscription and credit payments and to maintain billing records.
• To send you transactional and service emails, such as email verification, security notices, account confirmations and important changes to the Service.

3. Sub-Processors and Cloud Infrastructure

To provide high-accuracy extraction and secure hosting, we use the following categories of sub-processors. Each processes personal or business data only as needed to deliver the Service described in this Policy.

• Hosting and platform: Supabase (cloud database, authentication, server functions and related infrastructure). Our Supabase project is hosted in the AWS Asia Pacific (Mumbai) region.
• Document storage: Google (Google Drive). Your documents are stored in the Google Drive account you connect for your company, under that Google account's terms. We access it only through the permissions you grant when connecting it.
• Artificial intelligence: Google (Gemini models), OpenAI (GPT models), xAI (Grok models), Fireworks AI, OpenRouter, and Portkey (AI routing and gateway services). These providers may receive document content or prompts solely for extraction or inference as part of the Service's features. The provider used for a given request depends on the Service's configuration.
• Payments: Razorpay, for processing subscription and credit payments.
• Email delivery: Our email provider (Resend and/or SendGrid, as configured) for transactional and operational emails.
• Software updates: The desktop application checks GitHub for new versions. This check shares your IP address and application version with GitHub.
• Fonts:The mobile application downloads display fonts from Google Fonts. This shares your device's IP address with Google.

You should review each provider's terms and privacy notices for how they handle data sent via their APIs. We do not use your data to train our own models; use of third-party AI APIs is subject to those providers' applicable terms.

Data Residency: Extracted data and account data are stored on Supabase infrastructure located in India (AWS Mumbai region) to support local data residency preferences and audit requirements. Documents are stored in your connected Google Drive, whose storage location is determined by Google. Document content sent for AI extraction may be processed by the AI providers listed above outside India.

4. Our Role for Your Business Contacts' Data

For your own account information, we act as the Data Fiduciary under the DPDP Act. For personal data of your vendors, customers, employees and other business contacts that you enter into the Service or that appears in your documents, your business is the Data Fiduciary and we act as a Data Processor on your behalf. We process that data only to provide the Service to you.

5. Who Can See Your Data

A company's data is visible to the users you add to that company, with the role you assign to them.

If you authorise an accountant firm to manage your company, that firm's users can access your company's data according to their role in the firm.

We do not sell your data, and we do not share it with anyone other than the sub-processors listed in Section 3.

Data on your devices: Documents captured on the mobile application remain on your phone until you upload or delete them. The desktop application may keep a local cache of your company's data (for example, chart of accounts and settings) on that computer to improve performance.

6. Data Retention and Erasure

Retention: We retain your data for as long as you maintain an active account with us, whether on the free plan or a paid subscription. Cancelling a subscription does not by itself delete your data.

Deleting a Company: You can delete a company you own from the desktop application. This permanently deletes that company and all its data from our cloud servers at the time you confirm it, including its accounting records, invoices, bills, bank transactions, inventory, business contacts, uploaded-document records and integration settings.

Deleting Your Account: You can delete your account from the desktop application (Settings → Delete account). This permanently deletes the companies you own and all their data, removes you from companies owned by others, deletes your consent records, and deletes your login, at the time you confirm it. Companies owned by other users are not deleted.

Manual Deletion Request: You may also request deletion of your account by emailing support@intelacct.in from the email address registered with your account, with the subject “Delete my account”. We verify the request and complete the deletion manually within 30 days.

Data Not Deleted by Us: Documents stored in your connected Google Drive remain in that Drive and must be deleted there. Documents waiting on your phone are removed when you delete them in the mobile application or uninstall it.

Backups: Deleted data may remain in our encrypted backups until those backups expire, which happens within 30 days. Backups are not used for any other purpose.

Legal Retention: We may retain limited records where required by applicable Indian law (for example, payment and tax records), only for the legally required period.

Technical metadata (email verification and audit logs): As described in Section 1, email audit logs are purged on a rolling basis after 90 days; expired OTP verification records are removed on a scheduled basis.

7. Usage Data and Telemetry

We do not use third-party analytics, advertising identifiers, location tracking or crash-reporting services in the desktop or mobile applications. We record the number of documents and AI requests processed for your company as part of your account data, to calculate usage, credits and billing. This does not include the content of your financial transactions.

8. Data Security

We implement robust security measures to protect your sensitive financial information:

• In Transit: All data transmitted between the desktop application, the mobile application, our cloud servers and Google Drive is encrypted using TLS (Transport Layer Security).
• At Rest: Data stored in our cloud database is encrypted at rest by our infrastructure provider (AES-256). Access is restricted using Row Level Security (RLS), so that your data is accessible only to your authenticated account and the users you authorise.
• Infrastructure: Our servers are hosted in Tier-1 data centers with 24/7 monitoring.
• Personal Data Breach: If a personal data breach occurs, we will notify affected users and the Data Protection Board of India as required by the DPDP Act and its rules.

9. Your Rights Under the DPDP Act 2023

Under Indian law, you have the following rights:

• Right to Access: You can view all extracted data via the application dashboard, and you may request a summary of the personal data we process about you by contacting the Grievance Officer.
• Right to Correction: You can edit and correct any data before it is exported to your connected accounting system.
• Right to Erasure: You can delete your company data or your account through the desktop application, or request deletion by email, as described in Section 6.
• Right to Withdraw Consent: You may withdraw consent by discontinuing use of the Service and deleting your account. Processing lawfully performed before withdrawal may remain valid. Deleting your account is the primary way to withdraw consent for ongoing processing of your account data.
• Right to Nominate: You may nominate another individual to exercise your rights under the DPDP Act in the event of your death or incapacity, by writing to the Grievance Officer.
• Right to Grievance Redressal: You may raise a complaint with our Grievance Officer (Section 10). If you are not satisfied with the resolution, you may file a complaint with the Data Protection Board of India.

10. Grievance Redressal

In accordance with the Digital Personal Data Protection Act 2023, if you have any questions or complaints regarding your data, please contact our Grievance Officer:

• Grievance Officer: Sundar Rajan
• Email: support@intelacct.in
• Address: Coimbatore, Tamil Nadu, India.

We aim to acknowledge grievances within a reasonable period and resolve them in line with applicable law.

11. Children

The Service is intended for businesses and accounting professionals. It is not intended for, and must not be used by, individuals under 18 years of age. We do not knowingly process personal data of individuals under 18 as users of the Service.

12. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any significant changes by posting the new policy within the app or via email.

13. Mobile Capture Application

IntelAcct Capture is a companion application for Android that enables document scanning and upload. No AI extraction or data processing occurs on the device; all extraction and review take place within the desktop application after documents are uploaded.

• Account and Company Access: The mobile application uses the same credentials as your desktop application. On login, your account is authenticated through our servers, and the list of companies or clients you are authorised to access is retrieved from our cloud infrastructure. The mobile application does not allow you to create an account.
• Cloud Storage Configuration: The cloud storage destination (folder location and connected account) configured through the desktop application is retrieved from our servers at the time of use. This allows the mobile application to route your uploads to the correct destination without requiring separate setup.
• Document Capture and Local Storage: Documents may be captured using the device camera or selected from your photos. Captured images are stored in a local queue on your device until you choose to upload or delete them.
• Upload and Data We Record: When you choose to upload, files are transmitted directly from your device to your company's connected Google Drive; they do not pass through our servers during upload. Upon a successful upload, we record the following document metadata in our cloud database so that the desktop application can identify and process the document: document type, page count, file name, file size, image dimensions, and capture timestamp.
• Later Processing: When the desktop application processes an uploaded document, it downloads the file from your Google Drive and sends its content through our servers to the AI providers listed in Section 3 for extraction.
• Device Permissions Required: Camera access (for document capture) and internet access. When you import photos, the application uses the Android system photo picker; the application receives only the photos you select and does not request permission to read your photo library.
• Account Deletion: The mobile application links to the deletion options described in Section 6. Deletion is performed from the desktop application or by email request.

For grievances related to data collected through the mobile application, please contact the Grievance Officer as specified in Section 10 of this Policy.