Privacy Policy

Last updated: May 2026

1. Who We Are

SignMyGST is operated by Indgns Ecommerce Private Limited (CIN: U72900MP2022PTC062191, GSTIN: 23AAHCI7770D1ZM), Bhopal, Madhya Pradesh, India. This Privacy Policy explains how we collect, use, and protect your information when you use our Service.

2. Information We Collect

Account information: Your email address, entity name, GSTIN, PAN, ARN (AMFI Registration Number), entity type, signatory name and designation, and registered address. This is provided by you during onboarding.

Signature and seal images: PNG files you upload for use on generated invoices. Stored securely in private, user scoped storage until you delete them or close your account.

Payment information: We store only your payment plan type and purchase date. We do not store credit or debit card numbers. Payments are processed by Cashfree Payments.

Usage data: We collect minimal usage data including batch processing counts and credit consumption, for the purpose of account management and billing.

3. Information We Do NOT Store

Uploaded RTA files (CAMS PDFs, KFin ZIPs) are processed in memory and never written to persistent storage.
Commission amounts, brokerage data, and AMC financial details from your uploaded files are not retained after processing.
Generated invoice PDFs and Excel files are stored temporarily (24 hours) for download, then permanently deleted. You may opt in to 1 year retention in settings.

4. How We Use Your Information

To create and manage your account
To generate GST compliant invoices on your behalf
To process payments and issue GST invoices for our services
To send transactional emails (OTP, download links, payment receipts)
To respond to support requests

5. Third Party Services

Supabase (supabase.com): Authentication, database, and file storage. Your account data and signature or seal images are stored on Supabase infrastructure.
Cashfree Payments (cashfree.com): Payment processing. Subject to Cashfree's own privacy policy.
Resend (resend.com): Transactional email delivery (OTP codes, download links).
Vercel (vercel.com): Frontend hosting and serverless functions.
Railway or Render: Python PDF processing microservice hosting. Uploaded files are processed here and are not persisted.

6. Cookies

We use minimal cookies. The only cookies set are Supabase authentication session cookies, which are required for you to remain logged in. We do not use advertising cookies or third party tracking pixels.

7. Data Retention

Account data: Retained until you delete your account.
Signature and seal images: Retained until you delete them in settings or delete your account.
Generated files: Deleted after 24 hours by default. Optional 1 year retention available in settings.
RTA uploads: Never persisted beyond the processing session.
Payment records: Retained as required by Indian tax law (typically 7 years).

8. Security

All data is transmitted over HTTPS (TLS encryption).
Signature and seal images are stored in private Supabase storage buckets accessible only to your account.
We do not store passwords. Authentication is via email OTP only.
PAN numbers are stored encrypted at rest.

9. Your Rights

Access: You can view and edit your account details at any time in Settings.
Deletion: You can delete your account from Settings. This permanently removes your profile, signature or seal images, and all stored data.
Data export: Contact support@signmygst.com to request a copy of your account data.
Correction: Update your entity details at any time through Settings.

10. Updates to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated to your registered email address. Continued use of the Service after changes constitutes acceptance of the updated policy.

11. Governing Law

This Privacy Policy is governed by the laws of India. Any disputes shall be subject to the exclusive jurisdiction of courts in Bhopal, Madhya Pradesh.

12. Contact

For privacy questions or to exercise your rights: support@signmygst.com