Privacy Notice
Draft — This notice is pending legal review. Highlighted items in [brackets] will be completed before launch.
GRID is a web-based tool that prepares financial statements in the format required by Schedule III to the Companies Act, 2013. We built GRID on one simple principle: your financial data belongs on your computer, not on our servers. This notice explains, in plain language, what personal data we collect, why we collect it, how long we keep it, who we share it with, and the rights you have under the Digital Personal Data Protection Act, 2023 (the "DPDP Act") and the Digital Personal Data Protection Rules, 2025 (the "DPDP Rules").
1. Who we are
GRID is owned and operated by [Legal entity name], a [company / LLP] incorporated in India with [CIN / LLPIN] and its registered office at [Registered office address] ("GRID", "we", "us" or "our").
For the personal data described in this notice (principally your account data), GRID is the Data Fiduciary under the DPDP Act, which means we decide why and how that data is processed and we are responsible for protecting it.
For the accounting data you process through GRID (which may contain personal data of other people, such as your clients' debtors, creditors, employees, partners or directors), you or your organisation are the Data Fiduciary and GRID acts only as a Data Processor. That relationship is governed by our Data Processing Agreement, which you accept each time you sign in.
2. Scope of this notice
This notice applies to personal data we process when you:
- visit the GRID website or request a demo;
- create an account, sign in or use the GRID web application (the "Service");
- install or use the GRID Companion App on your computer;
- purchase, renew or manage a GRID licence or subscription;
- contact our support, sales or grievance teams.
This notice does not apply to websites or services of third parties that may be linked from GRID, such as payment gateways or Tally Solutions. Their own privacy notices apply.
3. How GRID is designed to protect your data
Most software stores your data on the provider's servers. GRID deliberately does not. Understanding this design will help you understand the rest of this notice.
- Local storage. Your companies, trial balances, ledger data, Schedule III mappings, notes, working papers and generated financial statements (together, "Customer Data") are saved only on your own device, in a local folder managed by the GRID Companion App. You choose that folder, and you can move, back up or delete it at any time.
- Tally stays on your computer. When you connect Tally Prime, the Companion App reads data from Tally running on your own machine (for example, at
localhost:9000). Tally is never exposed to the internet by GRID. - In-memory processing only. When you prepare a statement, the relevant Customer Data is sent over an encrypted connection (TLS 1.2 or higher) to GRID's processing engine. The engine works on it in temporary memory, returns the result to your device, and discards it. Customer Data is never written to our databases, file storage, backups or application logs.
- Protected logic. The accounting logic runs on our servers so that it can be kept up to date and protected. That is the only reason Customer Data travels to our servers at all, and it does so only for the few seconds needed to process your request.
- Minimal account data. The only personal data we keep is what is strictly needed to identify you, secure your account, manage your licence, bill you, prove your consent and meet our legal obligations. It is described in section 4.
4. Personal data we collect and why
The table below is an itemised description of each category of personal data we process, the specific purpose, the legal ground under the DPDP Act, and how long we keep it.
| Category | Data items | Purpose | Legal ground | Retention |
|---|---|---|---|---|
| Account identity | Full name, email address, mobile number (optional), firm or company name, designation, ICAI membership number (optional) | Create and administer your account, identify you when you sign in, communicate with you about the Service | Consent (s.6) | While your account is active + 90 days after closure |
| Credentials | Password stored only as a salted one-way hash (scrypt or Argon2); multi-factor authentication settings | Authenticate you and keep your account secure | Consent (s.6) | While your account is active; deleted on closure |
| Licence and subscription | Plan, number of users, licence keys, activation dates, device identifiers of activated Companion Apps, renewal status | Verify your licence at sign-in, enforce plan limits, prevent misuse | Consent (s.6); performance of the contract you request | While your account is active + 90 days |
| Billing records | Billing name and address, GSTIN, invoices, payment reference numbers, amounts and dates. We never receive or store full card, UPI PIN or bank login details; payments are handled by our payment gateway. | Issue tax invoices, account for revenue, meet tax and accounting laws | Consent; compliance with law (s.7(c)) | 8 years from the end of the relevant financial year (Companies Act, 2013; GST and income-tax laws) |
| Consent records | Which version of this notice and of the Data Processing Agreement you accepted, date and time, account, IP address and device type; withdrawals of consent | Prove that valid notice was given and consent obtained, as required by the DPDP Act and Rules | Compliance with law (s.7(c)) | While your account is active + 3 years, or longer if needed for a dispute or legal claim |
| Security and access logs | IP address, time stamps, browser and device information, pages or API endpoints accessed, sign-in success or failure, request size and duration. Never the contents of Customer Data. | Detect and prevent unauthorised access, fraud and abuse; investigate incidents; comply with CERT-In directions and the DPDP Rules | Legitimate use for compliance with law (s.7(c)) and security | At least one year, as prescribed under the DPDP Rules (and not less than 180 days under CERT-In directions), then deleted |
| Support communications | Emails, chat messages, call notes, and any screenshots or files you choose to share | Resolve your queries and improve the Service | Consent (s.6) | 2 years after the query is closed; files you share are deleted within 30 days of closure |
| Demo and sales enquiries | Name, email, phone, firm name, city, message | Respond to your enquiry and schedule a demonstration | Consent (s.6) | 12 months after the last contact, unless you become a customer |
| Grievances and rights requests | Your request, our response, supporting correspondence | Handle your requests and grievances and show that we did so | Compliance with law (s.7(c)) | 3 years after closure of the request |
5. Data we do not collect or store
To be completely clear, GRID does not store any of the following on its servers, databases, backups or logs:
- trial balances, ledgers, groups, vouchers, bills outstanding or stock data, whether uploaded or read from Tally;
- Schedule III mappings, adjustment entries, notes to accounts or working papers;
- generated Balance Sheets, Statements of Profit and Loss, Cash Flow Statements, ratios or exported Excel, Word or PDF files;
- names or details of your clients, their customers, suppliers, employees, directors, partners or shareholders contained in the above;
- full payment card numbers, CVVs, UPI PINs or net-banking passwords.
We do not use Customer Data for analytics, advertising, benchmarking, product research or to train any machine-learning or artificial-intelligence model.
We do not sell personal data, and we do not use third-party advertising or cross-site tracking technologies.
6. How we use personal data
We use the personal data in section 4 only for the purposes stated there, namely to:
- register you, verify your identity at sign-in and keep your session secure;
- check that your licence is valid each time you sign in, and enforce plan limits such as the number of users or companies;
- provide the Service, including sending Customer Data to our processing engine and returning the results to your device;
- issue invoices, process renewals and maintain statutory accounting and tax records;
- send you essential service messages, such as security alerts, changes to terms, licence expiry reminders and responses to your requests;
- send you product updates or newsletters, only if you separately opt in; you can opt out at any time;
- detect, investigate and prevent security incidents, fraud or misuse of the Service;
- comply with legal obligations and respond to lawful requests from government authorities;
- establish, exercise or defend legal claims.
If we ever wish to use personal data for a new purpose, we will give you a fresh notice and, where required, ask for your consent first.
7. Legal grounds for processing
Under the DPDP Act, we may process your personal data only on the basis of:
- Consent (section 6). Most processing relies on your free, specific, informed, unconditional and unambiguous consent, given by a clear affirmative action. You give it when you tick the consent box at sign-in or submit a form after reading this notice.
- Certain legitimate uses (section 7). Some processing is permitted without separate consent, for example where it is necessary to comply with a law in force in India, a judgment or order, or to respond to a medical emergency or disaster. We rely on this for statutory billing records, security logs required by law and consent records.
Where you use GRID on behalf of your employer or firm, your organisation may also have its own obligations to you as your employer.
8. Consent: giving, managing and withdrawing it
8.1 Consent at every sign-in
Each time you sign in, we ask you to confirm that you have read and accepted this Privacy Notice and the Data Processing Agreement. We do this deliberately, so that you are always aware of how GRID handles data and so that each session has a clear and recorded acceptance of the current versions. The consent box is never pre-ticked.
8.2 Withdrawing consent
You may withdraw your consent at any time, and withdrawing will be as easy as giving it. You can:
- use Settings → Privacy → Withdraw consent in your GRID account; or
- email [privacy@yourdomain] from your registered email address.
Withdrawal does not affect processing that took place before it. Because the Service cannot operate without account data, withdrawing consent to account processing will mean we must close your account. We will tell you this before we act. We will then stop processing and erase your data as described in section 11, except where the law requires us to keep it.
8.3 Consent Managers
Once Consent Managers registered with the Data Protection Board of India are operational, you may also give, manage, review and withdraw consent through such a Consent Manager. We will update this notice when that option is available.
9. Who we share personal data with
We share personal data only with the service providers listed below, and only to the extent needed for them to help us run GRID. Each of them acts as our Data Processor under a written contract that requires them to protect the data, use it only on our instructions and delete it when no longer needed.
| Provider type | Data shared | Purpose | Location |
|---|---|---|---|
| Cloud hosting provider: [Provider name] | Account data, consent records, security logs (encrypted at rest). Customer Data passes through in memory only. | Host the GRID web application, processing engine and account database | India ([region]) |
| Payment gateway: [Provider name] | Name, email, phone, billing address, amount, order reference | Collect subscription payments securely | India |
| Email delivery provider: [Provider name] | Name and email address, message content | Send sign-in, security, billing and service emails | [Location] |
| OpenAI, L.L.C. (ChatGPT / OpenAI API) | When you upload last year's financial statements as a PDF: that PDF | Reading the statements and returning a draft trial balance and the figures; not used to train AI models; not stored by GRID | United States |
| Anthropic, PBC (Claude API), alternative | Only where GRID uses Claude instead of ChatGPT: the uploaded PDF of last year's financial statements | Reading the statements and returning the figures; not used to train AI models; not stored by GRID | United States |
| Support desk tool: [Provider name] | Support messages and any files you choose to share | Manage and respond to support tickets | [Location] |
We may also disclose personal data:
- to government authorities, regulators, courts or law-enforcement agencies where required by law or a valid legal order. Where we are legally allowed to, we will notify you first;
- to professional advisers such as auditors and lawyers, who owe us a duty of confidentiality;
- to a successor entity in a merger, acquisition or restructuring, subject to this notice and to the DPDP Act. We will inform you before your data becomes subject to a different privacy notice.
10. Where your data is stored and transferred
Account data and logs are stored on servers located in India. The GRID processing engine also runs in India.
Some of our service providers may process limited account data, such as your email address, outside India. We permit such transfers only where they are not to a country or territory restricted by the Central Government under section 16 of the DPDP Act, and only under contracts that require protection equivalent to this notice. Customer Data is not transferred outside India by GRID, except that a PDF of last year's financial statements you upload is sent to GRID's AI provider (OpenAI, or Anthropic where configured, in the United States) to be read, as agreed in the Data Processing Agreement you accept at login. To avoid this, upload last year's head-wise trial balance in Excel, which is read without AI.
11. How long we keep data and how we erase it
We keep personal data only for as long as needed for the purpose for which it was collected, or as required by law, in line with the retention periods in section 4.
- Customer Data: not retained at all. It is held in server memory only for the duration of a processing request, typically a few seconds, and is then discarded.
- On account closure: we erase your account identity, credentials, licence and support data within 90 days. Billing, consent and security records are kept only for the statutory periods shown above and are then erased.
- Inactive accounts: if your licence has expired and you have not signed in for 24 months, we will notify you at least 48 hours before erasing your account, as required by the DPDP Rules, so you can sign in or tell us to keep it.
- Backups: encrypted backups of the account database are overwritten on a rolling cycle of no more than 35 days, so erased data leaves our backups within that period.
- Local data on your device: this is under your control. Uninstalling the Companion App does not delete your local GRID folder, so you can keep your records. You may delete the folder yourself at any time.
12. How we protect personal data
We take reasonable security safeguards, as required by section 8(5) of the DPDP Act and the DPDP Rules, to prevent personal data breaches. These include:
- encryption in transit using TLS 1.2 or higher with HSTS, and encryption at rest using AES-256 for the account database and backups;
- passwords stored only as salted, one-way hashes, never in readable form, with optional multi-factor authentication;
- a zero-retention processing engine that runs Customer Data in memory only, with request bodies excluded from all logs and error reports;
- role-based access controls, least-privilege access and multi-factor authentication for our staff, with access to production systems logged and reviewed;
- network firewalls, rate-limiting, protection against brute-force sign-in attempts and automated monitoring for suspicious activity;
- secure development practices, dependency and vulnerability scanning, and independent security testing at least once a year;
- confidentiality undertakings and regular data-protection training for everyone who works on GRID;
- a documented personal data breach response plan, described in section 13.
No system can be guaranteed to be perfectly secure. You can help by using a strong, unique password, enabling multi-factor authentication, keeping your device and operating system updated, and protecting and backing up your local GRID folder.
13. If there is a personal data breach
If a personal data breach affects your personal data, we will:
- act immediately to contain it and limit its effects;
- inform you without delay, in plain language, of what happened, when, how far it reached, the likely consequences for you, what we are doing about it, the steps you can take to protect yourself, and whom to contact;
- inform the Data Protection Board of India without delay, and provide a detailed report within 72 hours of becoming aware of the breach, or such longer period as the Board allows;
- report cyber-security incidents to CERT-In within the time required by law, currently six hours from noticing the incident;
- where the breach affects Customer Data that you control as a Data Fiduciary, notify you promptly so that you can meet your own obligations, as set out in the Data Processing Agreement.
14. Your rights
Under the DPDP Act, you have the following rights in relation to personal data we process as Data Fiduciary.
| Right | What it means |
|---|---|
| Right to access information (s.11) | Obtain a summary of the personal data we process about you and the processing activities, and the identities of the Data Fiduciaries and Data Processors with whom it has been shared, with a description of the data shared. |
| Right to correction, completion and updating (s.12) | Ask us to correct inaccurate or misleading data, complete incomplete data, or update your data. Most details can be edited directly in Settings → Profile. |
| Right to erasure (s.12) | Ask us to erase personal data that is no longer necessary for its purpose, unless the law requires us to keep it. |
| Right to withdraw consent (s.6(4)) | Withdraw consent at any time, as explained in section 8.2. |
| Right of grievance redressal (s.13) | Complain to us about any act or omission concerning your personal data and receive a response. |
| Right to nominate (s.14) | Nominate another individual to exercise your rights in the event of your death or incapacity. |
How to exercise your rights
Email [privacy@yourdomain] from your registered email address, or use Settings → Privacy in your account. To protect you, we may need to verify your identity before acting. We do not charge a fee.
We will acknowledge your request within 7 days and respond within 30 days. If a request is complex, we will tell you why we need more time. In every case we will respond within the maximum period prescribed under the DPDP Rules.
For personal data contained in Customer Data (for example, if you are a debtor, supplier or employee of one of our customers' clients), please contact the relevant customer, who is the Data Fiduciary. Because GRID does not store Customer Data, we generally cannot locate or retrieve it. We will, however, forward any request we receive to the relevant customer where we can identify them.
15. Your duties as a Data Principal
Section 15 of the DPDP Act places certain duties on Data Principals. When you use GRID, you must:
- comply with applicable laws;
- not impersonate another person or provide false particulars;
- not suppress material information when providing personal data for any document or proof;
- not register false or frivolous grievances or complaints;
- provide only verifiably authentic information when exercising your right to correction or erasure.
16. Children and persons with disabilities
GRID is a professional tool intended for adults. We do not knowingly process personal data of children (individuals under 18 years of age) and do not permit children to create accounts. If we learn that we hold a child's personal data without verifiable consent from a parent or lawful guardian, we will erase it promptly.
Where a person with a disability has a lawful guardian, the guardian may exercise rights on that person's behalf after verification, as provided in the DPDP Act and Rules.
17. Cookies and similar technologies
GRID uses only strictly necessary cookies and browser storage:
- a secure, HTTP-only session cookie that keeps you signed in and protects against cross-site request forgery;
- a small preference entry, for example your chosen output format, stored in your browser.
We do not use advertising cookies, third-party tracking pixels, fingerprinting or cross-site analytics. If we introduce any non-essential cookies in future, we will ask for your consent first.
18. The GRID Companion App
The Companion App is a small program that you install on your computer. It:
- reads data from Tally Prime on your computer when you instruct it to;
- saves Customer Data and generated statements in a local folder you choose, optionally encrypted with a key held on your device;
- sends Customer Data to the GRID processing engine over an encrypted connection when you request processing, and saves the results locally;
- sends GRID only minimal technical information needed to verify your licence and deliver updates: app version, operating-system version, a device identifier and licence key.
The Companion App does not scan your computer, read files outside the folders you select, or run in the background when closed, except to install updates you approve.
19. Grievance Officer and complaints
If you have any concern about how we handle personal data, please contact our Grievance Officer:
Grievance Officer: [Name], [Designation]
Email: [grievance@yourdomain]
Address: [Registered office address]
Hours: Monday to Friday, 10:00 to 18:00 IST, excluding public holidays
We will acknowledge your grievance within 7 days and aim to resolve it within 30 days, and in any case within the period prescribed under the DPDP Rules.
If you are not satisfied with our response, you may file a complaint with the Data Protection Board of India through the channels it notifies. Under section 13(3) of the DPDP Act, you should first use our grievance process before approaching the Board.
20. Changes to this notice
We may update this notice to reflect changes in the Service, our practices or the law. The version number and "Last updated" date at the top will always show the current version.
Because you accept the notice at every sign-in, you will always be shown the latest version before you continue. For material changes, we will also email you at least 15 days before the change takes effect, and we will not use previously collected data for a new purpose without fresh notice and, where required, consent.
21. Language
This notice is available in English. In line with section 5(3) of the DPDP Act, you may request it in any language specified in the Eighth Schedule to the Constitution of India by writing to [privacy@yourdomain]. We will provide it within a reasonable time. If there is any inconsistency, the English version will prevail to the extent permitted by law.
22. Contact us
[Legal entity name]
[Registered office address]
Email: [privacy@yourdomain]
Phone: [+91 phone number]
By ticking "I have read and accept the Data Processing Agreement and Privacy Notice" at sign-in, you confirm that you have read and understood this Privacy Notice and consent to the processing of your personal data as described in it.