Privacy Policy — Chitragupta

1. Data Controller & DPO

Chitragupta is operated by Deepak Achary, the Data Protection Officer (DPO) designated under the Digital Personal Data Protection Act, 2023 (DPDP Act, Section 10).

DPO Contact: dpo@kubera.app
Response SLA: <72 hours acknowledgment, 90 days resolution

You may also file a grievance directly at our DPO & Grievance page.

2. Information We Collect

2.1 Information You Provide

Account details (name, email, business name), transaction data (expenses, income, partner accounts, GSTIN), partner details (name, ownership percentage, GSTIN), and billing information for paid plans.

2.2 Information Collected Automatically

Usage data (pages visited, features used, session duration)
Device and browser information
IP address — collected at login, consent actions, and data requests for audit and security (DPDP Act Section 8, reasonable purpose)
Approximate location (derived from IP, at city level only)

2.3 Payment Information

Billing information necessary to process payments. Payment processing is handled by Razorpay (PCI-DSS compliant). We do not store full payment card details.

3. Purposes of Processing (DPDP Act Section 5)

We process your personal data only for the following specific purposes. Each purpose corresponds to a consent feature you can manage from Settings:

Purpose	Data Used	Consent Feature
Account management & authentication	Name, email, hashed password	profile_storage
Transaction tracking & partnership management	Transaction data, partner details, GSTIN	financial_tracking
Partner data storage (GSTIN, ownership)	Partner name, GSTIN, ownership %	partner_data
AI-powered categorization & analytics	Transaction descriptions, categories	ai_processing
Email notifications (reports, reminders)	Email address	email_updates
Marketing & promotional communications	Email address	marketing

4. Legal Basis (DPDP Act Section 6)

We process your data based on the following legal grounds:

Consent — for all data processing. You may grant or withdraw consent per feature at any time from Settings.
Contract — for processing necessary to provide the Service (transaction recording, partnership accounting).
Legal obligation — GST/TDS compliance, tax record retention as required by Indian law.

5. Third-Party Services

Service	Purpose	Data Shared	Location
PostgreSQL (Self-hosted, India)	Database	All account & transaction data	Oracle Cloud, MumbaiINDIA
Cloudflare Inc.	CDN, DNS, DDoS protection	IP address, request metadata	Global (CDN)
Razorpay	Payment processing	Payment details (PCI-DSS compliant)	India

6. Data Storage & Security

All data is stored in India (Oracle Cloud, Mumbai) — no cross-border transfer
Encryption in transit (TLS 1.3) and at rest
EdDSA (Ed25519) signed JWTs for authentication
PBKDF2 password hashing (100,000 iterations)
Access controls restrict data access at the application and database level
Daily backups with 7-day retention

7. Data Retention

We retain your data for as long as your account is active. After account deletion:

Personal data is anonymized within 24 hours
Transaction data required for tax/GST compliance is retained in anonymized form per Indian law requirements
Audit logs are retained for 1 year

8. Your Rights (DPDP Act 2023)

8.1 Right to Access (Section 11)

Request a copy of all personal data we hold about you via Settings > Data Rights > Export Data. We respond within 30 days.

8.2 Right to Correction (Section 12)

Correct inaccurate or incomplete data from your profile settings, or file a correction request via Settings > Data Rights.

8.3 Right to Erasure (Section 13)

Request deletion of your account and associated data. We offer a pre-deletion data export (optional), wait 48 hours, then permanently delete. This is available at Settings > Data Rights > Delete Account.

8.4 Right to Grievance Redressal (Section 14)

File a grievance regarding your data privacy. We acknowledge within 72 hours and resolve within 90 days. If unsatisfied, escalate to the Data Protection Board of India.

8.5 Right to Withdraw Consent (Section 9)

Withdraw consent for any processing purpose at any time from Settings > Privacy. Processing stops within 24 hours. Note: Withdrawing essential consents (profile_storage, financial_tracking) may affect service functionality.

8.6 Right to Nominate (Section 16)

You may nominate a representative to exercise your data rights on your behalf after your incapacity or death. Contact the DPO for details.

9. Consent Management

We use granular, feature-level consent as required by the DPDP Act. You can manage consents from the Privacy section in Settings:

Profile Storage — Store your name, email, and profile data
Financial Tracking — Record and manage transactions, expenses, income
Partner Data — Store partner names, GSTIN, and ownership info
AI Processing — AI-powered transaction categorization and analytics
Email Updates — Periodic reports, reminders, and notifications
Marketing — Promotional emails and feature announcements

Your consent choices are recorded with timestamp, IP address, and user agent for audit compliance.

10. Breach Notification (DPDP Act Section 8(6))

If a data breach is confirmed, we will:

Notify the Data Protection Board of India within 72 hours
Notify all affected users within 72 hours
Publish a post-mortem within 14 days

To report a suspected breach, email dpo@kubera.app with subject "SECURITY INCIDENT".

11. Cookies & Tracking

We use only essential cookies for authentication (JWT tokens) and session management. We do not use tracking cookies, third-party analytics cookies, or advertising cookies.

12. Children's Privacy

The Service is not intended for users under 18. We do not knowingly collect data from children. If you believe a child has provided data, contact the DPO immediately.

13. Changes to This Policy

We may update this policy. Material changes will be communicated via in-app notification and email. Continued use after changes constitutes acceptance of the updated policy.

14. Contact & Escalation

Data Protection Officer: Deepak Achary
Email: dpo@kubera.app

Escalation: If your grievance is not resolved within 90 days, file a complaint with:
Data Protection Board of India
https://complaints.dpbi.gov.in

Compliant with the Digital Personal Data Protection Act, 2023 (DPDP Act).