The short version. The free tools work in memory and forget you after 30 minutes. We use no tracking cookies, no analytics, and nothing on this site is loaded from another company. If you ask us to send you a report, or write to us, we use the details you give us to answer you, keep them for up to 12 months, and you can ask us to delete them whenever you like.
1. Who we are
This website is run by Fintacy Solutions Private Limited, which decides why and how the personal data described here is used. In the language of the DPDP Act, we are the Data Fiduciary, and you are the Data Principal.
Fintacy Solutions Private Limited No. 582, 3rd Floor, B J Arcade, 7th Main, 4th Cross Road, HMT Layout, CBI Road, R T Nagar Bengaluru - 560 032 CIN: U74999KA2021PTC154073
Privacy contact: hello@fintacysolutions.in
2. What we collect, why, and for how long
| When you… | What we receive | Why | How long |
|---|---|---|---|
| Visit any page | Nothing that identifies you reaches us. Like almost every website, the servers that host this site keep standard technical logs (your IP address, the page requested, the time). | Keeping the site secure and working. We do not analyse these logs or use them to identify or profile visitors. | Held by our hosting provider under its routine log retention. |
| Use a free tool, or try to sign in to edit the site | A security log entry: the time, the type of event (for example, a report was generated, viewed, downloaded or deleted), the report's reference number, and the IP address the request came from. Never the files you uploaded, the answers you gave, or your name. | Detecting and investigating unauthorised access, as required by Rule 6(1)(e) of the DPDP Rules, 2025. | 12 months, then automatically deleted. |
| Use the GST Health Report | The files you upload are read in memory to build your report, then discarded. We are told only that a report was made: its reference number, period, score and the ITC-at-risk figure — never your name, business or GSTIN. | Building your report. | Files: not kept. The report: 30 minutes (you can delete it sooner). |
| Use the DPDP Readiness Check | Your answers and organisation name are used in memory to build the report. A draft is kept in your own browser until you generate the report. We are told only that a report was made: its reference number, score, number of gaps and highest penalty ceiling — never who you are. | Building your report. | The report: 30 minutes (you can delete it sooner). |
| Ask us to send you a copy of a report | Your name, your email and/or phone (whichever you give; phone is optional), your business or organisation name, the report's reference number and score, and a record of your consent (when, and which version of this notice). | Sending you the PDF, following up on your report, and proving what you agreed to. | Up to 12 months, then deleted — or sooner if you ask. |
| Use the enquiry form on our homepage | Your name, email and message, sent through your own email app to our mailbox. | Replying to you. | Up to 12 months unless you become a client, in which case your details are handled under our engagement terms. |
| Are one of our staff | One sign-in cookie, used only by our team to edit the site. | Keeping the editing screens private. | 12 hours. |
Cookies: visitors receive none. We do not use analytics, advertising or tracking tools.
3. Who receives your details
Only if you ask for a copy of a report, or write to us. Even then, only:
- Our team.
- Our email delivery provider, to send the PDF to the address you give us.
- Telegram, the messaging service on which our team receives the alert that says you asked for a copy. Telegram's servers may be outside India.
- The company that hosts this website, which runs the servers everything above passes through.
We do not sell your details, use them for advertising, or share them with anyone else, except where the law requires it.
4. Your consent
Before a tool starts. The GST Health Report and the DPDP Readiness Check each show a short “Before you start” card that explains, in four steps, how the tool works, and ask you to tick a box to agree before you begin. The tool will not build a report without it. We remember that you agreed in your own browser only, never on our servers, and we ask again if this notice changes. Done: you will be asked again next time.
We use the details you give us for a copy of a report only because you ticked the box to agree. The box is never ticked for you. You can withdraw your consent at any time, as easily as you gave it: write to the address above and say so. We will stop using your details and delete them unless the law requires us to keep them.
5. Your rights
- Know what personal data of yours we hold, and who we have shared it with.
- Correct or complete anything that is wrong or missing.
- Have it erased, and withdraw consent, whenever you like.
- Complain. Write to the privacy contact above and we will respond promptly and in any case within 30 days. If you are not satisfied, you may complain to the Data Protection Board of India, in the manner it prescribes.
- Nominate another person to exercise these rights on your behalf if you die or become unable to.
To use any of these, email hello@fintacysolutions.in and, if you have one, quote the reference number from your report (it looks like FSR- or FDR- followed by digits and letters).
6. Your responsibilities
The DPDP Act asks people whose data we hold to do a few things in return. Please: follow the law when you use your rights; do not pretend to be someone else when you give us details; do not hide material information when giving us details for an official document; do not make false or frivolous complaints to us or to the Data Protection Board; and, when you ask us to correct or erase something, give us only information that is verifiably authentic.
7. Children
These tools are for businesses and organisations. They are not directed at children (anyone under 18), and we do not knowingly collect a child's personal data. If you think we have, tell us and we will delete it.
8. Keeping it safe
We take reasonable security safeguards: tool data is held in memory only and expires; nothing is loaded from third parties (an automated test checks this); access to editing is limited to our staff and rate-limited against password guessing. If a breach affects your personal data, we will tell you and the Data Protection Board as the law requires.
Security logs, kept for 12 months. The DPDP Rules ask every organisation to keep logs that can catch and investigate unauthorised access, for at least a year. We keep a security log of events like a report being generated, viewed, downloaded or deleted, and of sign-in attempts to edit the site — the time, the type of event, a report's reference number, and the IP address the request came from. This is separate from, and much narrower than, the files you upload or the answers you give: those are still never stored, exactly as described above. The Rules also ask some organisations to keep the personal data itself, not just logs about it, for a year — but only for a short list of purposes tied to government use of data (Rule 8(3) read with its Seventh Schedule). None of those purposes describe what this site does, so that wider duty does not apply to us, and we do not keep your files or answers beyond the times stated above.
9. Changes to this notice
The version number above changes whenever this notice changes in a way that matters, and the version you agreed to is recorded with your consent. Where a change needs your consent again, we will ask.
10. How we hold ourselves to this
We run our own DPDP Readiness Check on this website, and publish the result, including what we have not yet done, at How we practise the DPDP Act.