Short version: we use your account data only to run Parakh, never sell it, keep it only as long as needed, and you can download or erase it yourself from Settings → Privacy & data.
1. Who we are
Parakh Software ("Parakh", "we") operates this service. For account data we are the data fiduciary. Address: . GSTIN .
For personal data inside the files you upload (for example a supplier's name, a proprietor's GSTIN, or a supplier contact email) your organisation is the data fiduciary and we process it on your behalf under the data processing addendum.
2. What we collect and why
| Data | Purpose | Kept for |
|---|---|---|
| Name, work email, company name | Create and run your account, send service emails (sign-in links, invites, receipts) | Until you erase your account or the workspace is deleted |
| Password | Sign-in. Stored only as an Argon2id hash; we cannot see it | As above |
| Two-factor secret (if enabled) | Verifying sign-in codes | Until you turn 2FA off |
| IP address, browser, sign-in times | Security: sessions, rate limiting, audit log | Sessions: 14 days. Audit log IPs: 180 days |
| Billing name, GSTIN, address, payment reference | Issuing GST tax invoices | 8 years, as required by tax law (CGST Act s.36 and the Income-tax Act) |
| Consent records | Proving what you agreed to and when (DPDP s.6(10)) | Kept against a hashed email, even after erasure |
| Marketing preference | Product updates, only if you opt in | Until you withdraw |
Suppliers who answer a follow-up. The response page linked from a customer's email sets no cookies. What you enter there (your answer per invoice, an optional note, name and phone) goes to that customer, who is the data fiduciary for it; we process it on their behalf. We log the IP address with the answer for security, and delete it after 180 days.
We do not use your data for advertising, sell it, or train AI models on it. We set one strictly necessary cookie (parakh_sid) to keep you signed in, and nothing else.
3. Who we share it with
- Razorpay (payments), only when you pay.
- Our email provider, to deliver service emails.
- Our hosting provider in India, which stores the encrypted database.
Each processor is bound by contract to use the data only for providing its service to us. We disclose data to authorities only when Indian law requires it.
4. Your rights
- Access (s.11): download a complete copy from Settings → Privacy & data.
- Correction and erasure (s.12): edit your profile any time. Erase your account from Settings → Privacy & data; owners erase by deleting the workspace.
- Withdraw consent (s.6(4)): as easily as you gave it, from the same page. Withdrawing consent for service processing means closing the account.
- Nominate (s.14): name someone who can exercise these rights if you die or become incapacitated.
- Grievance redressal (s.13): contact our Grievance Officer. If you're not satisfied with our answer, you may complain to the Data Protection Board of India.
5. Security and breaches
See Security. If a personal data breach occurs, we will notify affected users and the Data Protection Board as required by the Act and its Rules.
6. Retention and deletion
Uploaded files are deleted 7 days after upload. Reconciliations follow your workspace's retention setting. Trial workspaces that never subscribe are deleted 90 days after the trial ends, after an email warning. Email delivery logs are deleted after 30 days.
7. Children
Parakh is a business tool for people aged 18 and over. We do not knowingly process children's data.
8. Changes
When this notice changes materially we update the version above and ask signed-in users to review it and agree again.
9. Contact
Grievance Officer: Grievance Officer, grievance@parakh.in, or use the grievance form.