Last updated: July 10, 2026
1. Information We Collect
Account Information
When you create an account, we collect:
- Email address
- Password (encrypted)
- Organization name
- GSTIN (if provided)
Uploaded Data
When you use our Service, we process:
- Marketplace sales CSV/XLSX files you upload
- Transaction data extracted from these files
- Generated GSTR-1 outputs
Product Analytics
When analytics is enabled, we collect page views, feature usage, browser and device information, approximate location derived from network information, and diagnostic events. We do not intentionally send uploaded file contents, transaction values, GSTINs, passwords, or payment-card details to analytics providers.
2. How We Use Your Information
We use your information to:
- Provide and improve our GSTR-1 generation service
- Process and store your transaction data securely
- Send important service notifications
- Process payments and manage subscriptions
- Respond to support requests
3. Data Security
We implement industry-standard security measures:
- Encryption: All data is encrypted at rest and in transit (TLS 1.3)
- Access Control: Row-level security ensures you only access your own data
- Secure Storage: Files are stored in encrypted cloud storage (Cloudflare R2)
- Password Protection: Passwords are hashed using bcrypt
- Rate Limiting: Protection against brute-force attacks
4. Data Retention
We retain your data as follows:
- Account Data: Retained while your account is active
- Operational Filing Data: Uploaded files, normalized transaction data, processing jobs, and generated outputs are automatically deleted after 30 days
- Protected Records: Security audit and billing records may be retained for up to 7 years where required for security, dispute resolution, accounting, or legal compliance
5. Third-Party Services
We use the following third-party services:
- Razorpay: Payment processing (subject to Razorpay's privacy policy)
- Cloudflare: CDN and file storage
- Sentry: Error tracking and monitoring
- PostHog and Google Analytics: Product and website analytics when configured
6. Your Rights
You have the right to:
- Access your personal data
- Request correction of inaccurate data
- Request deletion of your account and eligible data, subject to legal or security retention requirements
- Request a copy of your eligible account data
- Withdraw consent for marketing communications
These requests are not currently self-service. Email privacy@gstbrew.com from your account email so we can verify the request.
7. Cookies
We use essential cookies for:
- Authentication (session management)
- Security (CSRF protection)
When product analytics is configured, PostHog or Google Analytics may store analytics identifiers in cookies or browser storage. We use these for product measurement and diagnostics, not for selling personal data or serving third-party ads. Browser privacy controls and content blockers may restrict this collection.
8. Changes to This Policy
We may update this Privacy Policy from time to time. We will notify you of significant changes by email or through the Service.