Privacy Policy & Data Sovereignty Guarantee

01Statutory Framework & DPDPA 2023 Compliance

This Enterprise Privacy Policy governs the processing, ingestion, encryption, and transmission of financial records, invoice images, and Tally Prime telemetry within the Bill2Tally.ai platform, owned and maintained by BJG TECHNOLOGIES PVT. LTD. ("the Company", "Data Fiduciary", "we", "us").

This policy is drafted in strict compliance with:

• The Digital Personal Data Protection Act, 2023 (DPDPA 2023) — India's principal data protection legislation governing the processing of digital personal data
• Information Technology Act, 2000 and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 (SPDI Rules)
• Goods and Services Tax (GST) Act and associated regulations governing financial record retention
• All rules, notifications, and guidelines issued by the Data Protection Board of India under DPDPA 2023

02Definitions — Data Fiduciary & Data Principal

• "Data Fiduciary" refers to BJG Technologies Pvt. Ltd., the entity that determines the purpose and means of processing personal data collected through Bill2Tally.ai, as defined under Section 2(i) of DPDPA 2023.
• "Data Principal" refers to the individual or authorized representative of a subscribing business entity whose personal data is being processed, as defined under Section 2(j) of DPDPA 2023.
• "Data Processor" refers to any third-party service (such as Google Cloud Vision API, Cloudflare R2, Firebase Authentication) that processes personal data on behalf of the Data Fiduciary under contractual enterprise SLAs.
• "Personal Data" means any data about an individual who is identifiable by or in relation to such data, including name, email, phone number, GSTIN, and financial identifiers associated with invoice processing.
• "Processing" includes collection, storage, usage, transformation, erasure, and any automated operation performed on personal data within the Bill2Tally.ai platform.

03Lawful Basis & Consent Management

In accordance with Sections 4–7 of DPDPA 2023, we process personal data only upon obtaining free, specific, informed, unconditional, and unambiguous consent from the Data Principal. Consent is obtained through:

• Account Registration: Explicit consent is captured at the time of sign-up via clear, plain-language consent notices in English and Hindi
• Invoice Upload: Each document upload constitutes an affirmative action confirming consent for OCR processing and structured data extraction
• Tally Sync Authorization: Explicit opt-in is required before activating the desktop synchronization agent

Data Principals may withdraw consent at any time by contacting us at bjgtechnologies@gmail.com. Upon withdrawal, all ongoing processing of the concerned personal data shall cease, and the data shall be erased within 30 days, subject to any statutory retention obligations under GST or other applicable Indian laws.

04Data Ingestion Protocols & Ephemeral OCR Processing

When invoices, bills of supply, or purchase vouchers are uploaded via PDF, scanned image, or mobile camera stream, processing occurs under strict isolation:

• Ephemeral Vision Buffering: Image buffers are normalized in memory and evaluated by vision AI endpoints under zero-retention enterprise SLAs. No invoice image is retained by third-party AI processors after extraction completes.
• Deterministic Math Rules: All tax splits (CGST 9% + SGST 9% vs IGST 18%), HSN code lookups, item discounts, and round-off ledgers are verified using deterministic local algorithmic checksums.
• Standardized Inventory Normalization: Stock items and descriptions are standardized to match authentic Tally Prime accounting hierarchy and ledger formatting.
• Session-Scoped Processing: All AI inference results are scoped to the active session and associated company ID. No cross-tenant data leakage is architecturally possible.

05Categories of Personal Data Collected

We collect and process only the minimum personal data necessary to deliver our accounting automation services:

06Cloudflare R2 Object Storage & Enterprise Encryption

Original invoice documents are stored in private Cloudflare R2 object buckets protected by AES-256 bit server-side encryption at rest. Network transit between your browser, our cloud API endpoints, and your local desktop gateway is enforced over TLS 1.3 with Strict Transport Security (HSTS).

• All data at rest is encrypted using AES-256 server-side encryption
• All data in transit is protected by TLS 1.3 with HSTS preloading
• Firebase Authentication tokens employ RSA-256 signed JWTs with short-lived expiry
• Per-tenant data isolation is enforced through Firestore security rules scoped to authenticated company IDs

07Tally Prime Local Network Perimeter & Data Security

The Bill2Tally synchronization software communicates with Tally Prime locally over your internal computer network. At no point is your local accounting network or Tally setup opened or forwarded to the public Internet; all communication is outbound-initiated by your local authenticated session.

08Data Principal Rights Under DPDPA 2023

In compliance with Chapter III of the Digital Personal Data Protection Act, 2023, every Data Principal is entitled to the following rights:

• Right to Access (Section 11): You may request a summary of the personal data being processed and the processing activities undertaken with respect to your data.
• Right to Correction & Erasure (Section 12): You may request the correction of inaccurate or misleading personal data, the completion of incomplete data, and the erasure of personal data that is no longer necessary for the purpose for which it was collected.
• Right to Grievance Redressal (Section 13): You have the right to register a grievance with our designated Data Protection Officer and receive a response within 30 days.
• Right to Nominate (Section 14): In the event of death or incapacity, you may nominate another individual to exercise your rights under this policy.
• Right to Withdraw Consent: You may withdraw your consent for data processing at any time. The withdrawal shall not affect the lawfulness of processing based on consent before its withdrawal.

To exercise any of these rights, contact our Data Protection Officer at bjgtechnologies@gmail.com. We will respond within 30 calendar days of receiving your request.

09Data Breach Notification & Incident Response

In the event of a personal data breach, BJG Technologies Pvt. Ltd. shall:

• Notify the Data Protection Board of India within the prescribed timeframe as stipulated under Section 8(6) of DPDPA 2023
• Notify each affected Data Principal without undue delay, providing a clear description of the breach, the categories of data compromised, and recommended protective measures
• Activate our Incident Response Plan, including immediate containment, forensic investigation, impact assessment, and remediation within documented SLA timelines
• Maintain a documented Breach Register recording the nature of each breach, its effects, and the remedial actions taken

10Data Retention, Deletion & Purge Guarantees

Subscribing organizations hold full sovereign rights over their data. Personal data is retained only for the duration necessary to fulfill the purpose for which it was collected:

• Active Subscription: Data is retained for the duration of the active subscription plus 90 days post-termination for recovery purposes
• Invoice Documents: Original uploads in Cloudflare R2 are purged within 30 days of permanent deletion by the user or account closure
• Sync Logs: Daybook sync audit trails are retained for the current financial year + 1 year to meet GST audit requirements, then permanently purged
• Account Deletion: Upon account termination, all personal data, binary files, sync logs, and associated metadata are permanently and irreversibly purged from all production clusters within 90 days

11Cross-Border Data Transfer Restrictions

In accordance with Section 16 of DPDPA 2023, personal data processed by Bill2Tally.ai shall not be transferred to any country or territory outside India that has been restricted by the Central Government through notification. Where third-party Data Processors (e.g., Cloudflare, Google Cloud) process data on servers located outside India, such processing is governed by enterprise-grade Data Processing Agreements (DPAs) that contractually enforce equivalent data protection standards.

12Grievance Redressal & Data Protection Officer

In accordance with Section 8(10) of DPDPA 2023, BJG Technologies Pvt. Ltd. has designated a Data Protection Officer (DPO) as the point of contact for all privacy-related queries, complaints, and rights requests:

If the Data Principal is not satisfied with the response, they may file a complaint with the Data Protection Board of India as constituted under Chapter V of DPDPA 2023.