Privacy Policy

1. Who we are

ITCAlert ("ITCAlert," "we," "us," or "our") is currently a pre-launch product being built by its founding team in India. We are in the process of formal business registration; once that is complete, this section will be updated with our registered legal entity name and address. Until then, ITCAlert is operated on a pre-incorporation basis.

This policy applies to visitors of our website, participants in our early-access waitlist, and, once launched, users of the ITCAlert product.

2. Information we collect

Waitlist & website visitors. When you join our waitlist we collect the email address you provide, along with basic technical data such as your browser type, device type, and approximate location, collected automatically when you visit our site.

Product users (once ITCAlert is live). The core reconciliation — matching your purchase register against GSTR-2A/2B — runs locally on your device. Your full purchase register, invoice-level data, and GSTR-2A/2B records are not uploaded to our servers as complete datasets. To provide the rest of the service, we collect:

• Account details: name, email address, phone number, and business/organisation name.
• GSTIN(s) linked to your account, used to identify which business you're reconciling for.
• Supplier information: names, GSTINs, and contact details of your suppliers, along with the specific alert message you choose to send — the minimum needed to notify a defaulting supplier on your instruction.
• Billing information, if you subscribe to a paid plan (processed by our payment partner — we do not store full card details).
• Usage data and history: log files, pages visited, features used, alerts sent, and error reports, used to keep the product reliable and give you a record of past activity.

3. How we use it

We use the information above to: operate and improve ITCAlert; reconcile your purchase data against GSTR-2A/2B and flag mismatches; send notifications to defaulting suppliers at your request; communicate with you about your account, the waitlist, or product updates; provide customer support; detect and prevent fraud or misuse; and comply with applicable law.

We do not sell your personal data or your business's GST data to third parties, and we do not use your uploaded financial data to train third-party AI models.

4. Legal basis for processing

We process personal data in accordance with India's Digital Personal Data Protection Act, 2023 (DPDP Act) and other applicable data protection laws. Where required, we rely on your consent (for example, when you join the waitlist or upload supplier contact details), and otherwise on the basis that processing is necessary to provide the service you have requested or to meet a legal obligation.

5. Sharing & disclosure

We share information only with:

• Service providers who host our infrastructure, send emails/SMS notifications, process payments, or provide analytics — bound by confidentiality and data-processing agreements.
• GST Suvidha Providers (GSPs) or the GST portal, only where you have explicitly authorised a data connection.
• Your suppliers, but only the minimum information (such as invoice reference and filing status) needed for the alert you choose to send — we never share your full ledger with a supplier.
• Authorities, where disclosure is required by law, regulation, or a valid legal process.
• A successor entity, in the event of a merger, acquisition, or sale of assets, subject to this policy continuing to apply.

6. Storage & security

Because the core reconciliation runs locally on your device, your full purchase register and GSTR-2A/2B data are generally not transmitted to or stored on our servers, which limits the data we hold and the impact of any potential breach. For the account, supplier-alert, and history data we do store, we use industry-standard safeguards — encryption in transit (TLS) and at rest, access controls, and regular security reviews. No system is completely secure, and we encourage you to use a strong, unique password and enable any additional security features we offer once available.

7. Data retention

We retain waitlist email addresses until launch or until you ask us to remove them. Once the product is live, we retain account and GST-related data for as long as your account is active, and for a reasonable period afterward to meet legal, accounting, or dispute-resolution requirements, after which it is deleted or anonymised.

8. Your rights

Subject to applicable law, you have the right to: access the personal data we hold about you; correct inaccurate data; request erasure of your data; withdraw consent at any time (for example, by unsubscribing from the waitlist); and lodge a grievance with our Grievance Officer or the relevant data protection authority. To exercise these rights, contact us using the details in Section 13.

9. Cookies

We use a small number of cookies and similar technologies for essential site functionality (such as remembering your theme preference) and, where enabled, basic analytics to understand how visitors use our site. You can control cookies through your browser settings.

10. Children's privacy

ITCAlert is intended for business use and is not directed at individuals under 18. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us and we will delete it.

11. International transfers

Your data is primarily stored and processed in India. If we use infrastructure or sub-processors located outside India, we take steps to ensure they provide an equivalent standard of protection, in line with applicable law.

12. Changes to this policy

We may update this policy from time to time — including once our business registration is complete and this section is updated with our formal legal entity details. We will post the revised version on this page with an updated "Last updated" date, and, for material changes, notify you by email or an in-product notice.

13. Contact us

For any privacy questions, requests, or grievances, contact us at: