Privacy Policy

Last updated: 26 October 2026

This policy explains how Lekhafy (CA Gourav Verma) ("Lekhafy", "we") handles personal data when you use Lekhafy, in line with the Digital Personal Data Protection Act, 2023 and the Information Technology Act, 2000.

1. Two kinds of data

Your account data. For this, we decide why and how the data is processed (we are the Data Fiduciary).

Data inside the reports you upload. Marketplace reports can contain your customers' details, such as names, delivery states, order numbers and buyer GSTINs. You (the seller) decide why this data is processed. We process it only on your instructions, to prepare your returns, and act as your processor.

2. What we collect

• Account: name, email address, a hashed (not readable) password, and login session records.
• Business: the GSTINs that appear in your uploads, and any names you give them.
• Return data: the GSTR-1 JSON, GSTR-3B and TCS summaries, and the Excel working produced from your reports. The working lists each line used, which can include order numbers, invoice numbers, product descriptions, buyer GSTINs and buyer names.
• Payments: plan, subscription status, and Razorpay payment and subscription IDs. Card, UPI and bank details are entered on Razorpay's own checkout and never reach our servers.
• Technical: server logs (IP address, time, pages requested) kept for security and troubleshooting.

3. What we don't keep

The report files you upload are read in memory to produce your results and are not stored. We do not sell personal data, use it for advertising, or use your return data for any purpose other than providing the service to you.

4. Why we use it

• To run your account, prepare your returns and show your history.
• To bill you and enforce plan limits.
• To send service emails, such as password resets, payment receipts and important changes.
• To keep the service secure and fix problems.

You give consent when you create an account. You can withdraw it at any time by deleting your account (see section 7).

5. Who we share it with

We share data only with service providers needed to run Lekhafy, under contracts that require them to protect it:

• Oracle Cloud Infrastructure, which hosts our servers and database in India (Mumbai).
• Razorpay Software Private Limited, for payments.
• Brevo, for sending service emails.

We may disclose data when Indian law or a valid order from a court or government authority requires it.

6. How long we keep it

Saved returns and workings are kept while your account is open so you can re-download them. When you delete your account, we delete your login, GSTINs, saved returns and workings straight away. Backups that contain them are overwritten within 30 days. Payment records may be kept longer where tax or accounting law requires it.

7. Your rights

• See and download: your saved results are available in History at any time.
• Correct: email us to correct account details.
• Erase: delete your account from Plan & billing → Account, or email us.
• Grievance: contact our Grievance Officer below. If you aren't satisfied with the response, you can complain to the Data Protection Board of India.
• Nominate: you can nominate someone to exercise these rights on your behalf if you die or become incapacitated.

If you are a seller's customer and want your data removed from a seller's reports, please contact that seller, who controls that data. We will help them respond.

8. Security

Connections are encrypted with HTTPS. Passwords are stored as one-way hashes, and access to production systems is restricted. If a personal data breach occurs, we will inform affected users and the Data Protection Board as the law requires.

9. Children

Lekhafy is a business service and is not meant for anyone under 18.

10. Cookies

We use one essential cookie to keep you logged in. We use no advertising or tracking cookies.

11. Changes

We will email you before material changes to this policy take effect.

12. Grievance Officer and contact

CA Gourav Verma, Grievance Officer, Lekhafy (CA Gourav Verma), Panipat, Haryana 132103. Email: cagouravv@gmail.com. We will respond within 30 days.