Privacy Policy

Complynest Private Limited ("we") is the data fiduciary for personal data processed through XBRL Express. This policy explains what we collect and why, in line with the Digital Personal Data Protection Act, 2023 ("DPDP Act"), the Information Technology Act, 2000 and the Reasonable Security Practices and Sensitive Personal Data Rules, 2011.

1. What we collect

• Account data: name, email, mobile number, password (stored only as a salted hash).
• Company and filing data: company name, CIN, PAN, addresses, directors' and key personnel names and DIN, shareholder and group-entity details, auditor details, financial statements, reports and other documents you upload.
• Payment data: order, amount, status and reference numbers. Card, UPI and bank details are entered on Cashfree's secure pages and are not stored by us.
• Technical data: IP address, browser, and log entries needed for security and audit trail; one essential session cookie (see section 8).
• Communications: messages, comments, emails exchanged with us.

2. Why we use it

• To create your account, take payment and prepare, review, sign and file your XBRL documents (contract performance, and your consent).
• To send service emails about your filing, due dates and payments.
• To keep records, prevent fraud and misuse, and comply with law (including tax, accounting and professional-record requirements).
• To respond to queries and grievances.

Marketing: we may send occasional business emails about our service to company contacts. Every such email states who we are and has a one-click unsubscribe; we stop immediately when you opt out. We do not sell personal data.

3. Who we share it with

Only as needed: Cashfree Payments (payment processing); our hosting provider (Railway) and cloud storage/email providers (such as Google Drive and an SMTP/email delivery service) that store or transmit data for us under their security terms; the practising professional(s) who certify and file forms; and MCA and other authorities when we file on your instruction or when the law requires. Your data may be stored on servers located outside India; we choose reputed providers and do not restrict transfers to any country the Government of India has notified as restricted.

4. How long we keep it

We keep filing records for as long as the engagement continues and thereafter for the period needed for statutory, tax and professional-record purposes (generally up to 8 years after the filing), then delete or anonymise them. Account data is deleted on request subject to this retention. Marketing contacts who unsubscribe are kept only on a suppression list so that we do not write to them again.

5. Security

We use encrypted connections (HTTPS), hashed passwords, access controls separating clients, upload checks, rate limiting, audit logs and restricted administrator access. No system is perfectly secure; if a personal data breach affects you we will inform you and the Data Protection Board of India as the law requires.

6. Your rights

You may ask to access a summary of your data, correct or complete it, erase it, withdraw consent, nominate another person to exercise your rights, or raise a grievance. Use My account after login or write to our Grievance Officer (below). We respond within 30 days. Withdrawing consent or erasure does not affect lawful processing already done, and some records must be retained by law.

7. Children

The service is for businesses and is not directed at persons under 18.

8. Cookies

We use only a strictly necessary session cookie to keep you logged in and protect forms against forgery. We do not use advertising or analytics cookies. Payment pages of Cashfree may set their own cookies.

9. Grievance Officer

Rahul Srivastava, Complynest Private Limited, 23A, 11th Floor, Room No. 30, Fortuna Tower, N. S. Road, Kolkata - 700001, West Bengal, India. Email vjmrahul@gmail.com. We acknowledge within 48 hours and resolve within 30 days. If unresolved you may approach the Data Protection Board of India once constituted.

10. Changes

We will post updates here with a new date; for material changes we will notify registered users.