Privacy Policy

1. Overview and Scope

SumGST (“we”, “our”, or “the platform”) provides software solutions designed specifically for Indian Chartered Accountants, tax practitioners, and their business clients. Our software organizes marketplace sales reports, reconciles tax records, and assists in preparing GSTR-1 working summaries.

This Privacy Policy explains how we collect, process, store, and protect account information and financial records uploaded to SumGST workspaces. We believe in transparency, minimal data collection, and absolute respect for professional client confidentiality.

2. Information We Collect

We collect information solely to provide, secure, and operate the GST preparation workspace:

• Firm & User Account Details: Name, mobile phone number, firm trade name, and encrypted authentication credentials. We use mobile numbers for two-factor verification and authorized access.
• Client Profile Information: Business trade name, legal entity name, Goods and Services Tax Identification Number (GSTIN), and assigned filing frequency (Monthly or QRMP quarterly).
• Uploaded Source Records: E-commerce sales reports (Amazon, Flipkart, Meesho, and other marketplaces), direct sales spreadsheets, credit/debit notes, and bank statements provided by clients or their CAs for reconciliation.
• Operational & Audit Logs: Timestamps of file uploads, customer completion confirmations, return review approvals, and recorded GST filing evidence.

3. How We Use Client and Tax Data

Data provided to SumGST is processed strictly for the benefit of the CA firm and the client:

• To extract and categorize transaction totals, taxable values, CGST, SGST, IGST, and cess.
• To identify discrepancy exceptions, such as differences between source marketplace rows and return working papers.
• To generate exportable GSTR-1 working summaries and supported formats for CA review.
• To maintain an immutable revision trail showing who prepared, reviewed, and marked returns as filed.

4. Tenant Isolation and Data Boundaries

SumGST uses strict multi-tenant boundary controls. Every query and data access operation is scoped to the authenticated organization and authorized user:

• CA Firm Boundaries: Firm staff can only access clients and GSTINs explicitly provisioned within their firm.
• Client Boundaries: Business customers logging into the customer portal can only view their own assigned GSTINs and upload files for their designated periods.
• Zero Cross-Tenant Exposure: Data from one firm is strictly isolated from all other firms at the software and database layers.

5. Data Retention and Deletion

We retain financial records during the term of your active subscription to support statutory multi-year audit and revision requirements under the Central Goods and Services Tax (CGST) Act.

Upon account cancellation or formal written request by a firm owner, we provide structured data export options and permanently delete stored client files and database records in accordance with our standard backup rotation cycles (typically within 30 days of confirmed decommissioning).

6. Security Measures

We apply industry-standard administrative, physical, and technical controls:

• Encryption in Transit: Mandatory HTTPS/TLS 1.3 and TLS 1.2 across all web endpoints and API communications.
• Encryption at Rest: Database tables, storage buckets, and backups are encrypted using AES-256.
• Authentication Security: Passwords are hashed using salted cryptographic functions. Brute-force and rate-limiting safeguards protect all login routes.

7. Contact and Grievance Redressal

In accordance with the Information Technology Act, 2000 and the rules made thereunder, the Grievance Officer for SumGST can be contacted for any privacy inquiries, data subject access requests, or security questions:

Email: privacy@sumgst.com
Attention: Privacy & Data Governance Desk
SumGST: Operated by Hyavi Technologies