Privacy Policy

1. Data Fiduciary

For the purposes of the Digital Personal Data Protection Act, 2023, the Data Fiduciary is:

2. Information We Collect

We collect the following categories of personal data when you use UdyamPilot:

• Personal Information: Name, email address, phone number, and business name provided during registration
• Business Information: GSTIN, Udyam Registration Number, PAN, business address, industry classification, and annual turnover
• Financial Data: Invoice details, tax filing data, input tax credit records, and compliance documents uploaded to the platform
• Usage Data: Pages visited, features used, device type, browser type, IP address, and session duration

3. Purpose of Data Collection

We process your personal data only for the following specified, clear, and lawful purposes:

• Provide, maintain, and improve the UdyamPilot MSME scheme discovery and compliance service
• Match your business profile to eligible government schemes, subsidies, and grants
• Generate GST returns, compliance reports, and filing summaries
• Send compliance deadline reminders and regulatory updates
• Process waitlist registration and manage your account
• Ensure accuracy of tax calculations and compliance checks
• Analyze usage patterns to improve user experience
• Prevent fraud and protect the security of our Service

We will not process your personal data for any purpose beyond what is specified above without obtaining fresh consent.

4. Consent

By registering on UdyamPilot or joining our waitlist, you provide your free, specific, informed, unconditional, and unambiguous consent to the collection and processing of your personal data for the purposes stated in this policy. You may withdraw your consent at any time (see Section 10 below).

5. Data Storage and Security

Your data is stored on servers located in India. We use industry-standard encryption and security measures to protect your data during transmission and storage. Given the sensitive nature of financial and tax data, we implement additional safeguards including encrypted storage for GSTIN and PAN data, audit logging for all data access, and regular security assessments.

6. Data Sharing

We do not sell, rent, or trade your personal data to third parties. We may share your information only in the following circumstances:

• With GST Network (GSTN) and government portals as necessary to file returns and verify scheme eligibility on your behalf, with your explicit consent
• With data processors who assist in operating our platform, under written agreements ensuring equivalent data protection standards
• When required by law, regulation, or legal process
• To protect the rights, property, or safety of our Company, users, or the public

7. Cookies

We use cookies and similar tracking technologies to enhance your experience on our platform. Cookies help us remember your preferences, understand how you use the Service, and improve our offerings. You can control cookie settings through your browser preferences. Essential cookies required for the Service to function cannot be disabled.

8. Data Principal Rights (DPDPA Sections 11-14)

In accordance with the Digital Personal Data Protection Act, 2023, as a Data Principal you have the following rights:

• Right to Access (Section 11): Request a summary of your personal data being processed and the processing activities undertaken
• Right to Correction (Section 12): Request correction of inaccurate or misleading personal data, and completion of incomplete personal data
• Right to Erasure (Section 12): Request erasure of your personal data that is no longer necessary for the purpose for which it was collected
• Right to Grievance Redressal (Section 13): Lodge a complaint with our Data Protection Officer regarding the processing of your personal data
• Right to Nominate (Section 14): Nominate any other individual who shall, in the event of your death or incapacity, exercise your rights

To exercise any of these rights, please contact our Data Protection Officer at kishorer747@gmail.com or write to support@devpilot.co.in. We will respond to your request within 30 days.

9. Data Retention

We retain your personal data in accordance with the following schedule:

• Waitlist data: Retained until product launch plus 6 months. After this period, your data will be deleted unless you opt in to continued communications.
• Account data: Retained while your account is active. Upon deletion request, personal data will be erased within 30 days, and fully purged within 2 years.
• Tax and compliance data: Retained for a minimum of 8 years as required under Indian tax laws (Income Tax Act, 1961; CGST Act, 2017).
• Scheme application records: Retained for 5 years after the scheme benefit period ends, as required by government audit requirements.
• Financial documents (GSTIN, PAN, returns): Retained for 8 years as mandated by applicable statutory requirements.

Aggregated and anonymized data that cannot identify you may be retained indefinitely for analytical purposes.

10. Consent Withdrawal

You have the right to withdraw your consent at any time by:

• Emailing support@devpilot.co.in with the subject line "Withdraw Consent"
• Using the account settings within the UdyamPilot application (when available)

Consequences of withdrawal: Upon withdrawal of consent, we will cease processing your personal data. However, this may result in termination of your access to UdyamPilot services, including active scheme applications and compliance monitoring. Withdrawal of consent will not affect the lawfulness of processing carried out before the withdrawal. Tax and compliance data required to be retained under Indian tax laws (8-year minimum) will continue to be stored for the statutory period.

11. Data Protection Officer

In compliance with DPDPA requirements, we have appointed a Data Protection Officer:

12. Cross-Border Data Transfer

Your personal data is primarily stored and processed on servers located in India. In certain cases, data may be transferred to or processed in jurisdictions outside India in connection with the following third-party services:

• Cloud infrastructure providers for hosting and content delivery
• AI service providers for scheme matching and compliance analysis

Such transfers are made only to jurisdictions or entities that ensure adequate protection of personal data, in compliance with DPDPA Section 16 and any rules notified by the Central Government. GSTIN, PAN, and tax filing data are never transferred outside India.

13. Grievance Redressal

If you have any grievance regarding the processing of your personal data, you may:

1. Contact the Data Protection Officer: Email kishorer747@gmail.com. We will acknowledge your grievance within 48 hours and resolve it within 30 days.
2. Escalate to the Data Protection Board of India: If your grievance is not resolved to your satisfaction within 30 days, you have the right to file a complaint with the Data Protection Board of India as established under DPDPA Section 18.

14. Children's Privacy

UdyamPilot is not intended for use by individuals under the age of 18. We do not knowingly collect personal data from children. If we become aware that we have collected personal data from a child without verifiable parental consent, we will take steps to delete such information promptly in accordance with DPDPA Section 9.

15. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any material changes by posting the updated policy on this page with a revised "Last updated" date and, where required, by obtaining fresh consent. Your continued use of the Service after any changes constitutes your acceptance of the updated policy.

16. Contact Information

If you have any questions about this Privacy Policy or wish to exercise your data protection rights, please contact us at: