Privacy Policy

Altx Convergence Private Limited (“Altx”, “we”, “us”, “our”) operates Notifyce, an AI-powered tax-notice and compliance dashboard. This Privacy Policy explains what personal data we collect when you visit our website or use Notifyce, why we process it, who we share it with, how long we retain it, and the rights you have as a Data Principal under the Digital Personal Data Protection Act, 2023 (“DPDPA”).

By using our website or Notifyce, you acknowledge that you have read and understood this Privacy Policy. If you do not agree with any part, please do not use the website or Notifyce.

1. Who Is the Data Fiduciary

2. Two-Tier Processing — Please Read

3. Personal Data We Collect

We collect and process the categories of personal data described below. Tier 1 = CA Firm subscribers and named users (direct Data Principals). Tier 2 = end-clients of the CA Firm (secondary Data Principals, processed on CA Firm instructions).

4. How We Use Your Personal Data

We use your personal data for the following specific, clearly described purposes:

• CA Firm account registration & authentication — creating and managing the CA Firm account; user provisioning; secure login; password recovery.
• Government-portal automation — logging into GST / Income Tax / TDS portals on behalf of CA Firm clients using the credentials the CA Firm provides; retrieving notices; downloading attachments; submitting responses.
• Notice management & workflow — storing notices and supporting documents; assigning to firm users; tracking deadlines and review dates; reminders; daily digest.
• AI-powered notice analysis & response drafting — generating notice summaries, suggested responses, Q&A pairs, case-law citations — using a configurable AI provider (Anthropic Claude as primary; OpenAI or Google Gemini as alternates).
• Tax-API integration — calling third-party tax APIs (e.g., TaxPro GST) for filing-status checks and return-data retrieval.
• Subscription & billing — processing payments, invoicing, GST handling.
• Customer support, training, grievance redress — responding to CA Firm support queries; onboarding and training; grievance redress under Section 13 DPDPA.
• Service improvement & analytics — understanding feature usage to improve the product. Aggregated and de-identified data only — never end-client data.
• Security, fraud prevention & abuse detection — detecting credential compromise, abnormal portal-access patterns, abuse, ToS enforcement.
• Legal & regulatory compliance — complying with applicable laws (DPDPA 2023, IT Act 2000 and SPDI Rules 2011, CERT-In Apr-2022 directions, court orders, lawful regulator requests).

5. Legal Basis for Processing

We process personal data on the following legal bases under the DPDPA 2023:

6. Who We Share Your Data With

We share your personal data only with the categories of recipients listed below, and only for the purposes set out. Every recipient operates under a Data Processing Agreement with us. A current list of sub-processors is published at /sub-processors.html; we will update that list whenever we engage a new sub-processor.

• Amazon Web Services (AWS), region ap-south-1 (Mumbai) — cloud hosting for compute, databases, object storage, transactional email (SES), and secrets management.
• Government portals (Income Tax, GST, TDS) — automated retrieval of notices and submission of responses on the CA Firm’s behalf.
• TaxPro GST API — filing-status checks and GSTR-data retrieval via API.
• Anthropic (Claude API) — primary AI provider for notice analysis and response drafting.
• OpenAI and Google Gemini — alternate AI providers per workload configuration.
• Google Workspace — corporate email, calendar, Drive for support communications and corporate documents (not product data).
• Payment gateway for Notifyce subscriptions (Razorpay or other; confirmed at sign-up).
• Legal / regulatory authorities — on lawful request (court orders, statutory requests, regulator inquiries).

7. Cross-Border Transfers

As of the effective date of this Policy, all primary processing of personal data and end-client tax records is hosted in AWS region ap-south-1 (Mumbai, India). AI providers (Anthropic, OpenAI, Google) and Google Workspace process limited data outside India under their own Data Processing Agreements. We monitor restricted-country notifications issued by the Data Protection Board of India under Section 16 of the DPDPA, and we will update this Policy on any change of region or sub-processor.

8. How Long We Keep Your Personal Data

9. Your Rights as a Data Principal

Under the DPDPA 2023 you have the rights below. We acknowledge every request within 48 hours and respond substantively within 30 days of receiving a complete request, in line with our published Service Level Agreement.

• Right to access a summary of your personal data — Section 11.
• Right to correction and erasure — Section 12 (subject to legal-hold exceptions).
• Right to grievance redressal — Section 13.
• Right to nominate another individual to exercise your rights in the event of incapacity or death — Section 14.
• Right to withdraw consent at any time, prospectively — Section 6(4).

To exercise any of these rights, please use our Data Rights Request form or write to dpo@altx.one. If you are not satisfied with our response, you may approach the Data Protection Board of India under Section 13: https://dpboard.gov.in (portal to be enabled by the Board).

10. Cookies

We use cookies and similar technologies on this website. Detailed information about the cookies we use, the categories, and how to manage your preferences is in our Cookie Policy. We provide a granular consent banner on your first visit and at any time you may revisit your choices.

11. Children’s Data

Notifyce is a B2B product for licensed Chartered Accountants and tax professionals and is not directed at, or intended for, individuals under 18 years of age. We do not knowingly process children’s personal data. Where a CA Firm uses Notifyce to handle a tax matter that could touch a minor’s data (for example, a HUF return where a minor is a coparcener), the CA Firm is the Data Fiduciary and is responsible for obtaining any required verifiable parental consent.

12. How We Protect Your Personal Data

• Encryption in transit (TLS 1.2 or higher) and at rest (AES-256 via AWS KMS).
• Role-based access control with the principle of least privilege; multi-factor authentication on all administrative access.
• Security monitoring via AWS GuardDuty and centralised log aggregation; CERT-In-aligned 180-day minimum log retention (we apply a 1-year floor for forensic margin).
• Government-portal credentials encrypted with customer-managed keys; access strictly mediated by our automation service and fully audit-logged.
• Annual security and DPDPA training for every employee and contractor.
• Incident response capability with documented breach-notification procedures (CERT-In within 6 hours of detection; DPBI within 72 hours under Rule 7).

13. Changes to this Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, our technology, our service offering, or applicable law. When we make a material change, we will notify you via email or via an in-product banner. The “Last Updated” date at the top of this Policy will be revised. For significant changes that introduce a new purpose, a new sensitive data category, a new cross-border transfer, or a new sub-processor handling sensitive data, we will obtain fresh consent before the change takes effect.

14. Contact Us