Privacy Policy

SmartLedger AI is an accounting, bookkeeping and tax compliance platform for Indian businesses and CA firms. It covers invoicing, purchases, expenses, bank reconciliation, inventory, journals, GST, e-invoicing, e-way bills, TDS/TCS and related filings.

In this policy, “SmartLedger AI”, “we” and “us” refer to SmartLedger AI. This policy applies to our website, web app, mobile apps, client document portal and APIs (together, the “Services”).

If you are a customer, vendor or employee of one of our users and want to exercise your rights over your data held in their books, please contact that business first. We will help them respond.

3.1 Data you give us

• Account and identity: name, email, mobile number, password (stored only as a salted hash), role, and organisation details.
• Business identifiers: PAN, TAN, GSTIN, CIN/LLPIN, registered address, authorised signatory details.
• Financial and bookkeeping data: sales and purchase invoices, credit and debit notes, receipts, payments, expenses, journals, chart of accounts, opening balances, inventory, bank statements, GST and TDS returns, financial statements.
• Third-party personal data in your books: names, contact details, PAN, GSTIN, bank account details and addresses of your customers and vendors; employee names, PAN, salary and reimbursement data imported from payroll tools.
• Documents and uploads: PDFs, images, scans and spreadsheets you upload or send to us by email, WhatsApp or the client portal.
• Billing: plan, invoices and payment status. Card and UPI details are handled by our payment gateway; we do not store full card numbers.
• Support: messages, call notes and screen recordings you share with our team.

3.2 Data collected automatically

• Device, browser and operating system details, IP address, approximate location derived from IP.
• Log data: logins, pages and features used, timestamps, errors, and the audit trail of changes to books.
• Cookies and similar technologies (see section 14).

3.3 Data from third parties you connect

• Government portals (GSTN, IRP, e-way bill, TRACES) through licensed GSP/ASP partners.
• Banks and account aggregators, payroll systems (for example greytHR), accounting software (for example Zoho Books, Tally and others) for importing and syncing data, cloud drives and email, only when you connect them.

We do not sell personal data. We do not use your business records for advertising.

SmartLedger AI uses large language models and vision/OCR models from multiple providers to read documents, extract invoice and bank data, suggest ledgers and GST treatment, run SmartAuditor checks and answer your questions. We route each task to the model best suited to it.

Our commitments

• No training on your data. We use these providers only through their commercial/enterprise APIs, under terms that prohibit using your inputs or outputs to train their models. We do not use your business records to train any model of our own without your separate, explicit consent.
• Minimum necessary data. We send only the content needed for the task (for example, one document or a set of transactions), not your whole ledger. Where practical, we mask identifiers such as PAN and bank account numbers before sending.
• Limited retention by providers. Providers may keep inputs and outputs temporarily (generally up to 30 days) only for abuse monitoring, as permitted by their API terms, and delete them afterwards. Where zero data retention is available to us, we use it.
• Processed outside India. These providers may process data in the United States or other countries. See section 8.
• You stay in control.AI output is a suggestion. Nothing is posted to your books or filed with a government portal without your review, unless you have turned on “Auto” mode for that task. Every AI action is recorded in the audit trail.
• Opting out. An admin can turn off AI features for the organisation in Settings. Core bookkeeping and filing continue to work, but automatic extraction and suggestions will not.

• GST, e-invoice, e-way bill and TDS actions happen through licensed GSP/ASP partners using the API access and OTP-based authorisation that you approve.
• We do not store your GST portal or income tax portal passwords. Session tokens are encrypted and expire as set by the portal.
• We file or fetch data only when you or an authorised user starts the action, or under a schedule you have set.

We share personal data only with the following, and only as needed:

Every processor is bound by a written contract that requires confidentiality, security safeguards, breach reporting and deletion when the work is done. A current list of sub-processors is available on request.

• Our application and primary database are hosted in Singapore. Singapore is not on any list of countries restricted by the Government of India under section 16 of the DPDP Act.
• In line with Rule 3 of the Companies (Accounts) Rules, 2014, a backup of the books of account kept in electronic form is taken daily and stored on servers physically located in India.
• Some processing, mainly AI model calls (section 5) and certain email and monitoring tools, also happens outside India, including in the United States. Such transfers are permitted under section 16 of the DPDP Act, and we will not transfer data to any country the Government of India restricts.

Indian tax and company law requires businesses to keep their accounts for many years. Because SmartLedger AI is where you keep those accounts, we retain them for the statutory period even if you stop using the Services, unless you export and delete them yourself after that period.

The legal duty to preserve books of account rests with you, the business. The periods above are how long SmartLedger AI keeps your books for you while they are on our platform, so you can meet that duty.

When you close your account

Before closing, you can export your complete books, reports, documents and audit trail. You then choose one of two options:

Only an account owner or admin can choose option B, and we confirm it by email and OTP before deleting anything.

We keep what the law requires us to keep about our own relationship with you, even after option B: our subscription invoices to you, payment records, and a record that you requested and confirmed deletion. Copies already filed with government portals (GSTN, IRP, TRACES) are held by those authorities and are outside our control.

Inactive accounts. If an account is inactive for the period set in the DPDP Rules, we will notify you at least 48 hours before erasing any data we are not required by law to keep, so you can log in or export it.

• Encryption in transit (TLS 1.2+) and at rest (AES-256).
• Role-based access in the app, with maker-checker controls for sensitive actions and an audit trail that cannot be switched off.
• Strict internal access on a need-to-know basis, multi-factor authentication for staff, and logging of all admin access.
• Masking of sensitive identifiers such as PAN and bank account numbers in the interface and in AI inputs where practical.
• Daily backups on servers in India, tested restores, and a documented business continuity plan.
• SmartLedger AI is ISO/IEC 27001 certified for information security management, with regular vulnerability assessments and penetration tests.
• Written security and confidentiality obligations for every employee and processor.

• We will tell affected users without delay, in plain language: what happened, the likely impact, what we are doing, and what you can do.
• We will inform the Data Protection Board of India without delay and send a detailed report within 72 hours, as required by Rule 7 of the DPDP Rules.
• We will report cyber security incidents to CERT-In within 6 hours as required by the CERT-In Directions, 2022.
• Where a breach affects data in your books, we will give you the details you need to meet your own obligations to the people concerned.

Under the DPDP Act you have the right to:

• Access: get a summary of your personal data we process, what we do with it, and who we have shared it with (s.11).
• Correction and completion: fix inaccurate or incomplete data. Most details can be edited directly in Settings (s.12).
• Erasure: ask us to delete data we no longer need, subject to the statutory retention in section 9 (s.12).
• Grievance redressal: raise a complaint with our Grievance Department and, if unresolved, with the Data Protection Board of India (s.13).
• Nomination: nominate someone to exercise your rights if you die or become incapable (s.14).
• Data export: download your books, reports and documents in standard formats (Excel, CSV, PDF, JSON) at any time.

Send requests to privacy@smartledger.ai or use Settings > Privacy. We will verify your identity and respond within 30 days at most, and sooner where we can.

• At sign-up we show you a short, separate consent notice listing the data we collect and why. Marketing consent is a separate, unticked option.
• You can withdraw consent as easily as you gave it, in Settings > Privacy or by email. Withdrawal does not affect processing already done.
• If you withdraw consent needed to run the Services, we may not be able to keep your account active. Statutory retention in section 9 still applies.
• You may also manage consent through a registered Consent Manager under the DPDP Rules once available.

• Essential: login sessions, security and load balancing. Always on.
• Preferences: remembering your settings and filters.
• Analytics: understanding feature usage. Off unless you accept.
• Marketing: measuring campaigns on our website only. Off unless you accept. We never place marketing trackers inside the app.

You can change your choice at any time from the cookie settings link in the website footer.

SmartLedger AI is a business tool and is not meant for anyone under 18. We do not knowingly collect children’s data for our own purposes and do not track or target advertising at children. If children’s data appears in a customer’s books (for example, a minor employee or customer), the customer is responsible for obtaining verifiable parental consent where required.

If you are not satisfied with our response, you may complain to the Data Protection Board of India.

This policy is available in English. On request, we will provide it in any language listed in the Eighth Schedule to the Constitution of India.

We will post any update here with a new “Last updated” date. For material changes, such as a new purpose or a new category of AI provider, we will notify you by email and in the app at least 15 days before the change takes effect and, where required, ask for fresh consent.