Privacy Policy

1. Introduction

Corpfy ("we", "our", "the Platform") is committed to protecting your privacy and ensuring transparency in how we collect, use, store, and safeguard your personal and business information. This Privacy Policy applies to all users of our platform — founders, co-founders, directors, employees, and businesses registered or operating in India. We are compliant with the Digital Personal Data Protection Act, 2023 ("DPDP Act"), the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 ("SPDI Rules"), and the Information Technology Act, 2000.

2. Information We Collect

To deliver our services across company registration, compliance, payroll, and VC collaboration, we collect the following categories of information:

3. Legal Basis for Processing

We process your data on the following legal grounds under the DPDP Act, 2023 and applicable Indian law:

• Consent: For marketing communications, VC data room sharing, and optional features.
• Contract Performance: To deliver your subscribed services — company registration, GST filings, payroll processing, trademark applications.
• Legal Obligation: Compliance with MCA, GST Network, Income Tax Department, SEBI, and other Indian regulatory requirements.
• Legitimate Interests: Platform security, fraud detection, platform model improvement (using anonymized and aggregated data only), and service enhancement.

4. How We Use Your Information

• Execute company incorporation — Private Limited, LLP, OPC, Partnership — via MCA21 portal workflows.
• Prepare and assist in filing GST returns (GSTR-1, GSTR-3B, GSTR-9), TDS/TCS returns, and Income Tax returns.
• Process payroll, PF, ESI contributions, and generate Form 16 for employees (available on Operational and Growth plans).
• Manage trademark searches, TM applications with the IP India Registry, and IP portfolio tracking.
• Facilitate Startup India DPIIT recognition and related government benefit access (Growth plan).
• Enable VC data room creation and investor collaboration (with explicit consent).
• Send compliance calendar reminders — ROC filing deadlines, AGM notices, GST due dates, advance tax dates.
• Communicate service updates, security alerts, and (with consent) plan upgrade communications.
• Train and improve our platform compliance engine using anonymized, aggregated data only — never individual identifiable data.

5. Data Sharing & Disclosure

We do not sell your personal data. We share information only in the following circumstances:

• Government Regulators: MCA (Ministry of Corporate Affairs), GSTN, Income Tax Department, SEBI, Startup India / DPIIT, IP India Registry, Registrar of Trademarks, and applicable state labour authorities.
• Legal & Professional Advisors: Empanelled Chartered Accountants, Company Secretaries, and Advocates for compliance and representation.
• Technology & Payment Partners: Corpfy Banking & Treasury (payment processing), cloud hosting providers with data centres in India, HR & payroll processors — all bound by data processing agreements.
• Investors/VC Partners: Only with your prior explicit written consent and exclusively through our secure, access-controlled VC Data Room.
• Law Enforcement & Courts: When required by applicable Indian law, court order, or lawful government authority request.
• Business Transfers: In the event of merger, acquisition, or asset sale — subject to equivalent privacy protections and user notification.

6. Sensitive Personal Data or Information (SPDI)

In accordance with IT (SPDI) Rules, 2011, the following are treated with heightened protection:

• Financial information including bank account details, UPI handles, and payment card data.
• PAN and Aadhaar — collected only where mandated by MCA, GSTN, or applicable Indian law, with explicit consent.
• Employee payroll data including salary, PF UAN, and ESI details.
• Passwords and authentication credentials — stored using bcrypt hashing; never stored in plain text.

SPDI is collected only where strictly required to deliver contracted services and is never shared with third parties except as required by law.

7. Data Security

• TLS 1.3 encryption for all data in transit.
• AES-256 encryption for sensitive data at rest (PAN, Aadhaar references, payroll records).
• Primary data storage within India on servers located in Indian data centres.
• Role-based access controls — employees access only data necessary for their function.
• Multi-factor authentication (MFA) for all administrative and founder accounts.
• Regular security audits, penetration testing, and vulnerability assessments.
• ISO 27001 aligned information security management practices.

8. Data Breach Notification

• We will notify the Data Protection Board of India within the prescribed timeframe under the DPDP Act, 2023.
• Affected users will be notified promptly via their registered email with details of the breach, data affected, and remedial actions.
• We maintain an internal incident response procedure and will take immediate containment steps upon breach detection.

9. Data Retention

We retain data as long as necessary for:

• Active subscription and contractual service delivery.
• Statutory retention requirements — Companies Act mandates 8 years for statutory records; GST law requires 72 months; Income Tax Act requires 6 years for financial records.
• Dispute resolution, audit, and regulatory enquiry purposes.

Upon account deletion or subscription expiry (subject to legal holds), data is securely deleted or irreversibly anonymized within 90 days.

10. Your Rights as a Data Principal

Under the DPDP Act, 2023, you have the following rights:

• Right to Access: Request a summary of personal data we hold about you and how it is processed.
• Right to Correction & Erasure: Correct inaccurate data or request erasure, subject to statutory retention obligations.
• Right to Grievance Redressal: Contact our Grievance Officer (Section 14) for any privacy concern.
• Right to Nominate: Nominate another individual to exercise your rights in the event of your death or incapacity.
• Right to Withdraw Consent: Withdraw consent for non-essential processing at any time without affecting prior lawful processing.
• Right to Complain: Lodge complaints with the Data Protection Board of India once formally established.

To exercise any right, email legal@corpfy.in. We will respond within 30 days.

11. Cookie Policy

Corpfy uses cookies and similar technologies to deliver and improve our platform experience.

• Strictly Necessary: Session management, authentication, CSRF protection. Cannot be disabled.
• Performance & Analytics: Page views, feature usage, load times — anonymized and aggregated.
• Functional: Saved preferences, dashboard layout, language settings.
• Marketing: Promotional content targeting — only with explicit consent. Can be disabled via our cookie consent manager.

Manage cookie preferences through your browser settings or our in-platform consent manager. Contact support@corpfy.in for assistance.

12. Marketing & Opt-Out

With your consent, we may send promotional emails, compliance webinar invites, and product updates. Opt out anytime by:

• Clicking "Unsubscribe" in any marketing email.
• Updating notification preferences in your account settings.
• Emailing legal@corpfy.in with subject "Marketing Opt-Out".

Opting out does not affect transactional, compliance alert, or service notifications.

13. Data Localisation

In line with India's data sovereignty principles, all primary data storage and processing for Corpfy occurs within India on servers in Indian data centres. Where limited data processing occurs outside India (e.g., specific platform model inference), we ensure equivalent contractual protections and compliance with DPDP Act, 2023 cross-border transfer requirements, including obtaining consent where mandated.

14. Grievance Officer

In accordance with the IT Act, 2000, IT Rules, 2021, and the DPDP Act, 2023:

15. Children's Privacy

Corpfy is not intended for individuals under 18 years of age. We do not knowingly collect data from minors. If identified, such data will be deleted promptly.

16. Updates to This Policy

Material changes will be communicated via email or platform announcements with at least 15 days' prior notice. Continued use of the platform constitutes acceptance of the revised policy.