Privacy notice (India)

Who is responsible

IntegralChase is operated by Kyrova Holdings LLC, United States.

Firm account data (the name, email and team details of people at a firm): IntegralChase decides how it is used, as described here.

Clients' data and documents (details the firm enters and documents its clients upload): the firm decides what to collect and why, and is responsible for it as the Data Fiduciary. IntegralChase processes it only on the firm's behalf, to provide the service, as a Data Processor. If you uploaded documents for your CA, please contact them first; we will also help if you write to us.

What personal data we handle

• Firm users: name, firm name, email address and role; if you use Google sign-in, the name and email Google shares.
• Clients, as entered by the firm: name, contact person, email, mobile number, PAN, GSTIN, TAN, date of birth or incorporation, client type and notes.
• Documents: files clients upload (for example Form 16, AIS, bank statements, investment proofs) and notices the firm uploads, with any notes or answers.
• Bank statement entries: if a firm imports a client's bank statement into their record, the transactions we read from it (the file itself is deleted after import).
• Payment records: for paid plans, which plan a firm is on and whether it has paid. Payments are made by UPI or bank transfer.
• Results of automatic checks: what our checks read from a file, such as the statement period, last four digits of an account number, PAN, assessment year, balances, or a notice's section, DIN and reply-by date.
• Email records: which emails we sent, to whom, when, and whether they were delivered.
• Technical data: a sign-in cookie, a cookie remembering whether you chose our India or US site, standard server logs kept by our hosting providers (such as IP addresses), and privacy-friendly page statistics without cookies (private upload links are not included in our page statistics). The Product Hunt badge in our footer is an image loaded from Product Hunt's servers, which receive your IP address when it loads.

Passwords for PDF files

Many documents in India are password-protected. To open them, we try common patterns built from the client's details (such as PAN and date of birth), or use a password the client or firm types. The password is used to open that file and is not saved in our database or alongside the file. We keep an unlocked copy of the file for the firm, stored privately like the firm's other documents.

Why we use it

• To provide IntegralChase: store documents, check them, show what's missing, and track notices.
• To send emails the firm asks for: requests and reminders to clients, and notifications to the firm.
• To keep the service secure, prevent misuse and fix problems.
• To reply when you contact us, and to meet legal obligations.

We use firm users' data to provide the service they signed up for, and with their consent where the law requires it. Firms confirm they have a lawful basis (such as their clients' consent) for the client data they collect. We do not sell personal data, use it for advertising, or use documents to train AI. Automatic checks run on our own servers; documents are not sent to AI services.

Free bank statement converter

Our free converter at /tools/bank-statement-converter can be used without an account.

• The statement you upload is read in memory to produce your Excel or CSV file and is not saved by the converter. Statement passwords, and the details you type to open a locked PDF (such as name, date of birth, mobile number or PAN), are used for that conversion and are not saved by the converter.
• To apply free-use limits, we count conversions per visitor using a salted hash of the IP address (we don't store the IP address for this) or, if you're signed in, per firm account, plus a daily total of conversions.
• If you upload a client's statement, you are responsible for having the right to do so. Standard server logs kept by our hosting provider may include IP addresses.

Where data is stored, and who helps us

Data and files are stored in Mumbai, India, encrypted in transit and at rest. These providers process data for us only to provide their service:

• Supabase: database, sign-in and file storage
• Vercel: hosting the application
• Resend: sending emails
• Google: optional “Continue with Google” sign-in
• Discord: private internal alerts to our team, such as a new sign-up (name and email), a support message you send us, and the first time a firm's client uploads a document (which can include the client's business name), plus daily usage counts for the demo and free converter (no files or statement contents)

If you use “Send on WhatsApp”, your device opens WhatsApp with the message ready to send. We don't send WhatsApp messages ourselves, and WhatsApp's own terms apply once you send.

Some of these providers may process data outside India. We only use such transfers as the DPDP Act allows, and not to any country the Government of India restricts. We may disclose data if required by law.

How long we keep it

• For as long as the firm's account is active and needs it.
• Deleting a request, a notice or a client permanently deletes their files from storage and their records from our database.
• A firm can delete its whole account and all data at any time in Settings → Delete account, or by emailing support@integralchase.tech; the button takes effect immediately, and an emailed request is done within 30 days. A person leaving a team removes only themselves; the firm keeps its data until its last member deletes the account. We then remove the data from our active systems, except what we must keep by law. Copies of database records may remain in our database provider's backups for a limited time for up to 30 days after deletion, then they are overwritten.

Security

Encryption in transit and at rest, private file storage, a secret link per request that the firm can replace, and strict separation between firms. If a personal data breach occurs, we will take appropriate steps to investigate and contain it, notify the relevant firms without undue delay and within 72 hours of confirming it, say what happened, what data was involved and what we are doing about it, and notify the Data Protection Board of India, CERT-In and affected individuals as the law requires. The DPDP Rules require the Board to be told without delay and given a detailed report within 72 hours; CERT-In expects certain cyber incidents to be reported within 6 hours, and we keep system logs for 180 days. See our Security page.

Your rights

The DPDP Rules, 2025 were notified in November 2025 and are being brought into force in phases, with most obligations on notices, rights and breach reporting due to apply from about May 2027. We already follow the commitments in this notice, and will update it as provisions commence.

Under the DPDP Act you can:

• ask for a summary of your personal data we process and who we've shared it with;
• ask us to correct, complete, update or erase it;
• withdraw consent, as easily as you gave it, by emailing support@integralchase.tech or deleting your account in Settings (this stops future processing but doesn't undo processing already done, and may mean closing the account);
• nominate someone to exercise these rights if you die or become unable to; and
• have a grievance addressed.

Clients of a firm should usually contact the firm first, as it decides what to collect. Email support@integralchase.tech for any request; we aim to reply within 30 days. We may need to confirm your identity first, and erasure can be limited where the law requires us to keep a record.

Grievance officer

Sai Srinivas Pedhapolla, founder, Kyrova Holdings LLC (IntegralChase), United States · support@integralchase.tech. If you're not satisfied with our response, you may complain to the Data Protection Board of India.

Children

IntegralChase is a business tool for firms and isn't meant for anyone under 18. Where a firm uploads documents about a minor, the firm and IntegralChase each meet the obligations that apply to their own role, including any parental consent the firm needs to obtain.

Changes

If we make significant changes, we'll update the date above and email firm account holders first.