Privacy

01Who we are

fynxIQ is a startup, founded in March 2026 by Raunak Pathak. We are at 205/4, Near Railway Station, Chandigarh - 160101, India, and you can write to us at official@fynxiq.com.

02What we never receive

Marketplace reports, sales and purchase registers and your GSTR-2B are read in your browser. Their invoice lines, buyer names, delivery states, pincodes, order references and product identifiers are processed on your own device and are not transmitted to us. Settlement reports, bank statements, Form 26AS and a GST notice’s PDF are read in your browser too; the few figures kept from the first three are listed below. This is a property of how the software is built, not a promise about how we behave. The exceptions are the ones you choose, and each is set out below: a photographed or PDF bill you ask to have read, a month a client sends a firm through an upload link, an amendment you type on a return or a figure you set on its Checks step, and, once portal access is offered and you switch it on for a registration, what is read from the GST portal for it, which passes through our server to your browser and is not kept.

03What we hold

• Your email address, a bcrypt hash of your password, and your name.
• Your business name, your plan, and when it ends (nothing renews by itself).
• The GSTINs you prepare returns for.
• For each return prepared: the period, the taxable and tax totals, how many blockers and warnings there were, how many ledger lines it covered, and which sources produced it.
• Marketplace operator registrations and column mappings you choose to save.
• Product codes you save: a product or article type as you named it, and the HSN code you gave it, so you are not asked for it again.
• Tally ledger names you type for a client, so the next export posts to the same ledgers. A ledger for a registered buyer is kept against that buyer’s GSTIN. And, for each Tally vouchers file you download, the list of vouchers it carried: the voucher’s id, number, date and voucher type, kept per client and period so a later file can remove from Tally what the month no longer has. No amount and no party is stored with it.
• Amendments you type on a return (Tables 9A, 9C and 10 of GSTR-1), and figures you set on its Checks step, kept with the client and the month so they are there when the return is opened again. An amendment carries what the correction needs: for an invoice or a note to a registered buyer, that buyer’s GSTIN, the document number and its figures; for the others, the document number or the month, the state and the figures. A figure you set by pressing a check’s button carries the check, the file’s name and row or the document number it applies to, and the figure before and after. They are kept because you typed or chose them here, not because they came from a marketplace file, which never reaches us. Removing one on the return, or Undo on the Checks step, removes it here.
• Bills you mark as credit blocked under section 17(5) on the ITC desk, kept with the client and the month so the Tally files and the GSTR-3B draft find them again: the supplier’s GSTIN, the kind of document and the bill’s number, who marked it and when. No amount is kept with a mark; the figures are read from your files, in your browser, each time. Taking the mark off removes it here.
• Purchase bills you confirm from a photograph or a PDF on the Purchases page, kept with the client and the month so the Purchases page and the GSTR-3B draft read the same bills: what you confirmed of each (the supplier’s name and GSTIN, your GSTIN as the bill gives it, the number, the date, the lines, the tax and the total), who kept it and when. The picture itself is never kept. Removing a bill removes it here.
• Bank statements turned into Tally vouchers. The statement is read in your browser and never reaches us. A PDF is read from its text, and one locked with a password is not opened. Two things from it do. The rules you make for a client: the party a narration names, as fynxIQ reads it (a UPI address, the name in a transfer, or the narration’s words without numbers), and the ledger and group you placed it in, who made or changed it and when; each rule made, changed or taken away is in the activity log. And while an entry waits in Suspense we keep its date, amount and narration; cleared, the narration is deleted. Cleared means placed and sent to Tally again, or marked as placed in Tally. For each account we also keep its last four digits and the day and closing balance the last vouchers file ran to, so the next statement can be held against it.
• Suppliers you follow up for input tax credit. The GSTR-2B and your purchase register are read in your browser and never reach us. When you copy or open a follow-up for a supplier, we keep the bills it names (the supplier’s GSTIN, the bill’s number and date, its tax and the credit at stake), who followed up and when, and how (copied or opened, email or WhatsApp); not the message. The supplier’s email and phone number, if you type them, are kept with that client, encrypted, until you remove them. fynxIQ sends nothing to a supplier: the message goes from your own mail or WhatsApp. A bill leaves the waiting list when a later GSTR-2B carries it or you mark it settled.
• Your annual return. The year’s filed GSTR-1s, GSTR-3Bs, GSTR-2Bs and the portal’s own GSTR-9 and Table 8A downloads are read in your browser and never reach us. When you save the year’s working, or download its JSON or Excel, we keep each table’s totals and where each came from, the differences found (their titles and amounts), the figures you typed for GSTR-9 (Tables 15, 16 and 18 among them: refunds and demands, supplies from composition dealers, deemed supplies and goods sent on approval and not returned, and your inward supplies by HSN) and GSTR-9C (including any reasons you wrote), who saved it and when, and the ARN and day once you mark it filed; no invoice, supplier or document.
• Your marketplace settlements. Amazon’s, Flipkart’s, Meesho’s and Myntra’s settlement reports, the sales reports and bank statements you drop with them, the portal’s TCS statement and Form 26AS are read in your browser and never reach us; of Form 26AS nothing but each marketplace’s monthly TDS figure leaves it, never your PAN, name, address or another deductor, and no deductor’s TAN. When you keep the months, we keep each marketplace’s month of payouts as totals (sales, offers, fees and the GST on them, TCS, TDS, what was paid), the findings (their titles and amounts), the Form 26AS figure you typed or the one read from the file, and who kept it and when; no order, settlement line or bank entry. A rate card you type for a marketplace (shares of the price and charges per order) is kept with the client until you take it away.
• GST notices you keep on the register. A notice is typed in by hand, and the notice’s PDF is never sent to us or kept. For each notice we keep the fields you type: its form, reference, the date on it and the day it reached you, the reply date (worked out from its form, or the one you type), its standing, who in the firm handles it, the day and ARN of the reply, and for an appeal the notice it was taken from. Your notes and the text of the reply are kept encrypted, each under a key of its own, and are opened only for the people who can see that client. The activity log names the notice’s form and the client only, never its reference, dates, notes or reply. The owner or a manager can remove a notice. A notice is purged with its client, and it is in the export.
• Portal access and assistants you connect, if you use them: what each keeps, and for how long, is set out in its own clause below.
• Messages you send through the contact form.
• Buyer names and their GSTINs, when you confirm a photographed invoice. These are kept so that next month’s invoice to the same customer can be checked against the registration you used last month, which is the only check available on a photographed invoice that the invoice itself cannot provide. They are stored whether or not the document archive below is switched on.
• A month sent through an upload link. When a firm sends its client a link and the client sends a month back, the prepared return (the JSON the portal takes), its totals, the checks as they ran on the client’s device, the client’s note, and each file’s name, size and fingerprint are kept for the firm. The files themselves are read on the client’s device and never sent. The address the month was sent from is kept with it, as a security record.
• The manifest of each Month Pack you build. The zip itself is made in your browser and saved by you; we keep only its manifest: the name, size and SHA-256 fingerprint of every file in it and of every file the month was built from, what it left out and why, when it was built and by whom. No figure or line of a return is in it; a file’s name is kept as you named it. It is kept so the pack can be listed on any device and a zip found later checked against it.
• Your conversations in the Ask box, and any support ticket or feedback you send. We read these to answer them.
• Your IP address and browser identification, against sign-ins, sign-in failures, refused requests, administrative access, and each change made to a client, to the team or to the business’s settings. Kept as a security record, so that an attack on your account is something we can see rather than guess at.
• Payment records: which plan, which cycle, the amount, and the provider’s reference. Card details never reach us: they are entered in Razorpay’s own window and we never see them.

What is kept encrypted (a supplier’s email and phone, a notice’s notes and reply, your two-factor secret, and portal access’s username, token and key) is sealed with a key of its own under a master key used for nothing else. When that key is changed, each value is sealed again under the new one. A contact or a notice still sealed under a key we no longer hold is never written over: until the key is put back it can be removed, not changed.

04The document archive

Off unless the owner of your business turns it on. While it is on, the invoice-level detail behind each prepared return (invoice numbers, dates, buyer names, amounts and the checksum of the file it came from) is kept as evidence of what was filed. Apart from a month a client sends through an upload link, which a firm asked for and which carries registered buyers’ invoices the way the portal’s JSON does, and the amendments you type on a return and the figures you set on its Checks step, each of which you entered or chose yourself, this is where invoice-level detail is stored, which is why it is a switch and not a default.

05Portal access

Not offered yet. It needs a GST Suvidha Provider, the route GSTN licenses for software, and none is connected today, so nothing of yours goes to the GST portal from us: you upload the JSON and file there yourself. What follows is how it works once it is offered. It is off by default, and off unless you switch it on for one registration at a time. With it, fynxIQ reads that registration’s return status, its filed GSTR-1 and its GSTR-2B from the portal through the GST Suvidha Provider. It reads only; it does not save, submit or file a return.

To switch it on, the taxpayer first allows API access on the portal (View Profile, Manage API Access) and picks how long it lasts. The portal then sends an OTP to the taxpayer’s own registered phone and email, and it is typed here once. The OTP is used for that one request and is not stored, not even in a log. We never ask for, hold or use the portal password. Two-factor sign-in must be on to use it.

• While access is on we keep the session token and the session key the portal issues, each encrypted under a key of its own, until access ends. The token lives about six hours and is renewed only inside the period the taxpayer chose.
• A consent record: which registration and the portal username it was given for (the username encrypted), who switched it on and when, until when, and who revoked it and when.
• A log of each call: who made it, for which registration, which kind of read, when, the portal’s reference for it, whether it worked, how long it took, and a SHA-256 fingerprint of what came back. Never what came back, and never the OTP, token or key.

What is read passes through our server to your browser and is not kept; the screens use it as they use a file you download from the portal. Revoke from the same panel at any time, or turn off API access on the portal: the session is deleted at once. Deleting the client or the organisation ends it too. The consent records and the call log are kept for at least 180 days, as the CERT-In directions of April 2022 require of such logs; for an organisation that deletes itself they stay until they are 180 days old and are then deleted. A session is never restored from a backup.

Two things the GST system lets software do and fynxIQ does not do yet. Filing: once a return can be sent to the portal from here, it will go only when you press the button for that return, through our server, encrypted, for the minutes the filing takes, and nothing of it will be kept beyond the record of the filing. E-invoice and e-way bill: if fynxIQ comes to take a client’s API username and password for these, they will be kept only encrypted, for that client, and the client can remove them at any time.

06Connected assistants

Off unless you connect one. You can connect an AI assistant such as Claude or ChatGPT to your fynxIQ login, from the assistant’s own settings, and approve it on a fynxIQ page that names the assistant, the firm and what it may do, signed in to fynxIQ itself, so the assistant never sees your fynxIQ password. It can then read, for the clients you can see, each one’s name and GSTIN and where it stands: returns filed or not and their ARNs, how many checks blocked a month, how a filed GSTR-1 differed from the one built, how many bank entries wait in Suspense, open notices and their reply dates, due dates and settlement warnings. If you tick them, it can also mark a period filed, make an upload link, or send the due-date reminder. It never sees a file, a supplier’s email or phone, a bank entry’s narration, or a notice’s reference, notes or reply. No file can be sent to fynxIQ through it, and fynxIQ never files a return through it. What it reads goes to the company that runs the assistant (Anthropic for Claude, OpenAI for ChatGPT) under your own account with them; their terms, not ours, apply to it there, including whether it is kept or used to train models.

• A connection record: whose, in which firm, which assistant, what it may do, when it was made, when it was last used and for what, and when and why it ended.
• Its tokens, kept only as a keyed fingerprint that cannot be turned back into the token: an access token lasts an hour, a refresh token thirty days and is replaced each time it is used.
• A log of each call: which connection, person and client, which tool, whether it worked or why it was refused, and how long it took. Never what was asked in words, and never what was answered.

It needs two-factor sign-in on. Revoke a connection in Settings at any time, and its tokens stop at once; the owner can revoke any in the firm. Changing your password or leaving the firm ends yours. Each connection made or ended, each call refused, and each change made through one is in the activity log. The call log is kept for 180 days and then deleted. A connection’s record is deleted 180 days after it ends, and goes with the organisation when it is purged.

07What is sent to our AI providers

Four cases, each to an AI provider, and they are different from one another. A fifth kind of report comes only to us, and is listed after them. Beyond these, email is sent through Resend, which receives the address and the message (a password reset, an invitation, a sign-in alert, a reminder of returns due and GST notices to answer, naming each client, its GSTIN, the form and the date, with how many bank entries wait in Suspense and how many chased bills are still missing from a GSTR-2B, or a notice to the owner five days before a paid period ends), and payments go through Razorpay, below. If you connect an assistant to fynxIQ, what its tools return goes to the company that runs it (Connected assistants, above).

Who the AI providers are. Each of the four goes first to Anthropic’s Claude API, and to Google’s Gemini API only when Claude cannot answer it (an error, a delay, or a page Claude does not read); the same request, never more of it. Anthropic processes and stores what it is sent in the United States, outside India. Under its commercial terms it may not train its models on it, and it deletes it within 30 days, unless it must keep it longer to enforce its usage policy or to comply with the law. Google’s paid tier, the one fynxIQ uses, is described under the bill below. Neither is told who you are beyond what the request itself contains.

1. The second opinion on a return. When you explicitly ask for one, a summary is sent to the AI provider. That summary contains derived totals, HSN codes, your own product titles and the findings our rules produced. It contains no GSTIN, no buyer name, no address, no pincode and no order reference, and the server rebuilds the payload from a fixed list of permitted fields before it goes, so anything else is discarded rather than merely checked for. The application shows you the exact content before sending and sends nothing unless you agree, per return.
2. Reading a photographed or PDF bill. A sales invoice from your bill book or a purchase bill from a supplier, as a photograph or a PDF: the page itself is sent, in full, through our server to the AI provider. It is a picture of a document, so everything on that document goes with it, including the buyer’s or the supplier’s name, address and GSTIN. This is the one case where a customer’s name and address go beyond us, which is why you are asked to agree to it once, in writing, before it ever happens, and why the agreement can be withdrawn in Settings at any time.
   
   On the paid tier of Google’s API, which is the one fynxIQ uses, Google processes the image for the length of the request and does not retain it or use it to train models. We say that plainly because the opposite is true of the same API’s free tier, and the difference is a billing setting rather than anything visible in the software. We keep no copy at either end: the image is held in memory for one request and is written neither to disk nor to our database.
3. Reading an unfamiliar spreadsheet. A description of the file’s structure (its column headings and a few sample values) is sent so the columns can be identified. The rows themselves are not.
4. A question to the assistant. What you type in the Ask box, the recent messages of that conversation, and, when you ask from a prepared return, the same summary the second opinion is built from and the checks as they read on your screen, with anything shaped like a GSTIN, a PAN or an email address blanked first. No file and no invoice row.

Only to us: the shape of a file we could not read. When fynxIQ fails to understand a spreadsheet, it reports the file’s extension, its sheet name, its column headings and a rounded row count to our own database, so the format can be fixed. Not the rows, not a cell value, and not the file name; and nothing identifying you or your business: the table this is kept in has no column for an account, so it cannot say whose file it was even to us. Column headings are additionally stripped of anything resembling a GSTIN, PAN, email address, telephone number or long number before they are stored, because a workbook with no heading row is exactly the sort that fails to parse. Kept ninety days.

08Why we hold it

To run your account, enforce the limits of the plan you chose, and give you a record of what you prepared. We do not sell data, we do not share it with advertisers, and we do not use your returns to train anything. An assistant you connect reads only what you allowed it, and only because you connected it.

09How long

For as long as your account exists. A client you delete is hidden at once and purged seven days later; a deleted organisation is purged after the same seven days, with its clients, prepared-return summaries, evidence rows, activity trail and any login that belonged only to it. Until the purge the owner can restore either from inside the product. Payment records are kept regardless, because we are required to keep them. Portal access records are kept for at least 180 days (Portal access, above); the log of calls made through a connected assistant is kept for 180 days (Connected assistants, above). The database is copied nightly, encrypted, to a second provider; each copy is kept 35 days, so a purged record can persist in a backup for up to 35 days after the purge and is then gone from there too.

10For practices

A practice holds its clients’ registrations and the summaries of their returns with us, and its staff see only the clients assigned to them, which is enforced in the database reads. The owner is asked to turn on two-factor sign-in before the firm board opens. Every change a member makes to a client, to the team or to the practice’s settings is written to the practice’s own activity trail, with who made it, when, and the address it came from: adding, editing, archiving, deleting and restoring a client, assigning it, preparing its return and marking it filed, amendments typed on a return, upload links, invitations and roles, each setting, an assistant connected or its connection ended, and a call refused through one; a change made through an assistant names the assistant too. An entry names the client by its name and GSTIN and a colleague by email and role. It never records an amount, the text of a note, a buyer’s name, or anything from the rows of a file. The owner and managers can read the trail; a staff member cannot, because it names every client of the practice. The practice can take everything it holds with us out as one zip from Settings at any time, and can delete the organisation itself, with the seven days above to change its mind.

11Your rights

You can take a copy of what we hold (Settings, Export, for the owner), correct it (every field is editable from the product), or delete it (a client from its row, the organisation from Settings). For anything the product does not yet let you do yourself, write to official@fynxiq.com and we will act within thirty days, by hand. Payment records are kept regardless of a deletion request, because we are required to keep them.

12Cookies

Three, all our own, all http-only and same-site. One for your session, which expires after thirty days. One that holds a sign-in for five minutes between your password and your two-factor code. And one that remembers which client you last opened, for a year. There is no advertising or analytics cookie on this site.

When the connection drops while you are preparing a month, what the app would have sent at that moment waits in your browser’s own storage instead: a return’s record, a Month Pack’s manifest, what a Tally file carried, an amendment or a Tally ledger name you typed, a figure you set on the Checks step, the section 17(5) mark on a bill, a purchase bill you confirmed from a photograph, or a bank rule you made or what a bank vouchers file carried. It is the same thing that would have reached us then, and nothing more. It stays on that device, is sent when the connection returns, and is removed from the browser once we have it. Signing out leaves anything still waiting in that browser: it belongs to the person who was signed in, and is sent only when that person signs in there again. Clearing this site’s data in your browser before then removes it unsent.

13Payments

Card details are handled by our payment provider and never reach our servers. We store the plan you bought, the amount, and the provider’s reference for it.