Privacy Policy

1. About this Policy

1.1 This Privacy Policy (the Policy) explains how Alcodes Mobility Private Limited (Alcodes, we, us or our) handles personal data when you use Auditer. Auditer includes the website at https://auditer.com, the web portal at https://app.auditer.com, the Auditer mobile apps for Android and iOS, and the Auditer Agent desktop app for Windows (together, the Service).

1.2 This Policy is our notice under the Digital Personal Data Protection Act, 2023 (the DPDP Act) and the Digital Personal Data Protection Rules, 2025 (the DPDP Rules). It is also our privacy policy under the Information Technology Act, 2000 and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011.

1.3 Personal data means data about an individual who can be identified by or from that data. The individual the data is about is the Data Principal.

1.4 You can read this Policy in English or in any language listed in the Eighth Schedule to the Constitution of India. On our website, you can choose English, Hindi, Marathi, Gujarati, Punjabi, Bengali, Tamil, Telugu, Kannada, Malayalam or Odia. For another Eighth Schedule language, write to [email protected]. If a translation differs from the English version, the English version governs.

2. Who we are

Item	Details
Data Fiduciary	Alcodes Mobility Private Limited
Product and brand	Auditer
CIN	U74999RJ2018PTC060109
Registered office	208, Kesar Nagar, Sanganer, Jaipur, Rajasthan 302029, India
Privacy questions and requests	[email protected]
Phone / WhatsApp	+91 90244 66791
Grievance Officer	Yash Kumar · [email protected] · +91 90244 66791

Our Grievance Officer can answer questions about how we process personal data. The Grievance Officer’s details are on our Grievance Redressal page.

3. Our two roles

3.1 When we decide how data is used

For your own account data, we decide why and how it is processed. This covers your name, mobile number, email address, device and usage details, and billing details. For this data, we are the Data Fiduciary, and this Policy applies in full.

3.2 When we act for our customers

Our customers use Auditer to work with business data synced from their TallyPrime. This data includes personal data about their customers, suppliers (parties), staff and others. Examples are a party’s name, phone number, email address, postal address and GSTIN.

The business data we process for a customer includes:

data the Auditer Agent syncs from the Tally companies the customer selects: company profile, ledgers and parties with their contact details, vouchers, stock items, godowns and GST details;
entries the customer creates in Auditer, which the Agent writes back into TallyPrime;
payment reminders and alerts that the customer sets up for its parties, sent by WhatsApp, email or SMS, and their delivery status; and
data exchanged with government systems when the customer uses GST, e-invoice and e-way bill features, including the portal credentials the customer connects.

For this business data, our customer is the Data Fiduciary and we act as its Data Processor. We process it only to provide the Service to that customer, under our Terms of Use and our Data Processing Addendum.

3.3 If a business that uses Auditer holds your data

If you are a party of a business that uses Auditer (for example, you received a payment reminder from it), please contact that business about your personal data. If you write to us, we will pass your request to the business or tell you how to reach it, and we will help the business respond.

4. Personal data we collect and why

4.1 The table below lists the personal data we process as Data Fiduciary, what we use it for, our lawful basis and how long we keep it.

4.2 In the table, consent means you have agreed to the use, for example by signing up, by allowing notifications or by choosing to use an optional feature. Legitimate use means a use the DPDP Act allows without separate consent, such as using data you voluntarily gave us for the purpose you gave it, or complying with a law or court order.

Personal data	What we use it for	Lawful basis	How long we keep it
Account details: name, mobile number and email address (optional)	Create and run your account, sign you in, and contact you about your account and the Service	Legitimate use: you give it to us to use the Service	While your account is open; deleted or anonymised within 30 days after you delete the account (see section 10)
Sign-in and security data: one-time codes, sign-in times, device and app details, IP address	Verify sign-ins, keep accounts secure, and detect and investigate misuse	Consent, given when you sign up	Security logs for 12 months, unless a longer period is required by law or an investigation
Workspace and membership data: workspaces you own or belong to, your role and data limits, invitations you send or receive, and the audit trail of entries you make	Provide workspaces, control who sees what, and show the Owner who made each entry	Consent, given when you sign up or accept an invitation	While the workspace exists and you are a member; the audit trail as long as the workspace exists
Billing data: credit purchases and balance, credit usage, payment reference and status, and the details on your GST tax invoice (such as business name, address, state and GSTIN, if given)	Sell credits, issue GST tax invoices, handle refunds and keep the accounts that tax law requires	Legitimate use: you give it to us to buy credits; and compliance with law	Tax invoices and payment records for 8 years
Usage and device data: features used, actions and their times, app version, device model and operating system	Run and support the Service, measure credit use, fix problems and improve the Service	Consent, given when you sign up	While your account is open; deleted or anonymised within 30 days after you delete the account
Mobile app crash reports: technical details of the error, app version, device model and operating system	Find and fix errors in the apps	Consent, given when you sign up	90 days
Push notification data: device push token and notification content	Send notifications you have allowed on your device	Consent: you allow notifications on your device	As long as needed to send notifications to your device, and no longer than your account
Questions to Ask Auditer, our AI help assistant	Answer your question	Consent: you choose to use the feature	While your account is open; deleted with the account within 30 days
Support and grievance messages: your messages, contact details and anything you attach	Answer questions and resolve requests and grievances	Legitimate use: you give it to us for this purpose	3 years after the matter is closed
Website visit data: IP address, browser details and pages requested	Deliver and protect auditer.com, and count visits in aggregate without cookies	Legitimate use: your browser sends it to load the page you ask for; consent for analytics, which you can switch off in Cookie preferences	Visit statistics are kept only in aggregate and are not used to identify you

4.3 We do not store your card or bank credentials. Razorpay handles your payment details when you buy credits. We receive payment information such as the amount, status and payment reference.

4.4 Your device checks your fingerprint or face when you use biometric unlock. We do not receive your biometric data.

4.5 Passwords and API credentials for government portals are sensitive personal data or information under the 2011 Rules. We collect them only when a customer chooses to connect them, use them only to act on that customer’s requests, and store them encrypted.

4.6 We collect only the personal data we need for the purposes in the table. If we want to use personal data for a new purpose, we will tell you and, where the law requires, ask for your consent.

5. Where we get personal data

5.1 From you, when you sign up, use the Service, buy credits or contact us.

5.2 From the Owner of a workspace, when the Owner invites you. We receive your mobile number and the role and data limits the Owner sets. We use it to send the invitation and set up your access.

5.3 Automatically, from your device and our systems when you use the Service, such as sign-in records, usage records and crash reports.

5.4 From our service providers, such as payment status from Razorpay and delivery status from our messaging providers.

5.5 From our customers’ systems, as their Data Processor. The Auditer Agent syncs data from the Tally companies a customer selects. When a customer uses our GST features, we receive data from government systems through our GST Suvidha Provider. For example, a GSTIN check returns the registered name and address for that GSTIN.

6.1 Where we rely on consent, you can withdraw it at any time, as easily as you gave it. You can:

turn off notifications in your device settings;
switch off website analytics through the “Cookie preferences” link in the website footer;
stop using an optional feature, such as Ask Auditer;
delete your account in the app (Profile > Delete account); or
write to [email protected].

6.2 Withdrawing consent does not affect processing that took place before you withdrew it. After you withdraw, we will stop processing for that purpose within a reasonable time, unless the law requires or allows us to continue.

6.3 Some data is needed to run your account. If you withdraw consent for that data, we may not be able to continue providing the Service to you.

7.1 Sub-processors. We use service providers that process data for us, such as for hosting, email, messaging, payments, GST connectivity, AI features, push notifications and crash reports. Our Sub-processors page lists each provider, its purpose and its location. We use them under contracts that require them to protect personal data.

7.2 Government systems, at your request. When you or your members use GST features, we send the required data to the GST portal, the e-invoice system (IRP), the e-way bill system or the Vahan system through our GST Suvidha Provider.

7.3 Your workspace. The Owner and members of a workspace can see data within the access the Owner has given them. The Owner can see the audit trail, including entries you make.

7.4 Legal requests. We may disclose personal data where a law, a court order or a lawful request from a government authority requires it. We check that a request is valid before we respond.

7.5 Business transfers. If our business is merged or sold, personal data may pass to the new owner. The new owner must protect it as this Policy describes.

7.6 We do not share personal data in any other way without your consent.

8. Transfers outside India

8.1 We store the Service’s data in India, on Amazon Web Services in the Mumbai region.

8.2 Some providers process data outside India:

Provider	What is sent	Where
Groq, Inc.	Your question to Ask Auditer, or the request for an AI insight, with the summarised figures or help-article text needed for the answer	USA
650 Industries, Inc. (Expo)	Device push token and notification content, delivered through Google Firebase Cloud Messaging and Apple Push Notification service	USA
Functional Software, Inc. (Sentry)	Mobile app crash and error reports	USA
Cloudflare, Inc.	Website requests, such as IP address and pages requested, to deliver auditer.com and count visits without cookies	Global network

8.3 WhatsApp messages are sent by our messaging provider on Meta’s WhatsApp platform, which may process data outside India.

8.4 We transfer personal data outside India only to countries that the Government of India has not restricted under the DPDP Act, and on any conditions the law sets.

9. How we protect personal data

9.1 We use reasonable security safeguards, including:

hosting the application servers, database and backups on Amazon Web Services in Mumbai (India);
encrypting data in transit with TLS;
encrypting backups;
encrypting the GST portal, e-invoice and e-way bill credentials you connect, using AES-256-GCM;
role-based access, so that each person sees only what their role allows;
keeping each workspace’s data separate;
an audit trail of entries made in Auditer; and
storing the session securely on your device in the mobile apps, with an optional app PIN and biometric unlock.

9.2 Payment details are handled by Razorpay. We do not store card or bank credentials.

9.3 No method of storing or sending data is completely secure. Please help protect your account: keep your phone locked, do not share one-time codes and remove members who no longer need access. Our security page has more detail.

10. How long we keep personal data

10.1 We keep personal data only as long as we need it for the purposes in section 4. Then we erase it, unless the law requires us to keep it. The main periods are:

Data	How long we keep it
Account, usage, Ask Auditer and push-token data	While your account is open; deleted or anonymised from our active systems within 30 days after you delete the account
Copies in encrypted backups	Removed as backups are replaced; within 90 days of deletion from active systems
Security and sign-in logs	12 months, unless a longer period is required by law or an open investigation
Tax invoices and payment records	8 years
Support and grievance records	3 years after the matter is closed
Mobile app crash reports	90 days
Customer business data (as Data Processor)	Until the customer instructs us to delete it (for example when the Owner resets or closes a workspace), as our Data Processing Addendum describes

10.2 When you delete your account. You can delete your account in the app (Profile > Delete account). We then delete or anonymise your account data from our active systems within 30 days. Copies in encrypted backups are removed as those backups are replaced, within 90 days.

10.3 Records we must keep. We keep tax invoices and payment records for 8 years, and security logs for 12 months (or longer if the law or an investigation requires it), even after an account is deleted.

10.4 Customer business data. We delete it on the customer’s instructions, for example when the Owner resets or closes a workspace, as described in our Data Processing Addendum.

10.5 Deleting your Auditer account does not delete anything from your TallyPrime. Your master copy of the books stays on your PC.

11. Your rights

11.1 As a Data Principal, you have the right to:

access a summary of the personal data we process about you, the processing activities, and the other Data Fiduciaries and Data Processors we have shared it with, with a description of what was shared;
correct, complete or update inaccurate, incomplete or outdated personal data;
erase personal data we no longer need, unless the law requires us to keep it;
withdraw consent, as explained in section 6;
grievance redressal, as explained in section 13; and
nominate another person to exercise your rights, as explained in section 12.

11.2 How to make a request. Where the app lets you change a detail, you can change it there. You can delete your account in the app (Profile > Delete account). For any other request, write to [email protected] and include:

your name;
the mobile number registered with Auditer; and
what you would like us to do.

11.3 To protect your account, we may ask you to confirm the request with a one-time code sent to your registered mobile number.

11.4 We aim to acknowledge your request within 48 hours and to complete it within 15 days, and in any case within the time required by applicable law. If we cannot do what you ask, for example because the law requires us to keep the data, we will tell you why.

11.5 For data a business holds about you as its party, please contact that business, as it is the Data Fiduciary. We will help it respond.

11.6 The DPDP Act also sets duties for Data Principals. When you exercise your rights, give accurate information, do not impersonate anyone and do not make false or frivolous complaints.

12. Nominate someone

12.1 You can nominate an individual to exercise your rights if you die, or if you become unable to exercise them because of unsoundness of mind or infirmity of body.

12.2 To nominate someone, write to [email protected] with your registered mobile number and the nominee’s name and contact details. You can change or cancel a nomination in the same way.

12.3 When a nominee contacts us, we will ask for proof of their identity and of the event that allows them to act.

13. Grievances and complaints to the Data Protection Board

13.1 If you have a concern about how we handle personal data, write to our Grievance Officer, Yash Kumar, at [email protected]. Our Grievance Redressal page explains what to include.

13.2 We aim to acknowledge a grievance within 48 hours and to resolve it within 15 days, and in any case within the time required by applicable law.

13.3 If you are not satisfied with our response, you can complain to the Data Protection Board of India in the manner the Board specifies. The DPDP Act asks you to use our grievance process before you approach the Board.

14. Children

14.1 The Service is meant for adults aged 18 or over who run or work for businesses. Under the DPDP Act, a child is a person under 18.

14.2 We do not knowingly process the personal data of children as account holders. If we learn that a child has created an account without verifiable consent from a parent or lawful guardian, we will delete the account data. If you believe this has happened, write to [email protected].

15. Cookies and similar technologies

Our website does not use advertising or tracking cookies. Its analytics do not set cookies. The website and the web portal use browser storage only to remember your choices and to keep you signed in and secure. Our Cookie Policy explains this in detail.

16. Personal data breaches

16.1 If a personal data breach affects your account data, we will inform you without delay through the Service, by email, or through your registered mobile number. We will tell you what happened, the likely consequences, what we have done and what you can do to protect yourself.

16.2 We will also inform the Data Protection Board of India as the DPDP Act and DPDP Rules require. We will report cyber security incidents to CERT-In as its directions require.

16.3 If a breach affects customer business data, we will inform the customer without undue delay and help it meet its own obligations, as our Data Processing Addendum sets out.

17. Changes to this Policy

17.1 We may update this Policy from time to time. The date at the top of this page shows when it was last updated.

17.2 For material changes, we will notify you by email, in the app or on the website before the changes take effect. Where the law requires, we will ask for your consent again.

18. Contact us

Questions and requests: [email protected]
Phone / WhatsApp: +91 90244 66791
Grievance Officer: Yash Kumar · [email protected] · +91 90244 66791
Post: Alcodes Mobility Private Limited, 208, Kesar Nagar, Sanganer, Jaipur, Rajasthan 302029, India