Privacy Policy

1. Data we collect

• Account data — name, email, phone number; your Google account's basic profile if you sign in with Google.
• Order and KYC data — documents and identifiers required for the services you order: PAN, Aadhaar, DIN, photographs, address proofs, bank details, business registration documents and financial data (invoices, statements) needed for filings.
• Payment data — order amounts, payment status and identifiers received from Razorpay. We never see or store your full card number, UPI PIN or banking credentials — those go directly to the payment gateway.
• Lead data — name, phone, email and message when you request a callback, along with the page and campaign parameters (UTM) that brought you.
• Technical data — standard server logs (IP address, browser, pages visited) used for security and debugging.
• Sign-up and sign-in location — the IP address your account was created from and the one you most recently signed in from, together with the approximate, city-level location derived from it (city, state and country). We keep this to detect fraudulent and duplicate accounts and to help our support team verify who they are speaking to. We do not collect precise or GPS location, and we never ask your browser or phone for it. This information is visible only to our own staff — never to the professionals you consult, and never to other customers.

2. Why we process it (purposes)

• To deliver the services you order — preparing and filing your registrations, returns and applications through partner professionals.
• To operate your account, dashboard, document vault and order tracking.
• To process payments, issue GST invoices and maintain accounting records required by law.
• To respond to callback requests and support queries.
• To send transactional notifications about your orders, and (only with your consent) service reminders and updates.
• To secure the platform, prevent fraud and comply with legal obligations.

We do not sell your personal data, and we do not use your KYC documents for any purpose other than the service you ordered.

3. Who can see your data

• Partner professionals — the independent CA/CS/trademark agent/advocate assigned to your order sees only the documents of orders assigned to them, under confidentiality obligations.
• Government portals — your data is submitted to the relevant authority (MCA, GSTN, income-tax, IP India, DGFT, FoSCoS etc.) as required by the service you ordered.
• Service providers — payment processing (Razorpay), SMS/email delivery and cloud infrastructure providers, each receiving only what their function requires.
• Law enforcement / regulators — where disclosure is required by law.

4. How we protect it

• Documents are stored on private servers outside public web reach and are served only through short-lived signed links.
• Every access to a stored document is recorded in an append-only access log — you can ask us who accessed your documents.
• Sensitive identifiers (PAN, Aadhaar, DIN, bank details) are stored encrypted at the field level.
• All traffic is encrypted in transit (TLS). Backups are encrypted before storage.
• Staff access is role-restricted and limited to assigned orders.

5. Retention

• Order records and invoices — retained for 8 years, matching record-keeping requirements under tax and company law. These are kept even if you delete your account: a tax invoice must, by law, show the buyer's name and GSTIN, so it cannot be blanked.
• KYC documents — retained while your account is active so repeat filings do not require re-uploads. Documents you uploaded to your own folders are erased when you delete your account; documents attached to an order we filed for you are kept as the evidence behind that filing.
• Lead data — retained up to 24 months from last contact, then deleted or anonymised. An enquiry is not an account, so deleting an account does not reach it — ask us and we will remove it sooner.
• Server logs — retained up to 12 months for security purposes.
• Your account — kept while the account exists. You can delete it yourself, from the ClearTLC app or your dashboard: the request starts a 14-day window you can cancel at any time, and at the end of it we erase your personal data, documents and conversations. The records listed above stay for their own periods, which deleting your account does not shorten. The full list of what is erased and what is kept is on Delete your ClearTLC account.

6. Your rights

Under the DPDP Act you may: access a summary of the personal data we hold about you; request correction of inaccurate data; request erasure of data no longer required for a stated purpose or a legal obligation; withdraw consent for optional processing (such as promotional messages); and nominate a person to exercise these rights on your behalf. Write to the grievance contact below — we respond within the timelines prescribed under the Act.

Deleting your account does not need an email to us: you can do it yourself from the ClearTLC app (Account → Delete account) or from your dashboard. It starts a 14-day window you can cancel, and Delete your ClearTLC account lists exactly what is erased, what we are required to keep, and why. If you can no longer sign in, that page also explains how to ask us directly.

7. Cookies

cleartlc.com uses only functional storage (such as the login token for your dashboard) and campaign parameters passed in URLs. We do not use third-party advertising cookies on this site. If analytics tooling is added, this policy will be updated before it is enabled.

8. Grievance officer & contact

For any privacy question, data request or grievance under the DPDP Act:

Grievance Officer — Data Protection
YALI GLOBAL CORPORATION PRIVATE LIMITED
Email: support@cleartlc.com (subject line: “Privacy request”)
We acknowledge grievances within 72 hours and aim to resolve them within 15 days.

9. Changes

We will post any changes to this policy on this page with a new effective date, and notify you of material changes. See also our Terms of Service and Refund Policy.