Privacy policy

Last updated: 4 November 2026

This privacy policy ("Policy") explains how XBRLVAULT, a proprietorship concern ("XBRL Vault", "we", "us"), collects, uses, stores and protects information received from its clients, in accordance with the Information Technology Act, 2000, the rules made thereunder, and the Digital Personal Data Protection Act, 2023 to the extent applicable.

1. Definitions

"Client" means the company, and the person acting on its behalf, who places an order. "Client Documents" means the financial statements, reports and other files supplied for an order. "Personal Data" has the meaning given in the Digital Personal Data Protection Act, 2023, and includes names, PAN, DIN, contact details and remuneration of directors and key managerial personnel contained in Client Documents.

2. Information collected

1. Contact details of the person placing the order: name, email address and mobile number.
2. Company details: name and Corporate Identity Number.
3. Client Documents supplied for the preparation of the XBRL file.
4. Payment confirmation details received from the payment gateway. Card, bank account and UPI credentials are collected and processed by the payment gateway and are not received or stored by us.

3. Purpose of processing

Information is processed solely to (a) prepare, verify and deliver the XBRL file; (b) communicate with the Client about the order, including status updates by email and WhatsApp; (c) receive payment; and (d) comply with applicable law. Client Documents are not used for marketing or for any other purpose.

4. Consent

By supplying Client Documents, the Client confirms that it is authorised to share them, including any Personal Data contained in them, for the purposes stated in this Policy.

5. Disclosure to service providers

We do not sell, rent or trade information. Information is disclosed only to service providers engaged to deliver the service, each bound by confidentiality and data protection obligations: cloud hosting and storage, business email, the payment gateway, WhatsApp Business messaging (order status only, never Client Documents), and an artificial intelligence service used to assist in reading and tagging Client Documents under commercial terms that prohibit use of the data to train its models. Some of these providers may process data outside India, subject to applicable law. Information may also be disclosed where required by law or by order of a competent authority.

6. Security

We maintain reasonable security practices, including encryption of files in storage and in transit, access restricted to personnel assigned to the order, logging of access, confidentiality undertakings from personnel, and use of office systems only.

7. Retention and deletion

Client Documents and delivered files are deleted automatically 90 days after delivery, or 90 days after receipt where an order is not completed. Records required under tax and other laws are retained for the period prescribed by those laws.

8. Rights of the Client

The Client may request access to, correction of, or deletion of its information, or withdraw consent, by writing to support@xbrlvault.com. Deletion or withdrawal before delivery will prevent completion of the order.

9. Grievance redressal

Any grievance regarding the processing of information may be addressed to the Grievance Officer at grievance@xbrlvault.com. Grievances are acknowledged within 48 hours and resolved within one month.

10. Changes to this Policy

This Policy may be updated from time to time. The current version is always available on this page.