Legal

Privacy Policy

Effective Date: 14 October 2026 | We do not sell your data. Ever.

Short version: We collect only what we need to run the platform. We use AES-256 encryption for stored data. We never sell, rent, or share your business data with third parties for advertising or any commercial purpose. Your data belongs to you.

1. Who This Policy Applies To

This Privacy Policy applies to all users of the Truetal platform (truetal.in), operated by Truetal. It covers data collected through our website, web application, API, and any communication you have with us by email or support channels.

By using Truetal, you consent to the data practices described in this policy. If you do not agree, please do not use the platform.

2. What Data We Collect

We collect two types of data:

2.1 Data You Provide

Registration details: name, email address, mobile number, business name, GSTIN.
Company settings: address, bank account details, invoice configuration, authorised signatory details.
Business records: customer details, vendor details, invoice data, purchase data, expense records.
GST return data: figures entered for GSTR-1, GSTR-3B, GSTR-9 preparation.
Support communications: emails you send to mail@truetal.in.

2.2 Data Collected Automatically

Login timestamps and session metadata (for security monitoring).
IP address (to detect fraudulent access, not for location tracking).
Browser type and operating system (for compatibility support).
Feature usage patterns (which modules you use, anonymised — to improve the product).

On our public website, Google Analytics is optional and loads only after you select “Allow analytics”. Google may then set first-party measurement cookies. You can reject analytics or change your choice from the website footer. We do not send form contents, phone numbers, email addresses, GST data, or business records to analytics. Separately, Truetal uses a pseudonymous first-party visitor identifier for up to 180 days to remember the first public page and campaign that brought you to us, record article CTA clicks, and connect that journey to a later workspace registration. This measurement does not read form contents, account fields, GSTIN, invoice data, or bank data and is not shared with advertising networks.

3. How We Use Your Data

We use your data strictly to operate and improve the Truetal platform. Specifically:

To create and maintain your account.
To generate tax invoices, bill of supply, delivery challans, credit notes, and GST return JSON files from the data you enter.
To send OTP authentication codes for login (via Fast2SMS).
To send transactional emails: invoice PDFs, filing reminders, system alerts (via Brevo).
To operate TruBot, our AI compliance assistant (queries are sent to Anthropic's Claude API — see Section 6).
To detect, investigate, and prevent fraudulent or unauthorised access.
To respond to support requests.

We do not use your data for marketing to third parties, profiling for advertising, or any purpose not listed above.

4. Data Security

We take data security seriously. Our security measures include:

AES-256 encryption for all data stored in the database.
TLS 1.2+ encryption for all data in transit.
Password hashing using bcrypt with salt (passwords are never stored in plain text).
Database hosted on Railway's managed PostgreSQL with daily automated backups.
Role-based access control — each user can only access their own business data.
Founder-only access to the administrative analytics dashboard.

No system is 100% secure. If we discover a data breach that affects your personal data, we will notify you by email within 72 hours of becoming aware of it.

5. Data Retention

We retain your data for as long as your account is active. When you cancel your account:

Your data is retained for 60 days to allow you to export it or reactivate.
After 60 days, all your data — including invoices, customer records, and return data — is permanently deleted from our systems.
Anonymised, aggregated usage statistics (total invoices generated, etc.) may be retained for platform improvement purposes after deletion.

You can request deletion of your data at any time by emailing mail@truetal.in. We will complete deletion within 30 days.

6. Third-Party Services We Use

We use the following third-party services to operate the platform. Data shared with each is described below:

Railway (railway.app) — Hosts our backend server and PostgreSQL database in the cloud. Your business data resides on Railway's infrastructure. Railway is SOC 2 compliant.
Vercel (vercel.com) — Hosts our frontend web application. Vercel does not process your business data.
Brevo (brevo.com) — Sends transactional emails (invoice PDFs, OTPs, alerts). We share your email address with Brevo for delivery purposes only.
Fast2SMS (fast2sms.com) — Sends OTP verification SMS. We share your mobile number with Fast2SMS for OTP delivery only.
Anthropic (anthropic.com) — Powers TruBot, our AI assistant, and reads invoices you choose to scan. When you use TruBot, the question you type is sent to Anthropic's Claude API. Where Google Gemini (below) is not available, Anthropic is also used to suggest bank-line categories and to read scanned bank statements on the same terms as Google. Anthropic's data processing is governed by their privacy policy.
Google (Gemini API, paid tier) — Suggests expense categories for bank lines our own rules do not recognise, reads scanned (image-only) bank statements, and reads delivery challans where you have given consent. For category suggestions we send only the cleaned payee name, a rounded amount and whether money went out; we never send your account number, balance, account holder name, UPI handle or reference numbers. Every suggestion is shown to you and nothing is posted until you confirm it. On the paid tier Google does not use this data to train its models.
Google Analytics — If you allow optional analytics on our public website, Google receives page and interaction measurements used to understand which content helps visitors. Analytics is disabled by default until you choose, advertising storage stays disabled, and we do not send contact details, form contents, GST data, or business records.
GoDaddy — Manages our domain (truetal.in). GoDaddy does not process your business data.

We do not share your business data with any other third parties. We do not use Facebook Pixel or advertising networks. Optional Google Analytics is used only with your consent as described above.

7. Your Rights

As a user of Truetal, you have the following rights regarding your data:

Access: You may request a copy of all data we hold about you.
Correction: You may update incorrect data directly through the platform at any time.
Deletion: You may request deletion of your account and all associated data.
Export: You may export your invoice data, customer records, and return figures from the platform at any time.
Restriction: You may ask us to restrict processing of your data while a dispute is pending.

To exercise any of these rights, email mail@truetal.in with your registered email address and the specific right you wish to exercise. We will respond within 30 days.

8. Sensitive Financial Data

Truetal stores bank account details (account number, IFSC code, bank name) that you enter for inclusion in invoices sent to your customers. This data is:

Encrypted at rest using AES-256.
Never shared with any third party.
Displayed only in PDF invoice outputs that you generate and choose to share.
Not used for any payment processing — Truetal does not process payments.

Your GSTIN, customer GSTINs, and supplier GSTINs stored in the platform are used exclusively for generating compliant GST documents. They are not shared with the GSTN portal unless you manually upload the generated JSON files.

9. Children's Privacy

Truetal is a business compliance platform intended for adults running registered businesses. We do not knowingly collect personal data from individuals under 18. If you believe a person under 18 has created an account, please notify us immediately at mail@truetal.in and we will delete the account.

10. Changes to This Policy

We may update this Privacy Policy to reflect changes in our data practices or applicable law. When we do, we will update the Effective Date at the top and notify all registered users by email at least 14 days before changes take effect.

Material changes (changes that expand how we use your data) will require your affirmative consent before they apply to your account.

11. Contact

For privacy questions, data requests, or concerns about how we handle your information:

Truetal
Privacy queries: mail@truetal.in
We respond to all privacy queries within 5 business days.

Effective Date: 14 October 2026 · Truetal · We never sell your data.

Create Free Account