Your books are yours. We just run the software

What you give us, what you create in the product, and what we log to keep it running.

• Account details: your name, email address, and password (stored as a hash) or your Google account identity if you sign in with Google, plus a mobile number when you verify one by OTP.
• Organisation details you enter or we look up for you: company name, address, GSTIN and other tax registrations, CIN, directors and shareholders you add during onboarding, invoice letterhead and bank details, and team members and their roles.
• The records you create or upload: chart of accounts, journal entries, invoices, bank statements, receipts and other files in the document vault, agreements, and conversations with the in-app assistant.
• Emails and attachments you forward to your organisation's intake address, including the sender and recipient addresses.
• Bank connection credentials you add for supported providers (currently Wise and Mercury), and the balances and transactions we sync from them.
• For people who sign an agreement: legal name, email address, designation, the one-time passcode challenge, IP address, browser user agent, and the time of each signing step.
• Billing details: plan, invoices, and payment status. Card and bank payment details are entered with Stripe and are not stored by us.
• Operational data: sign-in sessions with IP address and user agent, API key and connected-app (OAuth / MCP) activity, error reports, and product analytics described under Cookies and analytics.

What leaves CompanyStack when you use an AI feature, and where it goes.

• AI features send the content they need to a large language model: your assistant messages and the ledger data the assistant looks up to answer them, receipts, invoices and bank statements you ask us to read, emails received at your intake address (to classify them), agreement drafts you edit with AI, and records sent by the Tally Companion app.
• Model requests are routed through Cloudflare AI Gateway to our configured model provider, currently Google (Gemini models).
• AI output is a draft. New transactions and journal entries created by AI start as drafts for you to review, and agreements are starting points, not legal advice.
• If you connect an external AI client such as Claude or ChatGPT to CompanyStack over MCP, the data that client reads from your workspace is handled by that client's provider under its own terms. You approve each connection in the browser.
• The model provider processes these requests under its own terms for API customers, which govern how it retains and uses them.

To run the product you asked for, and to keep it working.

• To provide the ledger, invoicing, tax, reporting, document, agreement, and banking features you use, and the managed bookkeeping and compliance services you buy.
• To verify identities and details you give us, such as your email or mobile number by OTP, a GSTIN, a company's CIN record, or a postal address.
• To secure accounts, rate-limit and prevent abuse, troubleshoot failures, and improve product quality.
• To run billing, customer support, and account-related emails and messages.
• To measure sign-ups and purchases from our ads, as described under Cookies and analytics.

The companies that process data on our behalf, and what each one is for.

• Cloudflare: hosting for the app, API, and website, file storage (R2), caching, the AI Gateway, outgoing email, the email intake inbox, and PDF generation.
• Amazon Web Services: the primary PostgreSQL database, and the service that connects to our GST provider.
• Google: sign in with Google, Gemini AI models, and Google Maps address validation.
• Stripe: subscription checkout and payments.
• PostHog: product analytics, error tracking, and session recording.
• Meta: Meta Pixel and Conversions API for ad measurement, and WhatsApp when you choose to send an invoice by WhatsApp.
• 2Factor: SMS one-time passcodes for mobile verification.
• Masters India (a GST Suvidha Provider): GSTIN verification. Sandbox: company master data lookups by CIN.
• Wise and Mercury: only when you connect a bank account there, to read balances and transactions.
• Tavily: web search used when you ask for an AI-suggested GST rate. Only the HSN/SAC code, its description, and the catalog item name are sent.

A short, specific list, and one firm commitment.

• Members of your organisation, according to the roles you give them.
• CompanyStack's accounting and company-secretarial team, when they are assigned to your organisation to deliver a managed service.
• The people you send an agreement to, who see the document and the signing record.
• Statutory portals and authorities, when you ask us to file on your behalf.
• When required to comply with law, enforce our terms, or protect the security of the service and its users.
• We do not sell your accounting data. Ever.

What we store in your browser, and why.

• A sign-in session cookie, required for the app to work.
• Small preferences in your browser's storage, such as your selected organisation, sidebar state, onboarding progress, and the campaign (UTM) parameters you arrived with.
• PostHog analytics on the website and app. In the app, PostHog links events to your account (user ID, name, and email). Clicks are captured without the text or attributes of the element clicked, and personal-data parameters are stripped from captured URLs.
• PostHog session recordings, to help us fix usability problems. In the app, recordings keep the page layout and your interactions but mask all text and every form value, mask attributes that can carry names or amounts, and replace images, PDFs, signatures, and other embedded media with a placeholder. On the website, recordings show the public page content but mask everything you type into forms. Neither records the content of network requests.
• Meta Pixel cookies (_fbp, _fbc) and an event ID cookie, used to measure sign-ups and purchases from our ads. When you sign up or pay, we send Meta the event with a hashed email address and phone number, your IP address, and your browser user agent.

Encryption, organisation scoping, least privilege, and verifiable signing records.

• Data is encrypted in transit over HTTPS and stored with providers that encrypt it at rest.
• Bank connection credentials are additionally encrypted with AES-256-GCM before they are stored.
• Every record belongs to an organisation, and every request is checked against that organisation's membership and roles.
• Access by our team is role-restricted and granted only where a managed service, support, or debugging requires it.
• Each completed agreement has a manifest of its signing events, signed with our attestation key, so anyone can check that the document has not been altered.

How long we keep records, and how you get them out.

• We retain data for as long as needed to provide the service and to meet statutory record-keeping obligations under Indian tax and companies law.
• You can download the files in your document vault, export report data to CSV, and read your records through the API and MCP server at any time. A one-click export of your whole workspace is not available yet; until it is, write to us and we will help you get a copy of your data.
• You can disconnect a bank connection or revoke an API key from settings at any time.
• Account and workspace deletion is handled on request, subject to records we are legally required to keep.

What you can ask us to do with your personal data.

• You can request access to, correction of, or deletion of your personal data by writing to us. We respond within 30 days, subject to records we are legally required to keep.
• Most organisation details and records can be corrected directly in the app by an owner or admin.
• If you are a signer on someone else's agreement, the organisation that sent it controls that document. Contact them first; we will help where we can.