Privacy Notice
This notice explains how Complifly (operated by S3 Infotech, the “Data Fiduciary”) collects, uses, shares, retains, and protects your personal data, and the rights you have under India’s Digital Personal Data Protection Act, 2023 (“DPDP Act”). It is presented to you at the point we first collect your personal data — when you subscribe.
1. Who we are
Complifly is a GST e-invoicing and e-way bill compliance platform. For the personal data of the individuals who sign up for and use Complifly, we act as a Data Fiduciary. For the tax documents your organisation processes through the platform (invoices, GSTINs, IRNs, e-way bills, TDS records), we act as a Data Processor on behalf of your organisation under a Data Processing Agreement — your organisation remains responsible for the lawful basis of that data.
2. Personal data we collect
At subscription we collect, about the individuals named on the form: name, business email, phone number, designation/role, and the company and billing details needed to create your account. As you use the platform we also process account and login activity. Payment card details are tokenised by our payment gateway and are never stored on Complifly servers.
3. Why we process it (purposes)
To create and administer your account, deliver and support the service you have purchased, handle billing, and meet our own legal and security obligations. With your separate, optional consent we may also send you product updates and marketing communications, and analyse platform usage to improve the service. These optional purposes are independent of your purchase.
4. Legal basis
For individuals’ personal data, our basis is your consent (for the necessary service, given at subscription) together with the performance of our contract with you. Optional marketing and analytics rely on your separate consent. Tax documents are processed on your organisation’s instructions as its processor, not on the basis of our own consent.
5. Who we share it with
We share personal data only as needed to run the service: GST Suvidha Providers and the GSTN for compliance operations, our payment gateway for billing, and cloud infrastructure providers that host the platform within India. We share with advisors or CA firms only where you direct or consent. We do not sell personal data.
6. Data residency & security
Personal data is hosted in India. We protect it with encryption, access controls, role-based access, and an immutable audit trail.
7. Retention
We keep personal data for as long as your account is active and thereafter only as required to meet legal, tax, and audit obligations, after which it is deleted or anonymised.
8. Your rights
Under the DPDP Act you may request access to and correction or erasure of your personal data, nominate another person to exercise your rights, and raise a grievance. You can exercise these from within your Complifly account or by contacting us below.
9. Withdrawing consent
Withdrawing consent is as easy as giving it. You can withdraw consent for optional purposes — or for the processing of your personal data — at any time from your account settings or by contacting our grievance officer. Withdrawal does not affect processing already carried out, and withdrawing consent necessary for the service may mean we can no longer provide it.
10. Grievance officer
For any privacy question, request, or complaint, contact our Grievance Officer at privacy@complifly.in. We respond within the timelines required by the DPDP Act.
11. Changes to this notice
This notice is versioned. When we make a material change (a new purpose or a new type of data), we publish a new version and ask you to review and, where required, re-consent on your next sign-in. The current version and effective date are shown at the top of this page.
Version v1.0 · Effective 26 June 2026. This notice is provided for transparency and should be read together with our Terms of Use.