Privacy Policy

MyCAlive — GST & Billing

Effective date: 30 September 2026 · Last updated: 30 September 2026

1. Who we are

MyCAlive is operated by PUNE FINANCIAL SERVICES PRIVATE LIMITED, a company incorporated in India (PAN AAPCP5784L, GSTIN 27AAPCP5784L1ZG), with its registered office at Shop No. C3 304, 3rd Floor, Epic Co Op Hsg Society, Vagholi, Haveli, Pune 412207, Maharashtra, India. In this policy “we”, “us” and “MyCAlive” mean that company.

MyCAlive is a business tool for Chartered Accountants, tax practitioners and their clients in India. It is used to raise invoices, keep books, and download and review GST return data from the Government of India’s GST portal.

2. Two kinds of data, and why the difference matters

Most of what MyCAlive holds is not our data — it belongs to the firm using it.

Account data	Information about the person or firm who signs in: name, email address, mobile number, GSTIN, address and a password. We decide how this is handled, so for this data we are the data fiduciary.
Client and accounting data	The records a firm keeps about its own clients — invoices, purchases, ledgers, GST returns, bank details, and the clients’ own GSTINs and contact details. The firm decides what to put in and what to do with it. We hold and process it on the firm’s instructions, as a data processor.

If you are a client of a CA firm and want your records changed or removed, ask that firm first — they control the account. We will help them act on your request.

3. What we collect

3.1 When a firm or client signs up

Firm or business name, and legal name
Email address and mobile number (used for sign-in codes and password resets)
GSTIN, PAN where supplied, and business address
A password, which is stored only as a salted hash — never in readable form

3.2 Accounting and GST records the firm enters or imports

Invoices, purchases, payments, receipts and ledgers
Customer and vendor details, including GSTIN, address and contact details
Bank account name, number and IFSC, where entered for invoicing
GST return data (GSTR-1, 2A, 2B, 3B), cash and credit ledgers, and filing status, downloaded from the GST portal at the user’s request

3.3 GST portal credentials

These are encrypted at rest. Where a firm chooses to save a client’s GST portal username and password so that returns can be downloaded without retyping them, those credentials are encrypted before they are written to the database, using a key held outside the database and readable only by the server process. They are used for one purpose: signing in to the GST portal on that client’s behalf, when a user of the firm asks for it. They are never used for anything else and never shared.

Saving portal credentials is optional. A firm that prefers not to may sign in manually each time.

3.4 Technical data

Server logs: IP address, page or endpoint requested, time, and browser user-agent
Session cookies, which keep you signed in. We do not use advertising or tracking cookies.

4. What we do with it

Provide the service: invoicing, books, GST downloads and reports
Authenticate you, including sending a one-time code by email or WhatsApp
Bill for subscriptions and paid downloads, and raise the corresponding GST invoice
Keep the service secure and diagnose faults
Meet our own legal and tax obligations in India

We do not sell personal data, and we do not use it for advertising. We do not profile users or share data with advertising networks.

5. Who else sees it

Data is shared only with the providers needed to run the service:

Government of India — GST portal	GSTIN lookups and return downloads, performed at the user’s request using that taxpayer’s own portal session.
Hosting	DigitalOcean, which hosts the servers and the database.
Email delivery	Brevo, used to send sign-in codes, password resets and notifications.
WhatsApp messages	CLEAK, and through it WhatsApp Business, used to send sign-in codes and notifications to a confirmed mobile number.
Payments	Cashfree Payments, for wallet recharges and subscription payments. Card and bank details are handled by the gateway — MyCAlive never sees or stores your card number.

The providers named above are those in use as of the effective date of this policy. We may change a provider — if a service is withdrawn, or no longer meets our requirements — and where we do, we will apply equivalent protections. What we commit to is the list of purposes above, not any particular company.

We may also disclose data where the law requires it, or to protect our rights or the safety of users. We do not otherwise give personal data to third parties.

6. Where it is kept

Your books stay in India. Our servers and database are hosted in DigitalOcean’s Bangalore region. The accounting and GST records a firm enters or downloads — the bulk of what MyCAlive holds — are stored and processed within India.

A narrower set of data may be processed outside India: the sign-in codes and notifications we send to your email address or mobile number, and the details you give our payment gateway when you pay. Those providers operate internationally. Your invoices, ledgers, GST returns and client records are not sent to them.

7. How long we keep it

Accounting and GST records are kept for as long as the firm’s account is active, because Indian tax law requires books to be retained for several years.
Account data is kept while the account is open.
Server logs are kept for a limited period for security and diagnosis.
On closure of an account we delete or return the firm’s data on request, except where we must keep records to meet a legal obligation.

8. How it is protected

All traffic is encrypted in transit using HTTPS
Passwords are stored as salted hashes and cannot be read back
GST portal credentials are encrypted at rest with a key stored outside the database
Each firm’s books are held separately, so one firm cannot see another’s data
Payment and messaging keys are held in server configuration readable only by the administrator account

No system is perfectly secure. If a breach affects your data we will notify you and the relevant authority as the law requires.

9. Your rights

Under India’s Digital Personal Data Protection Act, 2023 you may ask us to give you a copy of your personal data, correct it, or erase it, and you may withdraw a consent you have given. You may also nominate someone to exercise these rights on your behalf.

Write to support@mycalive.com. We will respond within the time the law allows. If you are a client of a CA firm using MyCAlive, please contact that firm first, since they control your records.

10. The MyCAlive Chrome extension

We also publish a separate Chrome extension, MyCAlive GST Portal Auto-Login, which carries an existing GST portal session from MyCAlive into a browser tab so the captcha does not have to be solved twice. It stores nothing and sends nothing to any server of ours. Because it is a different product with different data handling, it has its own policy: Chrome extension privacy policy.

11. Children

MyCAlive is a business tool and is not intended for anyone under 18. We do not knowingly collect data from children.

12. Changes

If we change this policy we will update the date at the top of this page, and tell users inside the application where the change is significant.

13. Contact

PUNE FINANCIAL SERVICES PRIVATE LIMITED
Shop No. C3 304, 3rd Floor, Epic Co Op Hsg Society, Vagholi, Haveli, Pune 412207, Maharashtra, India
Email: support@mycalive.com · Phone: 8956977070