Privacy Policy

1 Scope, Status & DPDP Act Framework

This Privacy Policy explains how Cod Xpert (operating as the "Data Fiduciary" under the Digital Personal Data Protection Act, 2023) processes digital personal data provided by business users, authorized representatives, clients, and partners (the "Data Principals").

Our processing activities are strictly governed by the provisions of the Digital Personal Data Protection Act, 2023 (Act No. 22 of 2023) and applicable rules framed thereunder.

2 Categories of Digital Personal Data Collected

In accordance with the principle of Data Minimisation, we collect only the personal data that is strictly required for delivering our software services:

• Account & Identity Data: Full name, authorized signatory name, business email address, hashed passwords, contact phone numbers, and digital signatures.
• Business & Tax Identifiers: Company name, postal address, GSTIN, PAN, Letter of Undertaking (LUT) reference numbers, and bank account/UPI identifiers.
• Customer & Client Contact Details: Customer business names, billing addresses, contact emails, phone numbers, state codes, and GSTINs entered by the user.
• Transactional & Financial Records: Invoice line items, SAC/HSN codes, item descriptions, invoice dates, foreign currency symbols, locked exchange rates, inward remittances, and FIRC tracking numbers.
• Business Expense Logs: Expense categories, vendor details, receipts/documents, taxable values, and Input Tax Credit (ITC) data.
• Custom SMTP Credentials: Custom mail server host, port, username, and encrypted password used solely for dispatching authenticated invoice emails from the user's custom domain.

3 Specified Purposes & Lawful Processing

Under Section 4 and Section 7 of the DPDP Act, 2023, personal data is processed strictly for the following specified, lawful business purposes:

• Generating printable and downloadable PDF invoices, quotations, and payment receipts.
• Calculating state-wise GST allocations (CGST + SGST for intra-state, IGST for inter-state) based on statutory rules.
• Locking foreign currency exchange rates on invoice creation dates and computing INR equivalents for GST export compliances.
• Compiling GSTR-1 CSV exports (B2B, Export under LUT, Nil/Exempted, HSN summaries).
• Exporting business expense ledgers to Excel/CSV with Input Tax Credit (ITC) categorization.
• Dispatching transactional emails and payment reminders to clients upon user request.

4 Itemized Notice & Consent Framework (Sections 5 & 6)

In compliance with Section 5 of the DPDP Act, 2023, users are provided with a clear notice at the time of registration and data entry detailing the specific personal data collected and the purpose for which it will be processed.

Right to Withdraw Consent: Data Principals have the unconditional right to withdraw consent at any time by accessing their account settings or contacting the Grievance Officer. Withdrawal of consent will lead to the immediate cessation of data processing and subsequent erasure of personal data, subject to mandatory statutory tax retention obligations.

5 Restriction on Processing Children's Personal Data (Section 9)

Cod Xpert Invoices is exclusively a B2B business invoicing and tax management tool intended for commercial entities and individuals aged 18 years and older.

In strict compliance with Section 9 of the DPDP Act, 2023, we do not knowingly collect, track, or process personal data of children (individuals under 18 years of age) or persons with disabilities without verifiable parental or guardian authorization.

6 Multi-Tenant Data Isolation & Security Safeguards (Section 8)

In compliance with Section 8(4) and 8(5) of the DPDP Act, 2023, we maintain robust organizational, technical, and architectural security safeguards:

• Multi-Tenant Row-Level Isolation: Strict authorization policies ensuring that no tenant can query, access, or alter data belonging to another user.
• Encryption in Transit & at Rest: Enforced TLS 1.3 encryption across all public and internal connections; symmetric AES-256-CBC encryption for SMTP credentials.
• Password Hashing: Strong, irreversible Bcrypt hashing for authentication credentials.
• Session & Cookie Protection: Encrypted, HTTPOnly, and SameSite=Strict cookies guarding against CSRF and cross-site scripting attacks.
• Data Breach Notification Protocol: In the event of a personal data breach, Cod Xpert will notify the Data Protection Board of India (DPBI) and affected Data Principals in accordance with statutory guidelines.

7 Custom SMTP & Third-Party Processors

We engage only trusted third-party service providers acting as Data Processors under strict contractual privacy obligations:

• Exchange Rate Providers (ExchangeRate-API): Used strictly for retrieving reference foreign currency conversion rates without transmitting any personal data.
• Custom SMTP Relays: When configured by the user, custom SMTP servers are connected securely to transmit emails directly through the user's authorized mail infrastructure.
• Cloud Infrastructure: Secured enterprise server hosting with automated daily backups, firewall isolation, and DDoS protection.

8 Data Retention, Minimization & Erasure (Section 8(7))

Personal data is retained only for as long as necessary to satisfy the purpose for which it was collected, or to comply with statutory audit trail requirements under the Goods and Services Tax (GST) Act and the Companies Act, 2013 (typically up to 6-8 financial years for accounting invoices).

Upon receipt of an account closure or data erasure request, personal data that is no longer required for statutory compliance will be irrevocably deleted or anonymized.

9 Statutory Rights of the Data Principal (Sections 11–14)

Under Chapter III of the DPDP Act, 2023, you have the following enforceable statutory rights:

• Right to Access Information (Section 11): Right to obtain a summary of personal data being processed, identities of all data processors, and any other relevant processing details.
• Right to Correction & Erasure (Section 12): Right to correct misleading or inaccurate personal data, update incomplete records, and request erasure of data no longer required.
• Right of Grievance Redressal (Section 13): Right to an accessible and timely grievance redressal mechanism provided by our designated Grievance Officer.
• Right to Nominate (Section 14): Right to nominate another individual who shall, in the event of death or incapacity of the Data Principal, exercise these statutory rights.

10 Grievance Redressal Officer & DPBI Escalation (Section 8(9) & 13)

In compliance with Section 8(9) and Section 13(1) of the Digital Personal Data Protection Act, 2023, Cod Xpert has appointed a designated Grievance Officer / Data Protection Officer (DPO):

Escalation to Data Protection Board of India (DPBI): If you do not receive a satisfactory response to your grievance from our Grievance Officer within the stipulated timeline, you have the statutory right under Section 13(3) of the DPDP Act, 2023 to file a formal complaint with the Data Protection Board of India (DPBI).