This is the privacy policy for FirmGenie products (audit, websites, plans). General privacy policy for firmgenie.in: Privacy

Privacy policy

This policy explains how FirmGenie handles personal data under India's Digital Personal Data Protection Act, 2023 (DPDP Act) and the DPDP Rules, 2025, and the Information Technology Act, 2000 and its rules while they apply.

1. Who we are

The Data Fiduciary for FirmGenie's own services (audits, accounts, plans, payments and emails to you) is Animesh Kumar, trading as FirmGenie (sole proprietorship, GSTIN 19DDNPK8068R1Z9), Third Floor, B9/6, 301, AC-119/1, BlueOffice Workspace, Prafulla Kanan (East), Kestopur, Kolkata, North 24 Parganas, West Bengal 700101. Email: animesh@firmgenie.in.

Visitors of our clients' websites: when you fill a form on a website made with FirmGenie, that business is the Data Fiduciary for your data and FirmGenie only processes it on their behalf (as their Data Processor). Each such website has its own privacy notice at /privacy. To see, correct or delete that data, write to the business; if they do not reply, you can write to us too.

2. What we collect

• Audit data: your business name, city, area, category, website, Instagram handle and any competitors you name; public information about your business from Google Maps (name, address, rating, review count, listing link) and from your website (the checks in your report).
• Contact details: your name, mobile number and email.
• Website content: what you type in our forms (services, timings, prices), your logo and photos, and the website we build from them.
• Payment data: Cashfree Payments processes every payment. We receive the order number, amount, status, payment method type (for example UPI or card) and Cashfree's reference. We never see or store your card number, UPI PIN or bank login.
• Domain details: if you buy a domain through us, the owner name, address, email and phone the registry requires.
• Usage and security logs: a scrambled (hashed) version of your internet address, the date and time of consents you give, sign-in records and an activity log of changes made in your admin panel.
• Chatbot messages: if a website has the AI chatbot on, the questions visitors type and the answers. Phone numbers and email addresses typed into a chat are masked before the message is stored.
• Email records: which automatic emails were sent to whom, and unsubscribe requests.

3. Why we use it

• To run your audit and show the report; to build, host and change your website; to send your report, receipts, renewal notices and service emails.
• To take payments, issue GST invoices and credit notes, and meet tax and legal duties.
• To prevent fraud and misuse, for example checking that a website is made by the real business owner, and to keep our systems secure.
• To contact you about your audit or website when you have asked us to. We do not send marketing messages without your consent.
• Our AI tools write text only from what you and public listings tell us. We do not use your data to train AI models.

4. Legal basis and consent

• We ask for your consent with a clear tick box before running an audit and before publishing a website. We also process data you give us voluntarily for a specific service, and data the law requires us to keep (for example GST records). These are the "legitimate uses" in section 7 of the DPDP Act.
• You can withdraw consent at any time by emailing animesh@firmgenie.in or using the unsubscribe link in any email. Withdrawing is as easy as giving consent. It does not affect what was done before, and a service that depends on it (such as hosting your website) stops once you withdraw.

5. Who processes it for us

We use these service providers (Data Processors). Each gets only what it needs to do its job:

• Cloudflare (hosting, database, security and bot checks)
• Google: Gemini API (writing website text and chatbot answers, on Google's paid terms, where Google does not use prompts to improve its products), Google Maps Places and PageSpeed (audit data)
• Resend (sending emails)
• Cashfree Payments (payments and refunds; an RBI-authorised payment aggregator)
• GitHub (building Android app files for businesses that order an app: the app name, icon and website address)
• Domain registrars (Cloudflare Registrar, or ResellerClub for .in names) and the domain registry, when you buy a domain

We do not sell personal data. We share it with government authorities only when the law requires it.

6. Data outside India

Some of these providers store or process data outside India (for example in the United States). The DPDP Act allows this except to countries the Government restricts; no country was restricted when this policy was written. We choose providers that commit to protecting the data.

7. How long we keep it

Data	How long
Account, audit and website data	While your account or website exists. Ask us and we delete it within 30 days, except what the law makes us keep.
Chatbot messages	180 days, then deleted automatically
Admin-panel activity log	365 days
Sign-in codes	Deleted a day after they expire
Cached Google Maps data	Refreshed after 30 days
Payment, invoice and GST records	8 years, as tax law requires

8. Your rights

Under the DPDP Act you have the right to:

• access a summary of your personal data and who we shared it with;
• correct, complete, update or erase it;
• withdraw consent;
• have your grievance redressed; and
• nominate a person to use these rights if you die or cannot act.

How: email animesh@firmgenie.in from the email address you used with us (or tell us your mobile number), say what you want, and we may ask you to confirm it is you. We reply within 30 days. If you are not satisfied with our answer, you can complain to the Data Protection Board of India once its complaint process applies.

9. Grievance Officer

10. Children

FirmGenie is for businesses and is not meant for anyone under 18. We do not knowingly collect children's data. If you think a child has given us data, email us and we will delete it.

11. Security

All pages use HTTPS. Secret keys and access tokens are encrypted (AES-256-GCM), internet addresses are stored only as hashes, admin panels need a one-time sign-in code, and access is limited to what is needed. No system is perfectly secure, but we work to protect your data.

12. If there is a data breach

If a breach affects your personal data, we will tell you without delay, in plain words: what happened, what it means for you and what you can do. We will also report it to the Data Protection Board of India (with details within 72 hours) and to CERT-In (within 6 hours), as the law requires.

13. Cookies

The service itself needs only a sign-in cookie for admin panels and customer accounts. On the public FirmGenie pages on firmgenie.in (the audit, pricing, templates, free tools, the landing pages and the payment thank-you page), Google Analytics and the Meta (Facebook) pixel set cookies and measure page visits, which buttons are pressed, and whether a form was sent or a payment completed (with the amount and our order number). They are not used on your private dashboard links, the admin panel, invoices, or on websites built with FirmGenie; what you type into forms is not sent to them, and the access key in your dashboard link never reaches them. A tracking blocker or your browser's privacy settings will stop them. Our bot check (Cloudflare Turnstile) and fonts (Google Fonts) receive your internet address when a page loads.

14. Changes

If we change this policy in a way that matters, we will email account holders before the change applies. The date below shows the latest version.

Last updated: 4 October 2026.