Privacy Policy

Who we are

ATPL OCR is operated by [Legal entity name] (“ATPL”), CIN [CIN], [registered address]. For the purposes of the Digital Personal Data Protection Act, 2023 (DPDP Act), the Information Technology Act, 2000 and the SPDI Rules, 2011, we are the data fiduciary for your account data and a processor for the content of the documents you upload.

Data we collect

• Account: name, email, phone, organisation, password (stored hashed).
• Billing: billing name, address, GSTIN and payment status. Card and UPI details go directly to Razorpay and are not stored by us.
• Uploaded documents and the extracted output (JSON, XML, text).
• Usage logs: pages processed, API calls, IP address, device and browser details, timestamps, errors.
• Essential cookies and local storage, see the Cookie Policy.

Why we use it

• To create your account, read your documents and deliver the output.
• To bill you, issue GST invoices and prevent fraud.
• To keep the service secure, fix faults and apply plan limits.
• To send service notices and reply to support requests.
• To meet legal obligations.

Consent and legal basis

We process your data on the basis of your consent given when you sign up and upload, and for certain legitimate uses permitted by the DPDP Act, such as performing the service you asked for and complying with law. You can withdraw consent at any time by closing your account; this does not affect processing done before then.

Where data is stored

Your data is stored on servers located in India.

Retention

Uploaded documents and their output are deleted [30] days after processing (this period can be configured in your account). Account and billing records are kept as long as your account is active and afterwards for the period needed for tax and legal compliance. Logs are kept for [90] days.

Who we share with

• Our payment gateway, Razorpay, to take payments.
• Our hosting provider, [hosting provider], to run the service.
• Our email provider, [email provider], to send service emails.
• Authorities, where required by law.

We do not sell your personal data or your documents, and we do not use them for advertising. Providers act on our instructions under written terms.

Security

We use encryption in transit, access controls, hashed passwords and activity logging. No system is perfectly secure; tell us at once if you suspect a breach and we will notify you and the Data Protection Board as the law requires.

Your rights

• Access a summary of the personal data we hold and how it is used.
• Correct or update inaccurate or incomplete data.
• Erase your data, unless we must keep it by law.
• Grievance redressal: contact our Grievance Officer.
• Nominate another person to exercise your rights if you die or become incapacitated.

To use any right, write to [privacy email]. You may also complain to the Data Protection Board of India.

Children

The service is for businesses and adults. We do not knowingly collect data from anyone under 18. If you think a child has given us data, write to us and we will delete it.

Cross-border transfers

We store and process data in India. We do not transfer your documents outside India. If this changes we will update this policy and, where required, ask for your consent first.

Contact

Privacy questions: [privacy email], [phone], [registered address]. Grievances: Grievance Officer. Other queries: Contact.

Changes

We may update this policy and will notify you of material changes by email or in the app. The date above shows the latest version.