Privacy Policy

DPDP Act 2023 Compliant GDPR Ready
Effective: 01 September 2026 Updated: 20 September 2026
Table of Contents
Table of Contents

Introduction & Scope

Yuvaasoft Technologies Pvt. Ltd. (“Yuvaasoft”, “we”, “us”, “our”) operates GoFinicky SmartDesk (“SmartDesk”), a cloud-based CRM, billing, and practice management platform designed for traders, small and medium enterprises (SMEs), distributors, and growing businesses in India. We take personal and commercial data privacy seriously. This Privacy Policy explains what personal data we collect, why we collect it, how we use it, how we safeguard it, and what statutory rights you hold over your data.

Applicability of This Policy

This Policy applies to all individuals and entities interacting with SmartDesk, specifically:

Subscribers / Admins

Business owners, partners, and enterprise administrators who register, fund, and hold the primary SmartDesk subscription account.

Staff Users

Employees, sales representatives, billing clerks, and team members added, invited, and provisioned by the subscriber with defined operational rights.

Website Visitors

Visitors exploring the public SmartDesk website, requesting live product demonstrations, or reaching out through contact forms.

Governing Legal Framework

This Privacy Policy is formulated and enforced under the following legal frameworks:

  • India’s Digital Personal Data Protection Act 2023 (DPDP Act)
  • The European Union’s General Data Protection Regulation (GDPR), where applicable to EU/EEA-based residents
  • Indian Information Technology Act 2000 and the Information Technology (Amendment) Act 2008, including reasonable security practices rules

Who We Are (Data Controller / Data Fiduciary)

For the purposes of applicable data protection legislation, the entity responsible for processing your personal data is:

Legal Entity Name Yuvaasoft Technologies Pvt. Ltd.
Registered Office Coimbatore, Tamil Nadu, India
Official Communications Email info@yuvaasoft.com
Legal Status (India - DPDP Act 2023) Data Fiduciary for platform registration, billing, and account management
Legal Status (EU - GDPR) Data Controller for personal data of European Union / EEA users
Data Processing Relationship: When a subscriber (Admin) stores customer ledgers, sales bills, or prospect contact details inside SmartDesk, the subscriber is the Data Fiduciary (or Data Controller), and Yuvaasoft acts as a secure Data Processor operating strictly under the subscriber’s operational instructions.

What Data We Collect

We collect personal and transactional data across six distinct categories to deliver the core functionalities of GoFinicky SmartDesk:

Account Registration Data

Collected when an Admin registers for SmartDesk or when an Admin provisions a Staff User:

  • Full name, primary official email address, and verified mobile / WhatsApp phone number.
  • Business entity name, trade name, and business category (e.g., Trader, Distributor, Manufacturer, Retailer).
  • Goods and Services Tax Identification Number (GSTIN) and Permanent Account Number (PAN) for statutory billing and invoice customization.
  • Official office / registered commercial address, PIN code, and state code.
  • Staff user profiles: Name, work email, phone number, designated operational role, and system access permissions.

Subscription & Billing Data

Collected when managing your SmartDesk software license and renewals:

  • Active subscription plan tier, licensing period (monthly / annual), renewal dates, and user seat quotas.
  • Payment transaction reference numbers, UTR numbers, and bank gateway receipt identifiers.
  • Official tax invoice history generated for your subscription.
Zero Raw Card Storage: Yuvaasoft never captures, logs, or stores full credit card numbers, debit card numbers, or CVV codes on our servers. All financial transactions are processed through PCI-DSS compliant, RBI-authorized payment gateways.

Platform & Login Usage Data

Technical data generated through normal system interactions:

  • Login timestamps, logout events, IP addresses, internet service provider, and device/browser telemetry.
  • Role-based action logs: Lead creation, quotation generation, sales bill printing, WhatsApp shares, and document exports (used by Admins to audit staff activity).
  • Session durations, error logs, and system crash diagnostics.

Customer & CRM Data (Entered by Admin & Staff)

Data entered directly into SmartDesk tools to operate daily trade, billing, and sales pipelines:

Lead Management & Follow-ups

Prospect names, phone numbers, email addresses, inquiry notes, deal valuations, and scheduled follow-up reminder alerts.

Customer Records

Buyer business names, contact persons, phone numbers, delivery addresses, GST numbers, and payment ledger history.

Quotations & Sales Bills

Product line items, HSN/SAC codes, tax rates (CGST, SGST, IGST), pricing, discounts, and generated invoice documents.

GST Reports & Exports

Sales registers, tax summaries, and periodic GST return datasets downloaded in PDF, CSV, or XLS formats.

Communications Data

Support inquiries, demo requests (name, business name, phone number, preferred time slot, location, message), feedback submissions, and email correspondences sent to our help desk.

Cookies & Technical Data

Strictly necessary session cookies and functional authentication tokens required to keep Admin and Staff users safely authenticated. We do not employ third-party advertising cookies, behavioural retargeting pixels, or commercial tracking networks.

Legal Basis for Processing (GDPR - EU/EEA Users)

For subscribers and users situated within the European Union or European Economic Area, we process your personal data in accordance with the following Article 6 bases under the GDPR:

GDPR Legal Basis Operational Application in SmartDesk
Contract Performance
Art. 6(1)(b) GDPR		 Delivering the SmartDesk CRM and billing platform, generating quotations and sales bills, executing WhatsApp dispatches, maintaining staff logins, and managing subscriptions.
Legal Obligation
Art. 6(1)(c) GDPR		 Preserving statutory tax records, maintaining GST-compliant invoices, and fulfilling Indian financial audit and regulatory retention mandates.
Legitimate Interests
Art. 6(1)(f) GDPR		 Ensuring infrastructure cybersecurity, preventing fraudulent platform usage, monitoring server performance, and analyzing anonymized platform usage metrics.
Consent
Art. 6(1)(a) GDPR		 Direct product communications, feature webinars, or demonstration scheduling where explicit opt-in consent is requested. Consent may be revoked at any time.

How We Use Your Data

We process personal, business, and operational data exclusively for specific, legitimate business purposes:

Service Delivery: To operate SmartDesk’s core modules including Lead Management, Customer Records, Quotation Generation, Sales Bill Creation, and GST Reports.
Role-Based Access: To authenticate Admin and Staff users, enforce granular operational permissions, and log team audit trails.
Billing & Subscriptions: To issue license invoices, verify payment receipts, handle renewals, and comply with Indian GST invoicing laws.
Technical Support: To troubleshoot issues reported by Admins or Staff, answer product queries, and conduct requested system demos.
Security Monitoring: To defend against unauthorized logins, brute force attempts, and data corruption across our cloud servers.
Platform Improvements: To optimize system response times and interface usability based on aggregate, non-identifiable telemetry.
Our Non-Monetization Guarantee: We never sell, rent, lease, or monetize your business or customer data. We never display third-party advertisements within SmartDesk, nor do we profile your clients for marketing.

Data Storage and Security

Data sovereignty and security are central to our design philosophy. All SmartDesk customer databases, leads, sales ledgers, and generated documents are stored on Tier-4 data centers located within India (AWS Mumbai Region — ap-south-1). No primary business data is exported or transferred outside India for storage.

Security Measures in Place

Encryption at Rest

All databases, storage volumes, and server backups are encrypted using industry-standard Advanced Encryption Standard (AES-256).

Encryption in Transit

All browser sessions and API calls are encrypted using Transport Layer Security (TLS 1.2 and TLS 1.3) with strict HTTPS enforcement.

Role Segregation & RBAC

Strict role-based access control separates Admin privileges from Staff privileges, ensuring confidential company metrics are protected.

Automated Daily Backups

Encrypted snapshot backups run automatically every 24 hours with a minimum retention cycle of 30 days for disaster recovery.

Cross-Border Transfer Notice (For EU/EEA Users): India does not currently possess an EU adequacy decision. Transfers of personal data from EU users to our servers in India are executed pursuant to Standard Contractual Clauses (SCCs) approved by the European Commission, or based upon your explicit, informed consent.

Data Retention Schedule

We retain your personal and business data only for as long as necessary to fulfill the purposes set out in this Policy, comply with statutory tax laws, and maintain business continuity:

Category of Data Statutory Retention Period Legal / Operational Rationale
Account & Staff Registration Data Duration of Subscription + 3 Years Account re-activation, dispute resolution, and contractual limitation periods.
Billing, Invoices & GST Records 8 Years Mandatory compliance under the Central Goods and Services Tax (CGST) Act and Indian Income Tax Act.
Customer Ledgers & CRM Records Duration of Active Subscription Maintained for your operational use; exportable in CSV/XLS at any time. Expunged 90 days after account termination upon written request.
Platform Usage & Access Logs 12 Months (Rolling Basis) Security monitoring, threat detection, and system maintenance.
Customer Support Inquiries 3 Years Service quality assurance and follow-up support records.
Session Cookies Browser Close Destroyed immediately upon browser termination or manual logout.

Following the expiration of the applicable retention timeline, personal data is permanently deleted from our live databases and securely overwritten across all backup archives.

Sharing of Data & Platform Isolation

We do not sell, rent, broker, or trade personal data. Data is shared strictly under limited, contractual circumstances necessary to operate the service:

  • Cloud Infrastructure Providers (Amazon Web Services Mumbai): Hosted under binding enterprise Data Processing Agreements (DPAs) solely for cloud storage, computation, and database management.
  • Payment Aggregators (RBI-Licensed Gateways): To process subscription licensing payments and issue receipts via PCI-DSS compliant channels.
  • Statutory & Legal Authorities: Disclosed only when strictly compelled by Indian law, a valid court order, a legal summons, or an authorized regulatory authority with competent jurisdiction.
  • Business Transfers: In the event of a merger, acquisition, or restructuring of Yuvaasoft, subscribers will be notified at least 30 days in advance via email with full rights to export or delete their data prior to transition.
Strict Product Isolation Guarantee
Yuvaasoft Technologies develops and maintains multiple specialized platforms, including SmartDesk and AuditDesk. Each platform operates within completely isolated, segregated cloud environments. No customer data, financial ledger, quotation, lead, or staff profile from SmartDesk is ever accessible, shared, cross-indexed, or merged with AuditDesk or any other product under any circumstances.

Your Rights Over Your Data

Depending on your geographic jurisdiction, you hold substantial statutory rights over your personal data:

Rights Under GDPR (For EU/EEA Users)

Statutory Right Scope & Provisions
Right of Access (Art. 15) Request confirmation of whether your data is being processed and obtain a comprehensive copy of your personal data.
Right to Rectification (Art. 16) Request prompt correction of any inaccurate, misleading, or incomplete personal data.
Right to Erasure (Art. 17) Request permanent deletion (“right to be forgotten”), subject to statutory tax and financial retention laws.
Right to Restrict Processing (Art. 18) Request the freezing or temporary restriction of data processing while a dispute or audit is being resolved.
Right to Data Portability (Art. 20) Receive your personal and business data in a structured, commonly used, and machine-readable format (CSV, XLS, JSON).
Right to Object (Art. 21) Object to processing founded upon legitimate interests or direct informational updates.
Automated Decision-Making (Art. 22) SmartDesk does not employ automated profiling or algorithm-only decision-making that produces legal or discriminatory effects.

Rights Under India’s DPDP Act 2023

DPDP Act Right Scope & Provisions
Right to Access Information (Sec. 11) Obtain a clear summary of personal data being processed, processing activities carried out, and identities of data processors involved.
Right to Correction & Erasure (Sec. 12) Request the correction of inaccurate data, updating of incomplete information, or erasure of data no longer required for its specified purpose.
Right of Grievance Redressal (Sec. 13) Lodge an official grievance directly with our designated Grievance Officer and obtain resolution within 30 days.
Right to Nominate (Sec. 14) Nominate another individual to exercise your digital data rights on your behalf in the event of death or legal incapacity.

To exercise any of these statutory rights, please write to us at info@yuvaasoft.com. We will process and respond to verified requests within thirty (30) calendar days.

Protection of Children’s Data

GoFinicky SmartDesk is an enterprise and business software solution intended exclusively for commercial entities and individuals who are at least eighteen (18) years of age. We do not knowingly market to, collect, or process personal data belonging to minors or children.

If we discover that personal data of an individual under 18 years of age has been inadvertently collected without verifiable parental or guardian authorization, we will permanently expunge that information from our servers immediately and inform the account administrator.

Grievance Redressal Officer (DPDP Act 2023)

In strict compliance with Section 13 of the Digital Personal Data Protection Act 2023 and the Information Technology Rules, Yuvaasoft has appointed a designated Grievance Redressal Officer:

Designated Officer

Sathya Priya

Grievance Redressal Officer & Compliance Lead

Company: Yuvaasoft Technologies Pvt. Ltd.
Location: Coimbatore, Tamil Nadu, India
Redressal Timeline

Formal complaints received will be acknowledged within 48 hours and resolved within 30 calendar days of receipt.

Changes to This Privacy Policy

We may periodically update this Privacy Policy to reflect modifications in our software features, statutory regulatory amendments, or operational requirements.

When significant material changes are introduced, we will notify registered subscribers via email at least fourteen (14) days before changes take effect. The revised policy will be posted on this page with an updated “Effective Date” and “Last Updated” timestamp. Continued access or usage of GoFinicky SmartDesk after the effective date constitutes your affirmative acknowledgment and acceptance of the revised policy.

Contact Us & Supervisory Authority

For all privacy inquiries, data access or deletion requests, compliance verifications, or feedback regarding GoFinicky SmartDesk:

Direct Privacy Desk

Email inquiries:

info@yuvaasoft.com
Postal Address

Yuvaasoft Technologies Pvt. Ltd.
Coimbatore, Tamil Nadu, India.

EU Supervisory Authority Notice: If you reside within the European Union and believe that our processing of your personal data violates the General Data Protection Regulation, you have the legal right to lodge a complaint with your domestic Data Protection Supervisory Authority.

Related: Terms & Conditions  |  Cookie Policy  |  Customer Support