Privacy Policy

ThinkFiling collects only the personal data needed to form and keep your company compliant, shares it only with the professionals and authorities who need it to do that work, and never sells it.

1. Who we are

thinkfiling.com ("ThinkFiling", "we", "us") is operated by [Legal entity name], [registered address], India. ThinkFiling is a technology platform that helps founders and businesses incorporate companies and LLPs in India and stay compliant with the Ministry of Corporate Affairs (MCA) and other authorities.

For the personal data you give us, we are the Data Fiduciary under the Digital Personal Data Protection Act, 2023 (DPDP Act). This policy also meets the Information Technology Act, 2000 and the IT (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011.

This policy covers our website, the client portal, and every service you buy from us. It does not cover third-party websites we link to.

2. Information we collect

We collect what the law requires for the filing you ask for, plus what we need to run your account.

Category

Examples

Why it is needed

Account details

Name, email, mobile number, password (stored hashed)

To create and secure your client portal account

Identity and address proof (KYC)

PAN, Aadhaar, passport, voter ID or driving licence, bank statement or utility bill, photograph

Required by MCA for every director, designated partner and subscriber

Filing details

Date of birth, father's name, occupation, DIN/DPIN, education, shareholding, specimen signatures

Required in SPICe+, FiLLiP, DIR-3 KYC and other MCA forms

Digital Signature Certificate (DSC) data

Details sent to the certifying authority, video or OTP verification

To issue DSCs for e-filing

Company or LLP information

Proposed names, business activity, registered office address, rent agreement or NOC, owner's utility bill

Name approval, incorporation and ongoing compliance

Payment information

Invoice details, GSTIN, transaction ID, payment status

Billing and tax invoices. Card, UPI and bank details are collected by Razorpay, not by us

Communications

Messages, emails, call notes, support tickets

To deliver the service and answer your questions

Usage and device data

IP address, browser, pages visited, referring ad or search term, cookies

Security, analytics and improving the site (section 5)

If you give us data about another person, such as a co-director, nominee or property owner, you confirm that you have their permission to share it for this purpose.

We ask that you upload masked Aadhaar (first eight digits hidden) wherever the filing allows it.

3. How we use your information

We process your personal data on the basis of your consent, which you give when you create an account or place an order, and for legitimate uses the DPDP Act allows, such as meeting a legal obligation. We use it to:

• Prepare, verify and file your applications and returns with MCA, CBDT, GSTN and other authorities
• Obtain DSCs, DINs, PAN, TAN and other registrations on your behalf
• Assign your case to a qualified professional and let them work on it
• Send you status updates, compliance reminders and due-date alerts
• Issue invoices, process payments and handle refunds
• Keep records the law requires us to keep
• Detect fraud, secure the platform and prevent misuse
• Understand how people use our website so we can improve it

We will send marketing emails only if you opt in, and every one has an unsubscribe link. We do not sell or rent your personal data, and we do not use your KYC documents for anything other than the filing you asked for.

4. Who we share it with

We share personal data only with those who need it to deliver your service, and only as much as they need.

Recipient

What they receive

Why

Chartered Accountants and Company Secretaries in practice engaged by us

Your filing details and documents

To certify and file forms that the law reserves for practising professionals. They are bound by professional confidentiality and a contract with us

Government authorities (MCA/ROC, Income Tax Department, GSTN, EPFO, ESIC and others)

What each form requires

To complete the filing you ordered

Certifying authorities for DSCs

Identity details and verification data

To issue your Digital Signature Certificate

Razorpay

Payment details you enter at checkout

To process payments and refunds under its own privacy policy

Technology providers (hosting, cloud storage, email, messaging, analytics)

Data needed to run the platform

They act as our Data Processors under written contracts

Law enforcement, courts or regulators

What a valid legal order requires

When the law requires it

If ThinkFiling is merged, acquired or restructured, your data may pass to the successor, who must keep to this policy.

Some of our technology providers may store or process data outside India. We transfer data abroad only to countries the Government of India has not restricted under Section 16 of the DPDP Act.

5. Cookies, analytics and advertising

We use a small number of cookies and similar technologies:

• Essential cookies keep you signed in and protect forms from abuse. The site does not work without them.
• Analytics cookies (for example, Google Analytics) tell us which pages people visit and how they found us.
• Advertising cookies (for example, Google Ads) measure whether our ads lead to sign-ups and may show you our ads on other sites.

You can refuse non-essential cookies in our cookie banner or block them in your browser settings. You can also opt out of personalised Google ads at adssettings.google.com.

6. Storage, security and retention

We protect your data with encryption in transit (HTTPS/TLS) and at rest, role-based access so each professional sees only the cases assigned to them, access logging, and regular backups. No system is perfectly secure. If a personal data breach affects you, we will inform you and the Data Protection Board of India as the law requires.

We keep data only as long as we need it:

Data

How long we keep it

KYC documents and filing records

8 years after your last service with us, to meet record-keeping and audit requirements under company, tax and GST law

Invoices and payment records

8 years from the end of the financial year they relate to

Account details

Until you close your account, then deleted within 90 days unless a record above still needs them

Support messages

3 years after the conversation ends

Analytics data

Up to 26 months

When a retention period ends, we delete or anonymise the data.

7. Your rights

Under the DPDP Act you have the right to:

• Access a summary of the personal data we hold about you and who we have shared it with
• Correct and update data that is inaccurate or incomplete
• Erase data we no longer need, unless the law requires us to keep it
• Withdraw consent at any time. Withdrawing does not undo processing already done, and we may be unable to complete a filing that is in progress
• Nominate someone to exercise these rights if you die or become unable to
• Seek redress from our Grievance Officer, and then from the Data Protection Board of India

To use any of these rights, email [privacy@thinkfiling.com] from your registered email address. We may ask you to verify your identity. We will respond within 30 days.

8. Children, changes and contact

Children. Our services are for adults. We do not knowingly collect data from anyone under 18. Where a minor must be named in a filing, such as a nominee, we process that data only with verifiable consent from a parent or lawful guardian.

Changes. We may update this policy as our services or the law change. We will post the new version here with a new date and, for material changes, email you before they take effect.

Contact and Grievance Officer. For questions or complaints about your personal data, contact:

[Grievance Officer name]
[Legal entity name]
[Registered address]
Email: [privacy@thinkfiling.com]

We will acknowledge your complaint within 48 hours and resolve it within 30 days. If you are not satisfied, you may complain to the Data Protection Board of India.