Privacy Policy

Galla Ai (“we”, “us”) provides GST billing, accounting and return preparation software at www.galla.ca and in the Galla Ai mobile apps. This policy explains what personal data we handle, why, and the choices you have. It is written to meet India's Digital Personal Data Protection Act, 2023 (DPDP Act) and the Information Technology Act, 2000 and its rules.

There are two kinds of data in Galla Ai. Your account data (your name, email, password) we handle for ourselves. Your books (invoices, bills, parties, items, payments, returns) belong to your business: for the personal data of your customers and suppliers in them, your business decides what is kept and why, and we process it on your behalf.

• Account details: your name, email address and password (stored only as a one-way hash, never in readable form).
• Business details: business name, GSTIN, PAN, address, state, phone, email, UPI ID, bank details you choose to print on invoices, and your GST portal username if you connect filing.
• Your books: sales and purchase documents, parties and their GSTINs, items and stock, payments, expenses, bank statements you upload, GSTR-2B files and the returns prepared from them.
• Files you upload: photos and PDFs of bills, bank statements, Tally exports and Excel or CSV registers.
• CA practice details: for chartered accountants, your firm name, city, ICAI membership and firm registration numbers, and the clients you add.
• Usage and security records: sign-in sessions, an activity log of who changed what in a business, and basic server logs (IP address, browser, time) kept to keep the service secure.

• To run Galla Ai for you: create invoices, keep your books, prepare GSTR-1 and GSTR-3B, reconcile with GSTR-2B, and show your reports.
• To let the people you invite (your team, your CA, your business owner) work in the same books, with the roles you give them.
• To send you service emails: sign-in and password reset links, invitations, return approvals and reminders you ask for.
• To file e-invoices, e-way bills and returns on the GST portal, only when you or your CA choose to file.
• To keep the service secure, prevent misuse and fix problems.
• To meet our legal obligations.

We do not sell your data, show you ads, or use your books to market to your customers. We do not use analytics or advertising trackers.

Some features use AI from Anthropic (Claude), and only when you use them:

• Scanning a bill or bank statement: the image or PDF you upload is sent to read the amounts, dates and parties into a draft for you to check.
• Mapping a spreadsheet's columns: only the column headings are sent, never the amounts, names or GSTINs in the rows.
• Asking Mantri: your question and the figures Mantri looks up to answer it, only in businesses whose owner has turned Mantri on. See Mantri, the in-app advisor.

Our AI provider processes this data only to return the result to us and does not use it to train its models. Everything else in Galla Ai, including return preparation and reconciliation, runs on our own servers without AI.

Mantri answers questions about a business's books in plain words, such as “who owes me the most?” or “which clients are blocked this month?”. It is off until the business owner turns it on in Settings, and the owner can turn it off at any time.

• What it sees: only what the person asking may see in that business with their role, such as invoices, bills, parties, items, reports and GST figures. A CA asking from their practice sees only the return status and checks of clients whose owners have turned Mantri on.
• What is sent to our AI provider: the question, the earlier messages in that conversation, and the records Mantri looks up to answer. Anthropic processes them only to return the answer and does not use them to train its models.
• What it can do: only read. Mantri cannot create, change, delete, file or send anything.
• What is kept: each question is noted in the business's activity log with who asked and when, so the owner can see how Mantri is used. We don't store Mantri's answers or the conversation; closing the panel ends it.

Mantri can make mistakes. Check figures before relying on them, and check tax decisions with your CA.

Only the service providers we need to run Galla Ai, each bound to use the data only for us:

Within Galla Ai, your data is visible only to people you or your business add, with the role you give them. A CA sees a client's books only after being added to that business. We may disclose data if Indian law requires it, for example to respond to a lawful order; where the law allows, we will tell you first.

Your account and books are stored in India (Mumbai). Some providers above process limited data outside India, as the DPDP Act permits.

• All traffic is encrypted in transit (HTTPS), and the database is encrypted at rest.
• Passwords are stored as one-way hashes; sign-in tokens are stored hashed too.
• Every business's data is kept separate, and every action is checked against the person's role in that business.
• An activity log records who created, changed or approved what.

No system is perfectly secure. If a breach affects your personal data, we will tell you and the Data Protection Board of India as the law requires.

We keep your data while your account is open. GST law requires businesses to keep their books for at least 72 months from the due date of the annual return; you can download a full backup at any time from Backup in the app, and you remain responsible for keeping records for that period.

When you ask us to close your account or delete a business, we delete the data within 30 days, and from our backups within 90 days, unless the law requires us to keep part of it longer.

Under the DPDP Act you can:

• Get a summary of the personal data we hold about you and how it is used.
• Correct, complete or update it; most of it you can edit yourself in Settings.
• Have it erased, unless we must keep it by law.
• Withdraw consent, which closes your account.
• Nominate someone to exercise these rights if you die or cannot do so.
• Raise a grievance with us, and then with the Data Protection Board of India if you are not satisfied.

Write to support@galla.ca from the email on your account. We will reply within 7 working days and resolve your request within 30 days. If you are a customer of a business that uses Galla Ai, please contact that business first; we will help them answer you.

We use one essential cookie to keep you signed in. We use no advertising or analytics cookies. The mobile app keeps your sign-in in the phone's secure storage.

Galla Ai is for businesses and professionals. You must be 18 or older to create an account, and we do not knowingly collect children's data.

If we change this policy in a way that matters, we will email account owners and show a notice in the app at least 15 days before it takes effect. The date at the top shows the latest version.

For any question, request or complaint about your data, write to our Grievance Officer at support@galla.ca. We acknowledge every grievance within 48 hours and resolve it within 30 days.