Veritally Privacy Notice
Last updated: 25 October 2026
This notice explains what personal data Veritally collects, why, how long we keep it, who we share it with, and the rights you have. It is written for the Digital Personal Data Protection Act, 2023 ("DPDP Act"), the Digital Personal Data Protection Rules, 2025 ("DPDP Rules") and the Information Technology Act, 2000 and its rules.
Who is responsible for your data (the "Data Fiduciary"): TruePayout, Bengaluru (Urban), Karnataka, India (postal address for legal notices on request at [email protected]) ("Veritally", "we", "us").
Questions or complaints about your data: Aloka Kiran, Grievance Officer and data protection contact, [email protected], +91 96065 74521. See section 12.
This notice is available in English. Choose your language from the language menu.
1. The short version
- You download your own reports and bank statement and upload them. Your original files never leave your device.
- Your browser keeps only the columns we need (order IDs, SKUs, dates, statuses, amounts, transaction references). It does not read customer names, addresses or phone numbers. From bank statements it keeps only the date, the amount and reference numbers (such as UTRs). It drops names, UPI IDs, phone numbers and IFSC codes; a reference number in your bank narration can include an account number, so please do not upload statements of accounts that are not yours.
- That reduced data is sent to our server in Mumbai, India, encrypted, and checked there. The reduced rows themselves are not stored. We keep the check result (order numbers, amounts, dates, payouts and the differences found) so you can come back to it and track claims, until you delete it.
- We never log in to your marketplace or bank account. We never see your card or UPI details.
- No advertising cookies. Google Analytics runs only if you allow it, and never receives anything from your reports. We do not sell your data.
- AI help is optional and never sees your report values. When you use it, the AI provider receives only: the column names and the kind of data in each column of a report we couldn't read; descriptions of your result without amounts or order numbers; charge names; or a question you type (emails, phone numbers and long numbers are removed first). Amounts and order numbers are filled in on your device.
- You can withdraw consent, download, correct or delete your data at any time.
2. What data we collect
2.1 Account data
| Data | When we collect it |
|---|---|
| Email address | Always, to create your account |
| Name | From your Google account when you sign in (Google shares your name and email address) |
| Google account identifier | From Google sign-in, to recognise your account |
| Language preference | When you choose a language |
| Phone or WhatsApp number | Only if you choose to give it |
| Business name, address, GSTIN | Only if you add them for your invoice |
2.2 Data from your reports (reduced data)
Your browser reads your marketplace reports and bank statement on your device and keeps only these fields:
- Marketplace reports: order and sub-order IDs, SKU, dates, order and return statuses, amounts (sale price, fees, deductions, settlement amounts), and transaction or UTR references.
- Bank statement: only the transaction date, the amount, and reference tokens that contain digits (such as UTR or transaction numbers). Names and descriptions without digits are dropped.
We do not read customer names, addresses or phone numbers in your reports, and we never receive your original files.
Your reports belong to your business, but they can still be personal data, especially if you are a sole proprietor. Bank transaction data is financial information, which we treat as sensitive.
Your buyers' data. Order numbers in your reports relate to your buyers. For that data you decide why it is processed, and we act only on your instructions as your data processor: we use it only to run your checks, keep it secure, delete it when you ask, and tell you without delay if a breach affects it.
2.3 Results we create and store
- the checks you ran and when;
- differences found and how strong the evidence is;
- payout explanations;
- suggested claim text, the claims you mark as filed, and their status;
- notes you add;
- return desk records you save: the order or sub-order number, AWB number, date received, outcome, value and your note.
Return desk videos and label PDFs never leave your device. The unboxing video you record and the barcode you scan are processed by your browser and saved only on your phone. The label cropper works on your PDF in your browser and never uploads it. Share a video only with the marketplace, when you file a claim.
These results can contain order IDs, SKUs, dates, amounts and references taken from the reduced data.
2.4 Payment and invoice data
- Razorpay payment ID, order ID, amount, status, date and payment method type (for example "UPI" or "card").
- Invoice records: your name, email, address and GSTIN (if you give them), what you bought and the amount.
- Billing records: the checks you paid for and what each price was made of (number of new orders, amount, the month's total), any Growth, Pro or Seller plan months you bought, and for each order you have paid for a one-way code (a hash) made from the marketplace, seller account and order number. The code lets us charge for each order only once; it cannot be turned back into the order number. It is deleted with your account, except that payment and invoice records are kept as the law requires.
We never see or store your full card number, CVV, UPI PIN or net banking login. Razorpay collects these directly.
2.5 Technical and security data
- IP address, browser and device type, and time of requests, collected by our hosting provider (Cloudflare) and our database provider (Supabase).
- Bot-check signals from Cloudflare Turnstile, used only to stop automated abuse.
- Sign-in and security logs (for example, sign-in times and failed attempts).
- Product use: when you are signed in, which Veritally screens and tools you use and when (for example "opened the return desk", "cropped labels", "unlocked a check"), so we can support you and see which features help sellers. These records never contain your report data, order numbers, files or videos. When you are not signed in, we only count how often each tool is used each day, with nothing that identifies you.
2.6 Support and messages
- Emails or messages you send us, and our replies.
- If you click a WhatsApp chat or share link, WhatsApp is opened on your device. We only see the message if you choose to send it to us.
2.7 Data we do not collect
- Marketplace or bank passwords.
- Your original report or bank statement files.
- Customer names, addresses or phone numbers from your reports.
- Advertising identifiers or advertising cookies.
3. Why we use your data, and our legal basis
| Purpose | Data used | Legal basis |
|---|---|---|
| Create and run your account, sign you in | Account data, security data | Your consent at sign-up |
| Check your reports, find differences, explain payouts, prepare claim text | Reduced data from reports | Your consent at first upload (separate pop-up) |
| Save your results and claims so you can return to them | Results, notes | Your consent at first upload |
| Run the check on our server (and not only in your browser) so results cannot be altered, your claims are saved safely, and bigger files can be checked | Reduced data | Your consent at first upload |
| Take payment, send invoices, keep tax records | Payment and invoice data | Your consent when you pay; keeping invoices for the legally required period is required by tax law (DPDP Act section 8(7) allows retention needed to comply with law) |
| Send service emails (sign-in links, receipts, important changes, security alerts) | Needed to provide the service you asked for (consent at sign-up / legitimate use under DPDP Act section 7(a)) | |
| Answer your support requests and grievances | Support messages, account data | Legitimate use: you gave us the data for this purpose (section 7(a)) |
| Keep the Service secure, stop fraud and bots, meet CERT-In and DPDP log duties | Technical and security data | Compliance with law, and your consent at sign-up |
| Send product news and offers by email or WhatsApp | Email, phone/WhatsApp | Only with your separate, optional consent. Untick it or turn it off any time |
| Respond to lawful requests from courts or authorities | Any relevant data | Compliance with law (DPDP Act section 7(d) and (e)) |
We do not use your data for advertising. We do not sell or rent your data. We do not use your data to make decisions about you that have legal effects.
4. How to withdraw consent
You can withdraw any consent at any time. It is as easy as giving it.
- Marketing: Account > Your privacy choices > untick the email or WhatsApp box. Or click "unsubscribe" in any marketing email, or reply STOP on WhatsApp.
- Report processing and saved results: Account > Your privacy choices > untick "Check my files on Veritally's server". We stop running checks for you and immediately delete your saved checks, findings and claim progress. Download them first if you need them.
- Everything: Account > Delete my account and data.
- By email: write to [email protected] from your account email.
Withdrawing consent does not affect processing done before you withdrew. If you withdraw consent for report processing, we cannot run new checks for you. Records we must keep by law (such as invoices) are kept as explained in section 6.
5. Your rights
Under the DPDP Act you have the right to:
- Access: get a summary of your personal data we hold, what we do with it, and who we have shared it with. You can also download your claim list from any unlocked check (Download list).
- Correction and updating: fix wrong or incomplete data. You can edit most account details yourself.
- Erasure: ask us to delete your data. We will delete it unless the law requires us to keep it.
- Grievance redressal: complain to our Grievance Officer and get a response.
- Nominate: name another person who can use your rights for you if you die or become unable to act. Email us to name a nominee.
How to make a request: Use the in-app options, or email [email protected] with your account email and what you want. We may ask you to confirm it is you, for example by a sign-in link. We do not charge for requests.
Response time: We will acknowledge your request within 24 hours and respond within 30 days. (The DPDP Rules allow up to 90 days; our published period is 30 days.) Complaints are resolved within 7 days, as our Grievance Redressal Policy explains.
Your duties: The DPDP Act also asks you not to give false information, not to impersonate anyone, and not to file false or frivolous complaints.
Complaint to the Data Protection Board of India: If you are not satisfied with our response, you may complain to the Data Protection Board of India through its online portal at https://www.dpb.gov.in, after first using our grievance process.
6. How long we keep your data
| Data | How long |
|---|---|
| Original files | Never received. They stay on your device. |
| Reduced data (rows sent for checking) | Not stored. Used only in memory while the check runs. |
| Check results (order numbers, amounts, dates, payouts, differences found), claims, notes | While your account is open, until you delete them or withdraw consent. |
| Account data | While your account is open. Deleted within 30 days of account deletion. |
| Inactive accounts | Kept until you delete them. If we ever start deleting inactive accounts, we will email you at least 48 hours before. |
| Payment and invoice records | 8 years from the end of the financial year of the payment, as required by tax and company law. Anonymised where possible after account deletion, but kept with your name, address and GSTIN where the law requires. |
| Security and access logs | 1 year, as required by the DPDP Rules, then deleted. |
| Product use records (signed in) | Detailed records 24 hours, then deleted automatically. Daily counts per feature (no detail) for up to 2 years. All deleted with your account. |
| Consent records (what you agreed to and when) | While the consent lasts, plus 3 years to prove consent if challenged. If you delete your account, the record is kept without your account link, under a one-way reference. |
| Support and grievance messages | 3 years after the matter is closed. |
| Marketing consent and contact | Until you withdraw consent. |
| Backups | Deleted data is removed from backups within 35 days as backups roll over. |
| Data on your device (session, language, last result) | Until you sign out or clear your browser storage. |
7. Who we share data with
We share data only with service providers who help us run Veritally. They process it on our instructions under contract, and must keep it secure.
| Provider | What it does | Data it handles | Where |
|---|---|---|---|
| Supabase (on Amazon Web Services) | Database, sign-in, server checks | Account data, reduced data, results, logs | Mumbai, India (AWS ap-south-1) |
| Cloudflare | Website hosting, content delivery, security, Turnstile bot check | Technical data, IP address, website traffic | Global network; may be processed outside India |
| Razorpay | Payment processing | Payment data, name, email, phone if given | India |
| Resend | Sending emails (sign-in links, invoices, notices) | Email address, name, email content | May be processed outside India (including USA) |
| Sign-in with your Google account (name, email address, account identifier); and analytics, only if you allow it (Google Analytics 4) | Pages visited, approximate location, device and browser type, and feature events such as "check completed" or "plan bought". No names, emails, order numbers or report data. IP addresses are not stored by Google Analytics 4. | May be processed outside India | |
| Odoo | Accounting and invoice records | Invoice records | As per Odoo's hosting for our account |
| Anthropic (or Google Gemini, if we switch providers) | Optional AI help: reading a new report layout, plain-language explanations, claim wording, charge names, answers from our guides | Column names and data kinds (never values), result descriptions without amounts or order numbers, charge names, and questions you type. Not used to train AI models; the provider may keep it for a short time for safety checks. | USA; may be processed outside India |
WhatsApp: Today we only use links that open WhatsApp on your device when you click them. If we start sending WhatsApp Business messages, we will ask for your separate consent first, and add WhatsApp (Meta) to this list.
We may also share data:
- with your consent or at your request;
- with courts, police or regulators when the law requires it; and
- with a buyer of our business, who must keep this notice's protections.
We never share your data with Meesho, Amazon or Flipkart. You decide what you send them.
8. Data outside India
Your reports, results and account are stored in India. Some providers (Cloudflare, Resend, Google, and the AI provider when you use AI help) may process limited data, mainly your email address and technical data, outside India. The DPDP Act allows this unless the Government restricts transfers to a specific country. We will follow any such restriction.
9. How we protect your data
- Files are filtered on your device, so less data leaves it.
- Data is encrypted in transit (HTTPS/TLS) and encrypted at rest by our database provider.
- Each account can only read its own data (database access rules).
- Staff access is limited to what is needed, protected by multi-factor authentication, and logged. These access logs are kept for one year.
- We record what you consented to and when, so we can prove it.
- We keep security logs, monitor for misuse and keep backups.
- Our providers are bound by contract to keep data secure.
No system is completely secure, but we work to meet the "reasonable security safeguards" required by the DPDP Act and Rules.
10. If there is a data breach
If a personal data breach affects you, we will tell you without delay, by email or in the app, in plain language. We will say what happened, when, what data was involved, the likely impact, what we are doing about it, what you can do to protect yourself, and who to contact.
We will also report the breach to the Data Protection Board of India (with a detailed report within 72 hours) and, where required, to CERT-In within 6 hours of noticing it.
11. Cookies and storage on your device
We only use storage that the Service needs to work:
- Sign-in session: keeps you signed in.
- Language preference: remembers your language.
- Last result: keeps your latest result on your device so it loads quickly.
- Cloudflare security: Turnstile and Cloudflare may set strictly necessary security cookies to stop bots.
- Privacy choice: remembers whether you allowed analytics.
Analytics, only with your consent. If you tap "Allow analytics", we use Google Analytics 4 to count visits and understand which features help sellers (for example, how many people complete a check or buy a plan). It sets the _ga and _ga_<ID> cookies for up to 13 months. Advertising features, Google signals and ad personalisation are switched off, and nothing from your reports is ever sent. If you tap "Essential only", Google Analytics is not loaded at all. You can change your choice at any time with "Privacy settings" at the bottom of every page; withdrawing stops analytics immediately and deletes its cookies.
We do not use advertising cookies, social media pixels or cross-site tracking.
12. Children
Veritally is only for people aged 18 and over. We do not knowingly collect data from children. If you think a child has signed up, email [email protected] and we will delete the account.
13. Grievance Officer and contact
Aloka Kiran Grievance Officer and data protection contact, TruePayout Bengaluru (Urban), Karnataka, India (postal address for legal notices on request at [email protected]) Email: [email protected] Phone: +91 96065 74521 (10 am to 6 pm IST, Monday to Friday, except public holidays)
See our Grievance Redressal Policy for timelines and escalation.
14. Changes to this notice
If we change this notice in a way that matters, we will email you or show a notice in the app before the change applies. If a change needs your fresh consent (for example, a new purpose), we will ask for it and not assume it.