Privacy Policy

Visbig handles tax filings. That means we hold PANs, income figures and scanned Form 16s, both yours and your clients'. This page says exactly what we collect, who it reaches, how long we keep it, and what you can make us do with it. Where something is not true of us, we say so instead of staying quiet.

Who we are

VISBIG LLP operates Visbig, a compliance workspace for Chartered Accountants, Company Secretaries and tax practitioners in India. Our registered office and contact details are at the bottom of this page.

The two kinds of people in this policy

Almost every privacy question about Visbig turns on which of these you are.

• You, the professional. You hold the account. For your name, email, phone, KYC outcome and billing history we are the data fiduciary (controller). We decide why that data exists.
• Your clients. When you add a client entity or upload their documents, we handle that data on your instructions, as a data processor. You decide what goes in and what comes out. Your engagement with your client, not this policy, governs your side of that relationship.

What we collect

What we deliberately do not store

These are design decisions in the code, not intentions.

• Aadhaar numbers. The number you enter during onboarding is sent to our KYC provider and discarded. We keep only the verification result and a keyed hash, which cannot be reversed into the number.
• Voice recordings. Audio is held in memory for the length of the turn, sent for transcription and dropped. Nothing is written to disk. The transcript is kept, as part of your conversation.
• Your card. Card details are entered on our payment gateway's page and never reach us. We store the gateway's payment reference.

How AI processing works

Visbig is built on models we do not host. To answer a question, read a document or assemble a return, we send the relevant content to the providers listed on our Subprocessors page. That includes uploaded documents and the text of your conversations.

We do not train models on your data. Content is sent to produce the specific answer or draft you asked for, and for no other purpose. We do not sell your data, and we run no advertising.

The assistant drafts. It does not file on its own. A return reaches a portal only after you have reviewed and approved it.

Where your data is stored

In Vienna, Austria. The application, the PostgreSQL database holding your clients and filings, and the session store all run on infrastructure we operate ourselves there. We do not use a managed cloud platform for them.

This is worth stating plainly, because it may not be what you assume of a product built for Indian tax practice: your data and your clients' data leave India. Under the DPDP Act, 2023 a transfer out of India is permitted unless the government restricts the destination country, and it has not restricted any. In practice your data sits under one of the stricter data-protection regimes in the world.

How your data moves

Two journeys, and both cross a border.

1. India to the EU, and it stays there. What you type, upload and save travels from your browser to our servers in the EU, and rests there.
2. The EU outward, while a request is being answered. To produce an answer, read a document or assemble a return, we send the relevant content to an AI provider, most of them in the United States. To verify a PAN or file a return we send those details to our compliance provider in India. Documents are stored with Cloudflare. Each of these is a transfer out of the EEA and rests on the data-protection terms in our contract with that provider, including standard contractual clauses where the provider offers them.

Every provider, what it is used for, what it sees and where it processes, is listed on the Subprocessors page.

We disclose data to no one else, except where the law compels us or where it is needed to establish or defend a legal claim.

How long we keep it

Your rights

You can, at any time:

• Get a copy of everything. Settings, then Security, then Export my data. You get a JSON file with your profile, clients, documents, filings, billing history and audit trail.
• Correct what is wrong. Profile and client details are editable in the app.
• Close your account. Settings, then Security, then Delete account. Your clients are deactivated and every session is signed out immediately.
• Withdraw consent or object. Write to us at [email protected].

Two limits worth knowing before you delete. Records we are required by law to keep, the audit trail and issued tax invoices among them, survive account closure; we cannot lawfully remove them. And because an email address identifies exactly one account, a closed address cannot be used to sign up again without contacting us first.

Requests sent to [email protected] are answered within thirty days. If you are in the EEA or the UK, see Data Protection and GDPR for the additional rights that apply to you.

Security

Traffic is encrypted in transit, documents are stored in encrypted object storage, passwords are hashed, and every query is scoped to the account that owns the row. The detail, including what we have not built yet, is on the Security page.

Children

Visbig is a professional tool and is not directed at anyone under 18. We do not knowingly collect data from children.

Changes

When this policy changes we update the date at the top. If a change materially affects how we handle your data, we will email you before it takes effect.

Words we use

Data-protection law names the same ideas differently in India and in Europe. Both sets appear on these pages, so here is the map.

Contact

Questions, requests and grievances all go to the same place, and a person reads them.