01
Information We Collect
Business information
- —Company name, type, incorporation stage, and registered address
- —GSTIN, CIN, Udyam/MSME registration, PAN, and DPIIT recognition number
- —Revenue band, sector, employee count, and state of operation
- —Financial and operational data entered manually or extracted from documents you upload
Founder and contact information
- —Founder names, designations, and brief bios
- —Email address and phone number for account management and OTP verification
Documents
- —GST certificates and filings
- —Incorporation certificates, MOA, and AOA
- —Audited financial statements, balance sheets, and ITRs
- —Any other documents you choose to upload to your document vault
Technical and usage data
- —IP address and browser or device information
- —Session data, page views, and usage patterns
- —Cookies and local storage identifiers
- —Google Analytics 4 (GA4) events — used in anonymised, aggregated form to improve the platform
Payment data
- —Transaction IDs, order references, and payment status
- —Card or bank account details are processed and stored exclusively by Razorpay — BenefitStack does not hold this data
02
How We Use Your Data
We use your information to:
- —Assess your eligibility for government schemes, grants, subsidies, and tax benefits
- —Generate personalised reports with ranked recommendations and funding estimates
- —Pre-fill application fields and document checklists to reduce manual entry
- —Verify company details through government-linked KYC data sources (GST, MCA, Udyam)
- —Connect you with verified CA professionals — only with your explicit consent
- —Enable your incubator or accelerator to view your assessment — only where you have accepted their invite
- —Process payments and manage escrow disbursement to CAs
- —Send transactional notifications about your account, cases, and payments
- —Improve platform accuracy through anonymised, aggregated analysis
- —Comply with legal and regulatory obligations
03
AI Processing and Automated Decisions
BenefitStack uses artificial intelligence to:
- —Match your business profile against scheme eligibility criteria across 160+ schemes
- —Extract structured data from documents you upload (OCR parsing and AI field extraction)
- —Score your eligibility probability and estimate potential funding value
- —Detect anomalies or inconsistencies in profile data that may require manual review
These are automated processes. Outputs are probabilistic and may not reflect your actual eligibility or the current state of a scheme.
You can request a human review of any AI-generated output by emailing legal@benefitstack.in. We will respond within 10 business days.
04
Data Sharing
We may share your data with the following parties, under the conditions stated:
Government portals
- —Only during the application process, as required
- —Limited to the specific fields that portal or scheme requires
Verified CA professionals
- —Only with your explicit consent when you purchase a CA-assisted or higher tier
- —Limited to case-relevant documents and profile data
- —CAs are contractually bound to use your data solely for the purposes of your case
Partners and incubators
- —If you registered via an incubator or accelerator invite, that partner has view-only access to your assessment and scheme results
- —Partners cannot access your uploaded documents, payment data, or CA case communications
- —You may withdraw this access at any time by contacting legal@benefitstack.in
Infrastructure and service providers
- —Razorpay — payment processing and escrow management
- —Supabase — database hosting, authentication, and file storage
- —Google Analytics 4 — anonymised usage analytics (no full IP addresses stored)
- —Government KYC APIs — GST Network, MCA21, and Udyam portal for company verification
- —Email delivery providers — transactional notifications and case communications
- —All vendors are bound by confidentiality obligations and data processing agreements
We do not sell, rent, or trade your personal or business data to any third party for marketing or commercial purposes.
05
Data Security
We implement appropriate technical and organisational measures:
- —TLS encryption for all data in transit
- —Encrypted storage for sensitive documents and identity data in the vault
- —Role-based access controls limiting which team members can access your data
- —API-level authentication and authorisation checks on all data endpoints
- —Regular security reviews and vulnerability assessments
No system can guarantee 100% security. If you suspect unauthorised access to your account or data, contact us immediately at legal@benefitstack.in.
06
Data Retention
We retain your data:
- —For as long as your account is active and services are being delivered
- —For up to 7 years where required by Indian accounting, GST, or income tax law
- —Until you request deletion, at which point we purge data not required for legal compliance
- —Document vault files are deleted within 30 days of an accepted deletion request
07
Your Rights
You have the right to:
- —Request a copy of the data we hold about you
- —Request correction of inaccurate or incomplete data
- —Request deletion of your data (subject to legal retention requirements)
- —Withdraw consent for partner or incubator access to your assessment at any time
- —Withdraw consent for CA data access after a case is closed
- —Request human review of any AI-generated eligibility output
- —Lodge a complaint with the relevant data protection authority
To exercise these rights, email: legal@benefitstack.in. We will respond within 30 days.
08
Cookies and Analytics
We use the following:
- —Session cookies — maintain your login state across pages
- —Preference cookies — remember UI settings between visits
- —Google Analytics 4 — page views, events, and aggregated user behaviour; IP addresses are not stored in full; no cross-site tracking
You can control and delete cookies through your browser settings. Session cookies are required for core platform functionality — disabling them will prevent login.
09
Children's Privacy
The platform is not intended for individuals under 18 years of age. We do not knowingly collect data from minors. If you believe we have inadvertently collected such data, please contact us immediately.
10
Changes to This Policy
We may update this policy from time to time. We will notify you of material changes by email or a prominent notice on the platform. Continued use after the effective date constitutes acceptance of the revised policy.
Data controller
Ventuno Technologies (P) Ltd.
Chennai, Tamil Nadu, India
legal@benefitstack.in
legal@benefitstack.in