Privacy policy

ArthList (arthlist.in) is operated by Lavish Takkar (“we”, “us”). This policy explains what we collect when you use ArthList and its connector, why, where it is kept, and the choices you have. Questions go to hello@arthlist.in.

• Your account — your name, email address and password, and the details you give us about your organisation and companies. We decide how this is used.
• Your books — the accounting data the connector reads from Tally on your behalf: ledgers, groups, vouchers and their narrations, balances, outstanding bills, and the names of the customers, suppliers and employees that appear in them. You decide what is in your books and why; we process it only to provide ArthList to you. Under India’s Digital Personal Data Protection Act, 2023, you are the data fiduciary for the personal data in your books, and we act as your data processor.

• Account: name and email address; your password, stored only as a one-way bcrypt hash; when you last signed in.
• Companies: what you enter in Settings — name, GSTIN, PAN, industry, financial-year start, and Tally company name.
• Books: the data listed above, plus the raw responses Tally returns, which we keep so your reports can be rebuilt when our processing improves.
• Connector: its access token (stored only as a SHA-256 hash), when it last checked in, and the progress and result of each sync.
• Questions you ask in “Ask your books”.
• Cookies: only the essential ones that keep you signed in and protect forms. We use no advertising cookies and no third-party analytics.

• To sync your books and produce your reports and answers.
• To keep ArthList running, secure and correct — including automated checks that your data synced completely and that your books balance.
• To send account email: address verification and password reset.

We don’t sell your data, don’t use it for advertising, and don’t use your books to train AI models.

• Hosting, database and the emails we send: Microsoft Azure, in its Central India region. Your account and your books are stored in India.
• Emails you send us: messages to hello@arthlist.in or to our grievance officer are held by Hostinger, which hosts those mailboxes and may store them outside India.
• AI features: when you use “Ask your books”, your question and your company’s name are sent to Groq, with what it looks up in your books to compose the answer: figures, and the ledger and party names, voucher numbers and narrations that go with them. Automatic account mapping sends the same provider your company’s name and industry, and the Tally groups it cannot place by itself, each with a few of its ledger names. This processing may take place outside India.

No other third party has access to your data.

For as long as your account is active. When you ask us to delete your account or a company, we delete it — including its synced books and the raw Tally responses — within 30 days, unless the law requires us to keep something. An owner or admin can also delete a company themselves, straight away, in Settings → Company profile: that removes its synced books, the raw Tally responses, its Ask history and its connector tokens. Encrypted database backups expire on their own, at most 35 days later.

• ArthList is served only over HTTPS, and connections to our database are encrypted.
• Azure encrypts the database at rest.
• Passwords are stored only as bcrypt hashes, and connector tokens only as SHA-256 hashes.
• The connector reaches us with outbound HTTPS calls only, so your Tally never has to be reachable from the internet.
• We don’t yet offer two-factor sign-in.

The connector runs on the PC where Tally runs. It reads Tally through Tally’s own local interface and sends what it reads to arthlist.in over HTTPS; it never opens a port for anyone to connect in. On Windows it updates itself from arthlist.in, and every update is checked against a published SHA-256 checksum before it is installed. Run it with -no-auto-update to turn updates off.

You can ask us for a summary of the personal data we hold about you, to correct or complete it, or to erase it; you can raise a grievance; and you can nominate someone to exercise these rights for you if you are unable to. Write to hello@arthlist.in. If someone asks you about their data in your books, we will help you respond.

Lavish Takkar, hello@arthlist.in. If you are not satisfied with our response, you may complain to the Data Protection Board of India.

ArthList is not intended for anyone under 18.

We will post any change here with a new effective date, and email account holders before a material change takes effect.