Privacy Policy

gstinapi.in ("we", "us", "our") operates an API platform that provides real-time GSTIN (Goods and Services Tax Identification Number) verification for Indian businesses and developers. This Privacy Policy explains what information we collect, how we use it, and the choices you have.

By registering for or using gstinapi.in, you agree to the practices described in this policy. If you do not agree, please do not use the service.

We are committed to protecting your personal information and your right to privacy. We do not sell, trade, or rent your personal data to third parties.

Account information — When you register, we collect your name, email address and mobile number, and optionally your company name. This is used to create and manage your account.

Sign in with Google — If you choose “Continue with Google”, Google shares your name, email address, whether Google has verified that address, and a Google account identifier with us. We store your name, email address and that identifier to sign you in; we do not receive your Google password and do not access your Gmail, contacts or any other Google data.

Authentication credentials — Passwords are stored as one-way bcrypt hashes. We never store plaintext passwords and cannot retrieve them.

API keys — We generate and store API keys that let you access the GSTIN lookup API. Keys are stored securely and can be revoked at any time from your dashboard.

Usage logs — Each GSTIN API call is logged with a timestamp, the calling IP address, the queried GSTIN, the HTTP status returned, and whether a credit was deducted. Logs are retained for 90 days and used for billing, debugging, and abuse prevention.

Payment information — Credit pack purchases are processed through Razorpay. We do not receive or store your card details. We receive a Razorpay order ID and payment status to credit your account.

Technical data — Server logs may capture your IP address, browser user-agent, and request timestamps. This data is used for rate limiting, security monitoring, and performance analytics.

• To create and authenticate your account
• To process credit pack purchases and maintain your credit balance
• To provide GSTIN verification API access and deduct credits per successful lookup
• To send transactional emails (account confirmation, payment receipts, low-credit alerts)
• To enforce rate limits and prevent abuse of the API
• To diagnose technical issues and improve service reliability
• To respond to your support requests

We do not use your data for advertising or share it with marketing platforms.

When you call our API with a GSTIN, we forward that GSTIN to India's official GSP (GST Suvidha Provider) network to retrieve business registration details in real time.

We do not store the GSTIN response data (business name, address, status, etc.) beyond what is necessary for your usage log entry (which records only the GSTIN queried, the HTTP status, and the timestamp — not the full response payload).

The GSTIN data returned to you is sourced from India's official e-Invoice GSP infrastructure. We act as a pass-through API layer; we do not cache or re-sell the GSTIN response data.

Contact lookups are the one exception. The Contact option of the Bulk GSTIN Check returns the mobile number and email registered against a GSTIN, sourced from a third-party verification provider rather than the GSP network. We keep each answer for up to 180 days (30 days when nothing was on record) so that a repeated lookup of the same GSTIN does not have to be bought from the provider again. This stored copy is used only to answer Contact lookups by our own signed-in customers; it is not sold, shared or used for marketing, and it is refreshed from the provider when it expires.

PAN verification is never stored. The PAN verification API returns the name registered against a PAN and, at the higher levels you choose, the date of birth, holder category, whether an Aadhaar is linked, and address details, sourced from a third-party verification provider. These answers are passed back to you and are not cached or kept beyond a usage log that records the PAN, the status and the time. You are responsible for having the right to verify the PAN you submit. The Aadhaar number is never returned.

We do not sell, rent, or trade your personal information. We share data only in these limited circumstances:

• GSP network (GSTIN lookups): Each lookup query is forwarded to India's official e-Invoice GSP infrastructure as required to complete your request.
• Contact lookup provider (Bulk GSTIN Check, Contact option only): The GSTIN you ask about is forwarded to a third-party verification provider to retrieve the registered mobile number and email. Nothing about your account is sent with it.
• PAN verification provider (PAN verification API only): The PAN you ask about is forwarded to a third-party verification provider to retrieve the registered name and the other details you request. Nothing about your account is sent with it.
• Razorpay (payments): Your payment information is handled by Razorpay in accordance with their privacy policy at razorpay.com/privacy.
• Legal requirements: We may disclose information if required by law, court order, or to protect the rights and safety of our users or the public.

• All data is transmitted over TLS/HTTPS — no unencrypted connections are accepted
• Passwords are stored as bcrypt hashes (never plaintext)
• API keys are scoped to your account and shown only in your dashboard when you're logged in — treat a key like a password, and delete and regenerate it if you think it's been exposed
• JWT authentication tokens have short expiry windows
• Rate limiting is enforced per IP and per API key to prevent abuse
• The server firewall allows only HTTPS (443) and SSH traffic

Despite these measures, no system is completely secure. If you suspect a security issue, contact us immediately at help@gstinapi.in.

• Account data — retained while your account is active. Deleted within 30 days of an account deletion request.
• Usage logs — retained for 90 days, then purged automatically.
• Payment records — retained for 7 years as required by Indian tax regulations.
• GSTIN response payloads — not stored (only the queried GSTIN and status are logged, not the response body).

You have the right to:

• Access — Request a copy of the personal data we hold about you
• Correction — Update incorrect information via your dashboard Profile page
• Deletion — Request deletion of your account and associated data
• Portability — Receive your usage logs in a machine-readable format on request

To exercise any of these rights, email us at help@gstinapi.in. We will respond within 30 days.

This section explains how gstinapi.in aligns with India's Digital Personal Data Protection Act, 2023 ("DPDP Act"). Where you use gstinapi.in as a business — for example, to verify the GSTIN of a vendor, seller, or customer as part of your own onboarding or compliance process — you (the "Data Fiduciary") determine why that verification is being done, and gstinapi.in acts as a Data Processor, processing data only on your instructions and for that stated purpose.

Lawful basis and purpose limitation — We process account data (Section 2) based on your consent when you register, and GSTIN lookup requests based on the instruction you give us with each API call. We do not process either for any purpose beyond operating the service, billing, and the security/abuse-prevention uses described in Section 3.

Data minimisation — As described in Section 4, we do not store the GSTIN response payload itself (business name, address, registration status, and similar business registration details) beyond your usage log entry, which records only the GSTIN queried, the HTTP status, and the timestamp.

Data Principal rights — Section 8 above (Access, Correction, Deletion, Portability) reflects the rights the DPDP Act gives individuals over their personal data. Requests are handled at help@gstinapi.in.

Security safeguards — Section 6 (TLS-only transport, bcrypt password hashing, account-scoped API keys, rate limiting) reflects the "reasonable security safeguards" the DPDP Act requires to prevent a personal data breach.

Breach notification — In the event of a personal data breach, we will notify affected users and, where required, the Data Protection Board of India, without undue delay, consistent with the DPDP Act's requirements.

Grievance Officer — For any grievance regarding the processing of your personal data, contact our Grievance Officer at help@gstinapi.in. We aim to acknowledge grievances within 7 days and resolve them within 30 days.

Data Processing Agreement — If your organisation requires a signed Data Processing Agreement to use gstinapi.in as part of your own DPDP compliance, contact us at help@gstinapi.in and we will provide one for review.

gstinapi.in uses minimal cookies. We set a session cookie to maintain your login state in the web dashboard. We do not use tracking cookies, advertising cookies, or third-party analytics platforms (e.g., Google Analytics).

gstinapi.in is intended for business use and is not directed at individuals under the age of 18. We do not knowingly collect personal information from minors.

We may update this Privacy Policy from time to time. When we do, we will revise the "Effective date" at the top of this page. Continued use of gstinapi.in after changes are posted constitutes acceptance of the updated policy.

For privacy-related questions or to exercise your rights, reach us at: