Last updated on July 27, 2026
At Variabl Financial Technologies Private Limited, which we'll refer to as "Variabl" for brevity, we hold a strong commitment to safeguarding personal information that pertains to our clients and other individuals. Our dedication extends to full compliance with the Information Technology Act, 2000, and any associated amendments, as well as all other pertinent laws in effect within India. Our highest priority is nurturing the trust and relationships we have with our clients.
This privacy policy serves as a comprehensive document delineating Variabl's procedures for collecting and sharing personal information. It specifically pertains to the data we gather and employ for the management of various income tax policies and for providing services to our clients. These services encompass, but are not restricted to, tasks such as tax preparation, tax planning, tax scrutiny, addressing tax queries, delivering financial planning advisory services within the Indian context, and providing cross-border collection through International Accounts.
This Policy is divided into two parts:
The Contacting Us, Changes, Miscellaneous and Governing Law sections at the end apply to all Services.
This privacy policy is relevant to a range of individuals and entities, including but not limited to the following:
For the sake of brevity, we'll collectively refer to all of these categories as "you." This policy applies to all aspects of our website, app, and the various products and services we provide.
This privacy policy explains our privacy-related protocols and encompasses: the information we may collect about you; why we collect it; how we may use it; the role of consent; the circumstances under which we may share it; our approach to the transmission, storage and security of your information; how long we retain it; your rights; how to contact our Grievance Officer; changes to this policy; our use of cookies; and other miscellaneous matters. It also sets out, in Part B, the additional data-handling terms that apply to International Accounts.
We may gather and process the following personal information about you:
We may retrieve your information and records available with third-party providers including but not limited to credit score and liabilities information or information from the KYC Registration Agency, Goods and Services Tax Network ("GSTN") and National Informatics Centre, such as name, KYC details, KYC status, father's name, occupation, address details and related documents. You hereby authorise the Company to download and retrieve any information from governmental and other statutory bodies including but not limited to GSTN and NIC.
We may collect Aadhaar details in accordance with Section 139AA of the Income Tax Act. In case you are required to provide your Aadhaar details to us during account creation, you acknowledge and agree that the act of providing your Aadhaar details to us is voluntary. We require Aadhaar details solely for the purpose of carrying out KYC and for filing of ITRs and GST Returns.
We may process your personal information for specific legitimate or lawful purposes, including but not limited to the following:
We do not sell or share your personal or financial information to anyone. However, notwithstanding anything contained in this Policy, you expressly acknowledge, consent and agree to the following terms on information use and further authorise us to access and use your information in the manner set out below:
Your consent to the processing of your personal information for specific purposes may be obligatory to comply with the Information Technology Act, 2000, along with all its amendments, and other relevant laws in effect in India. In cases where your consent is required in accordance with these laws, we will request your consent. You retain the right to withdraw your consent for such processing at any time.
From the moment you visit our website and engage with its content, it will be considered that you have granted your consent to abide by the privacy policies of Variabl.
There may be instances when you receive a seemingly legitimate-looking e-mail asking for your personal information, such as your credit card details, bank account details, one-time passwords, or contact information. The Company will never ask for such information from you via e-mail.
Such activities are usually carried on by unauthorized individuals and are illegal in nature. They are called phishing or identity theft. In case of any suspicion of such activity, or on receiving such an e-mail you are certain was not sent by us, we advise you not to respond to it and to take whatever action you see fit.
We are dedicated to upholding non-disclosure standards and all related agreements. While we are committed to ensuring the safety and security of websites linked to us, we do not exercise control over third-party websites. Variabl may access and/or share your personal information with:
Variabl Financial Technologies Private Limited may share information with its affiliated entities, including but not limited to Variabl Investment Advisers Private Limited and associated affiliate offices as permitted by law. We may provide your personal data to our group companies solely for the purposes delineated in this privacy policy. Access to personal information within Variabl and our affiliates is restricted to individuals who require access for our business operations. Your personal information will not be sold or shared with unauthorized third parties for their own commercial use without your explicit consent.
Our platform enables you to share your financial information with Chartered Accountants, tax professionals, and other authorized financial advisors for the purposes of income tax filing, GST return preparation, tax advisory, audit support, and related compliance services.
All Chartered Accountants and financial professionals who access your data through our platform are bound by their own professional confidentiality obligations and applicable laws governing their practice. We recommend you only grant access to professionals you trust and with whom you have a legitimate working relationship.
In compliance with applicable laws, Variabl may disclose your personal information to service providers, including but not limited to KYC validating agencies and other related entities. This disclosure may encompass your KYC details, such as KYC status validation, KYC documentation status, Aadhaar authentication, PAN validity checks, and retrieval of your KYC details. Additionally, your information may be shared with your bank for the creation of an automated financial profile and with various tax departments for accessing your Form 26AS. This sharing is done to automate various data elements that you would otherwise need to manually input.
Where permissible under applicable law, Variabl may reveal your personal information to service providers who perform business functions on our behalf, regardless of their location within or outside India. These third-party service providers may utilize information about your website visits, excluding personally identifiable information, to display advertisements for goods and services that may interest you, using industry-standard technology such as pixel tags. These service providers are contractually bound to use your personal information appropriately and lawfully.
If Variabl Financial Technologies Private Limited transfers its rights, interests, or claims in any part of its business or assets, certain client information may be included in such transfers. In such cases, Variabl will provide notification.
Variabl may disclose your personal information to third parties, including courts of law and law enforcement agencies, in connection with investigations, proceedings, or inquiries, regardless of their location. This disclosure may also be made to facilitate compliance with regulatory requirements or dialogues with law enforcement agencies for the prevention, detection, investigation, prosecution, and punishment of cybercrime incidents or offenses. Variabl will only proceed with such disclosures if government agencies ensure the information obtained will not be published or shared with other parties. Aggregate information that does not reveal individual identities may also be disclosed.
To deliver our services, we work with a limited number of trusted third-party processors. All of them are bound by data processing agreements and handle data in accordance with industry security standards and applicable data protection laws:
| Purpose | Data Shared | Location |
|---|---|---|
| Cloud hosting, database, and file storage infrastructure | All customer data (encrypted at rest) | India |
| AI-powered invoice extraction and document processing | Invoice document content, client names, and GSTIN for matching purposes. We do not share PAN, bank account details, or personal identification documents. Our AI provider does not use this data to train its models. | India |
| User authentication and account management | Email, name, authentication tokens | United States |
| Transactional email delivery | Recipient email addresses and email content | India |
| SMS and OTP delivery | Phone numbers and OTP codes | India |
| Product analytics and usage monitoring | Usage data, page views, feature interactions, and limited account identifiers (such as email and name) used to understand user behaviour and improve the platform | European Union |
We do not sell, rent, or trade your personal information to any third party for marketing purposes. All processors above are bound by data processing agreements that comply with the Digital Personal Data Protection Act, 2023. If you use an International Account, additional recipients and cross-border transfers apply (see Part B).
Variabl is dedicated to safeguarding your personal data with the utmost care, diligence, and the latest technological advancements to prevent unauthorized access. We maintain physical, electronic, and procedural safeguards that are commercially reasonable to protect your personal information in accordance with the Information Technology Act, 2000, along with its amendments and other pertinent laws in force in India.
All customer data is stored on servers located in India (Mumbai region) on Google Cloud Platform. Access to this data is subject to our established security policies and standards. We implement the following technical and operational security measures to protect your personal information from loss, misuse, alteration, or destruction:
We require third parties to whom we disclose your personal data to have appropriate technical and organizational measures in place to safeguard your personal information.
If we have provided you with a password, or if you have chosen one to access specific parts of our website or any other portal we operate, it is your responsibility to keep this password confidential and adhere to any other security procedures we communicate to you. We kindly request that you do not share your password with anyone.
Your primary data, including your account information, client records, invoices, uploaded documents, and AI-processed content, is stored and processed on servers located in India.
A limited set of ancillary data is processed by service providers outside India: authentication services are hosted in the United States, and product analytics are hosted in the European Union. All cross-border data transfers are governed by data processing agreements and comply with the Digital Personal Data Protection Act, 2023. Additional data-residency and cross-border processing terms for International Accounts are set out in Part B.
We use an enterprise AI service, hosted in India, to provide automated features that help you work more efficiently. These features include extracting invoice data from uploaded PDF documents, suggesting client matches based on invoice content, and assisting with tax and GST-related queries.
Our AI provider operates under a data processing agreement that ensures your data is not used to train AI models and is processed within India. You may opt out of AI-powered features at any time by contacting our Grievance Officer.
We will retain your personal information for a duration that is reasonably necessary for the purposes outlined in this privacy policy. This retention period may entail keeping your personal information for an extended period when there is a potential need related to reviews conducted by agencies or for advisory services. Additionally, we may be obligated to retain your information to comply with tax, accounting, regulatory, or legal requirements.
To govern our data retention practices, we maintain a comprehensive data retention policy that is applied to all data within our care. When your personal information is no longer necessary, we will ensure its secure deletion.
The Information Technology Act, 2000, along with its subsequent amendments, and the Digital Personal Data Protection Act, 2023, bestow upon you certain rights concerning the personal information we hold about you. These rights include:
In specific situations, we may need to restrict your rights to uphold the public interest, for example, in the prevention or detection of crime.
To make any of the above requests, please use the forms below or contact our Grievance Officer directly:
We will respond to all such requests within 30 days. Please note that certain financial records may be retained for up to 8 years as required by the Income Tax Act, 1961, even after account closure. Such retained data is anonymized where possible.
We make no representation as to providing or storing back-up copies of any information submitted to us. You shall be solely responsible to ensure that you maintain back-up copies of such information, and in the event of any malfunctioning or failing of the Platform for any reason whatsoever (including on account of maintenance), you may be required to resubmit such information.
We take our responsibility to protect your personal information seriously. In the unlikely event of a data breach affecting your personal information, we will:
We maintain an internal incident response plan and conduct regular security reviews to minimize the risk of data breaches.
When payment information is being transmitted on or through the Platform, it will be protected by encryption technology of third-party payment services providers, including payment gateways. You agree, acknowledge and consent to such sharing of your information with third-party service providers to process payments and manage your payment-related information. The Company does not guarantee that transmissions of your payment-related information or other information will always be secure.
GSTN shall have the sole right and discretion, without any liability of the Company, to accept/reject any User's data from being transmitted to the GST system from our Platform, including but not limited to in case of security breach, data traffic beyond that prescribed by GSTN, suspected payload (having virus and/or malware), transfer of corrupt data, or any other reasons as mandated by GSTN.
Our services are not intended for individuals under 18 years of age. We do not knowingly collect personal information from minors.
Our website employs cookies. These internet cookies enable us to tailor our website for you by depositing small files on your computer as you explore various segments of https://www.variabl.in/.
Through the use of cookies, we can display content that aligns with your interests on specific pages or facilitate your access to your account information. Like many standard website servers, Variabl utilizes log files, which might contain internet protocol (IP) addresses, browser types, internet service providers (ISPs), referring/exiting pages, platform types, and more.
At Variabl, we offer calculators and other tools that do not require registration. Casual visitors to the website are bound by the present Privacy Policy. We may gather non-identifiable data from such tools, such as the number of people using a particular tool.
We employ cookies and other technologies, like pixel tags and clear gifs, to store certain types of information each time you visit a page on our website. Cookies enable this website to recognize the information you have willingly provided and help us determine the website segments most relevant to your professional needs. We may also use cookies to serve advertising banners. These cookies do not contain personal information. To confirm that robots or Artificial Intelligence (AI) are not visiting the website, we may utilize Captcha or pictures.
Whether your web browser should accept cookies is at your discretion. If you haven't adjusted your computer's settings, your browser likely already accepts cookies. Opting to decline cookies may limit your ability to fully access all of the website's features. You can also delete or entirely disable your browser's cookies, although this may significantly impact your website experience.
We use a third-party product analytics service, hosted in the European Union, to understand how users interact with our platform and to continuously improve it. This service sets cookies and uses local storage to track page views and feature usage. It may also receive limited account identifiers such as your name and email to help us understand user behaviour across sessions. This service is bound by a data processing agreement and does not use your data for any purpose other than providing analytics to us. You can opt out of analytics tracking at any time by contacting our Grievance Officer.
Variabl operates in accordance with the following standards and regulations:
Variabl does not currently hold SOC 2 or ISO 27001 certification in its own name, but we build on infrastructure and processes that meet these standards. We are committed to strengthening our compliance posture as we grow.
The following provisions apply only if you open or use an International Account, a multi-currency collection account that lets you receive export payments for goods or services from parties outside India. They supplement the rest of this Policy; where they conflict with Part A, these provisions prevail for International Accounts. "Payments Partner" means our cross-border payments provider (currently Xflow) and its banking and settlement partners.
Where you provide personal information relating to any other person (including any director, partner, authorised representative or beneficial owner of your business), you are responsible for having obtained all consents necessary for us and the Payments Partner to collect, use, disclose and transfer that information for the purposes described in this Policy.
To settle your export payments, the Payments Partner and its offshore entities (Xflow Payments Inc in the United States and Xflow Payments Canada) process collection and settlement data outside India as part of the cross-border collection they perform for you. That processing is carried out under the Payments Partner's own terms and privacy policy (available at https://docs.xflowpay.com/privacy-policy) and applicable data processing agreements. Any processing of your information by the Payments Partner's banks, financial institutions and other service providers is governed by those parties' own privacy policies.
Certain data we process on the Payments Partner's documented instructions (including phone number, invoice and payment details, purpose codes, balances, and foreign-exchange and payout details) is stored in India and is not transferred outside India. We will not engage a new sub-processor for this data without the Payments Partner's consent, will notify the Payments Partner of any breach affecting it without undue delay, and will handle and delete it in line with the Payments Partner's data-processing terms. This is distinct from data we hold as our own controller, which is governed by the rest of this Policy.
Foreign-exchange, FIRA/eFIRC and related trade records that we hold as our own controller are retained for the period required under FEMA, RBI directions and other applicable law (typically up to 8 years), even after account closure, and are anonymised where possible once no longer required.
By using International Accounts, you consent to us and the Payments Partner conducting sanctions, PEP, adverse-media and fraud screening on you and associated persons, on an ongoing basis, as required to provide the Services and meet legal obligations.
We have appointed a Grievance Officer to oversee the handling of personal information. You can reach out to our Grievance Officer for privacy-related matters (including International Accounts) using the following contact information:
Please be aware that we may alter the content of our website or services, which might lead to changes in our privacy policy. We encourage you to periodically review it to stay informed about how we are utilizing personal information. Changes become effective upon posting the revised Privacy Policy on the Platform.
It is essential to carefully read and understand this privacy policy. It offers insights into the usage of personal information and your rights under the Information Technology Act, 2000, along with its amendments, and the Digital Personal Data Protection Act, 2023.
This website may feature links to other third-party websites. Should you decide to follow a link to any of these third-party websites, please be aware that they maintain their own distinct privacy policies. Consequently, we cannot accept any responsibility or liability for their policies or the handling of your personal information.
Our primary aim is to keep you well-informed about the information we collect and how we employ it to provide you with our services, enhance your financial well-being, manage our operations, and make our services more useful. We remain committed to not selling or sharing your personal information with unauthorized third parties for their own commercial purposes without your explicit consent.
This Policy is governed by all laws applicable within the territory of India. By using the Platform and Services, you agree to the terms of this Policy and consent to the exclusive jurisdiction and venue of courts in Bengaluru, India, in all disputes arising out of or relating to the use of the Platform or this Policy.
© 2026 Variabl Financial Technologies Private Limited.