How it works What it extracts Pricing Blog

Tools

GST Invoice to Excel Invoice Generator GST Calculator GSTIN Lookup Bulk GSTIN Verify GSTIN Validator GST Search by PAN HSN Code Lookup GST State Code List Return Due Dates E-Invoice Limit Registration Limit Late Fee Calculator Interest Calculator Set-Off Calculator
Sign in

Privacy Policy

Last Updated: 7 June 2026

GSTExtract is a tool that converts digitally generated GST invoice PDFs into structured Excel format. We are committed to handling your data responsibly and transparently.

1. What Data We Process

When you use GSTExtract, we may process:

  • The GST invoice PDF or image you upload
  • Extracted invoice fields (GSTIN, invoice number, invoice date, total, tax amounts)
  • Your IP address
  • Optional feedback you submit
  • If you sign in: your name, email address, and Google account identifier (via Google Sign-In)
  • If you buy credits: a record of the transaction (pack, amount, status, Razorpay payment reference) — we never see or store your card or bank details
  • Your credit balance and a metadata-only history of your extractions (counts, not invoice contents)

2. What Happens to Your Uploaded Invoice

  • We do not store your invoices. Your uploaded file (PDF or image) is processed to extract the invoice fields, then discarded immediately — we keep no copy.
  • How extraction works: to read invoices accurately across formats, we send your uploaded file to Google's Gemini AI (a third-party processor) which returns the extracted fields. We use Google's paid API tier, under which your data is NOT used to train Google's models. See Section 7 for details.
  • We never use your invoice to "improve" the service, never make it publicly accessible, and never sell or share it (see Section 5).

3. Excel File Handling

The generated Excel file is stored temporarily. It is deleted:

  • Immediately after download, OR
  • Automatically within 1 hour if not downloaded.

4. Learning & Improvement Data

We do not retain your invoices or extracted data to "improve" the service. Your file is processed and discarded; nothing from it is kept for training, testing, or analytics. (There is therefore nothing to opt out of.)

4a. Email Subscriptions (Opt-In)

If you enter your email address in the optional "Get GST workflow tips by email" card on the result page, we store it locally to send you a monthly newsletter with GST workflow tips and product updates.

  • Email collection is strictly opt-in — you must enter your address and click Subscribe.
  • We do not send marketing email unless you opt in.
  • We do not share your email with any third party.
  • You can unsubscribe at any time by replying to the email.
  • Stored alongside your IP address (for abuse prevention) in an append-only file on the server.

5. What We Do NOT Do

  • We do not sell invoice data.
  • We do not share invoice data with third parties.
  • We do not retain your uploaded invoices at all — they are deleted immediately after processing.
  • We do not make your data publicly accessible.
  • We do not use your data for advertising.
  • We do not track you across other websites or services.

6. Cookies

GSTExtract uses two categories of cookies:

Essential cookies — a single session cookie used to maintain session state and protect against cross-site request forgery (CSRF). It does not track you across websites, contains no personal information, and expires when you close your browser.

Analytics cookies — Google Analytics (gtag.js) sets _ga and _gid cookies to measure aggregate, anonymous traffic patterns (pages viewed, referrer, country, device class). We use this to understand which tools and articles are useful and where the product needs work. We do not use these cookies to identify individual users, run advertising, or share data with advertisers. The Google Analytics script is loaded only after your first interaction with the page (or after 10 seconds), so it does not run during the initial pageload.

How to opt out: install the official Google Analytics Opt-out Browser Add-on, enable your browser's "Do Not Track" or "Global Privacy Control" setting, or block third-party cookies for this site. The tool continues to work normally with analytics blocked.

We do not use advertising cookies or any other third-party tracking cookies.

7. Third-Party Services

GSTExtract uses these third-party services:

Google Gemini AI (extraction sub-processor) — to extract the fields from your invoice, the contents of your uploaded file (PDF or image) are sent to Google's Gemini AI via the Google Generative Language API and processed to return the structured fields. We use Google's paid API tier, under which, per Google's terms, your prompts and files are not used to train Google's models. Google processes the data to provide the API response and operates under its own privacy policy and API terms. If you do not want your invoice sent to a third-party AI service, please do not upload it.

Cloudflare — security and performance layer. When you access this service, your requests pass through Cloudflare's network before reaching our servers. Cloudflare may process your IP address, request headers and metadata, and security-related information (for bot and DDoS protection). Cloudflare operates under its own privacy policy.

Google Analytics — aggregate, anonymous traffic measurement as described in Section 6. Operated by Google LLC under its own privacy policy. We do not transmit your uploaded invoice contents or extracted fields to Google Analytics — only standard pageview metadata.

Google Sign-In — if you choose to sign in, we use Google OAuth to authenticate you and receive your name, email, and Google account identifier. We do not receive your Google password. Operated by Google LLC under its own privacy policy.

Razorpay (payments) — if you buy credits, your payment is processed by Razorpay. Your card/UPI/bank details are entered directly into Razorpay's secure checkout and are never sent to or stored by us. We receive only the transaction result (success/failure and a payment reference). Razorpay operates under its own privacy policy.

We do not use any other third-party services that process your invoice data.

7a. Account & Payment Data

If you create an account, we store your name, email, Google identifier, credit balance, a metadata-only record of your extractions (counts and timestamps, not invoice contents), and your payment/transaction history. We use this only to operate your account, provide the service you paid for, support you, and keep the legally required financial records. We do not sell or share this data for marketing.

8. Usage Logs

We maintain append-only usage logs for operational purposes. These logs include:

  • Timestamp
  • IP address
  • Success/failure status
  • Optional feedback

These logs help us monitor system performance and prevent abuse.

9. Security Measures

GSTExtract implements:

  • CSRF protection
  • Daily usage limits (per IP and per account)
  • Strict file validation (PDF/image, magic byte check)
  • UUID-based secure downloads
  • Automatic file cleanup
  • Cloudflare-based infrastructure protection

However, no system can guarantee absolute security.

10. Data Breach Notification

In the unlikely event of a data breach that affects your information, we will:

  • Investigate the incident promptly.
  • Take steps to contain and remediate the breach.
  • Notify affected users via this website within 72 hours of becoming aware of the breach, where feasible.

11. Children's Data

GSTExtract is a business tool intended for use by adults. We do not knowingly collect or process data from individuals under the age of 18. If you believe a minor has used this service, please contact us and we will delete any associated data.

12. Data Retention Summary

Data TypeRetention
Uploaded invoice (PDF/image)Not stored — deleted immediately after processing
Generated ExcelDeleted after download or within 1 hour
Account data (name, email, balance)Kept while your account is active; deleted/anonymized on request (see Section 12a)
Payment & transaction recordsRetained as required by Indian tax/accounting law, in anonymized form after account deletion
Session cookieExpires when browser is closed
Google Analytics cookies (_ga, _gid)_ga expires after 2 years, _gid after 24 hours (set by Google)
Usage logsRetained for operational monitoring

12a. Your Rights & Choices (Digital Personal Data Protection Act, 2023)

As a data principal under India's DPDP Act, 2023, you have the right to:

  • Access the personal data we hold about you.
  • Correct inaccurate or incomplete data.
  • Erase your data and account. On request we delete or anonymize your personal identifiers (name, email, Google ID). Note that payment and transaction records are retained in anonymized form where we are legally required to keep them for tax/accounting purposes.
  • Withdraw consent to optional data uses (such as the email newsletter) at any time.
  • Grievance redressal — raise any concern with our Grievance Officer (below).

The legal basis for processing is your consent (given when you use the service and agree to these terms) and, for account and payment records, the performance of our service and our legal obligations.

13. Your Responsibility

You should:

  • Review extracted values before using them for accounting or tax filing.
  • Avoid uploading documents you are not authorized to share.

14. Grievance Officer & Contact

For any privacy, data-protection, or grievance matter, contact our Grievance Officer, Ritusmoi Kaushik (Proprietor):

See our Contact page for full details. We aim to acknowledge grievances within 2 business days.