Privacy Policy

Triam Innovations Private Limited is the Data Fiduciary for the personal data processed through Triam Accounting, under India’s Digital Personal Data Protection Act, 2023 (DPDP Act).

An important distinction: for the business records you enter — your customers, vendors, employees and their details — you decide what is collected and why. We process it on your instructions to provide the Service. You are responsible for having a lawful basis to give us that data, and for telling the people concerned.

• Account data — name, work email, phone, company name, GSTIN and billing address; and a password hash, or a Google account identifier if you sign in with Google. We never see your Google password.
• Your business data — everything you enter, import or upload: invoices, bills, ledgers, bank transactions, documents, inventory, payroll and the personal data of your own customers, vendors and employees contained in them.
• Usage data — pages visited, actions taken, feature usage, AI requests and their measured cost, and audit-trail entries recording who changed what and when.
• Technical data — IP address, browser and device type, timestamps, and error diagnostics.
• Payment data — handled by Razorpay. We store the transaction reference, amount, status and mandate token. We never receive or store your full card number, CVV or UPI PIN.

• To provide the Service — the contract between us. Without this data there is no product.
• To bill you — subscriptions, metered usage, AI credits, and the statutory invoices that follow.
• To keep it secure — authentication, audit trails, abuse and fraud prevention.
• To support you — answering your questions, which sometimes means looking at your account.
• To meet legal obligations — tax, accounting and lawful requests from authorities.
• To improve the Service — aggregated, de-identified usage patterns only.

We do not sell your data, and we do not use it for advertising or profiling.

When you use Trex, the relevant part of your data — a document, a query, the records needed to answer it — is sent to the AI providers listed below so a response can be generated.

• Your business data is not used to train third-party AI models. We use these providers under terms that exclude training on customer data.
• Only the data needed for a request is sent, not your whole ledger.
• This processing may occur outside India — see section 6.
• We keep a record of each AI request (model, credits, measured cost) for billing and audit.

We share data only with processors who need it to run the Service, each bound by contract to protect it:

We also disclose data where legally compelled, and to a successor entity in a merger or acquisition — in which case this policy continues to apply until you are given notice of any change.

Your ledger, database and uploaded documents are stored in India — DigitalOcean’s Bengaluru (BLR1) region.

Some processing happens outside India: AI requests go to providers in the United States and the European Union, and logging and email delivery may be processed abroad. This is permitted under the DPDP Act; we do not transfer data to any territory restricted by the Central Government.

• While your account is active — for as long as you use the Service.
• After cancellation — 90 days, so you can export or reactivate. Then deleted.
• Financial records — invoices and payment records retained up to 8 years, as Indian tax and company law requires.
• Audit and security logs — up to 12 months.

As a Data Principal you may:

• Access — ask what personal data we hold about you and how it is processed.
• Correct — have inaccurate or incomplete data fixed.
• Erase — have data deleted where it is no longer needed and no law requires us to keep it.
• Nominate — name someone to exercise these rights if you die or become incapacitated.
• Complain — to our Grievance Officer, and then to the Data Protection Board of India.

Write to privacy@triam.ai. We respond within 30 days. We may need to verify your identity first — we will not hand over personal data to someone who merely claims to be you.

If your data is in a Triam account operated by another business — for example you are their customer or employee — that business decides what happens to it, so please contact them. We will help them respond.

• Encryption in transit (TLS) and at rest.
• Each customer’s data is isolated in its own database schema.
• Role-based access control, with an audit trail of who changed what.
• Passwords stored only as salted hashes; short-lived session tokens.
• Internal access limited to staff who need it for support or operations.

No system is perfectly secure. If a breach is likely to affect you, we will notify you and the Data Protection Board as the DPDP Act requires.

We use cookies that are strictly necessary — keeping you signed in, remembering your workspace, and security. We do not use advertising or cross-site tracking cookies. Blocking the necessary ones will stop sign-in working.

Triam Accounting is a business product and is not directed at children. We do not knowingly collect data from anyone under 18 as a user of the Service.

We will post material changes here and notify you by email or in-app before they take effect.

Privacy questions: privacy@triam.ai
Grievance Officer & Data Protection Officer: grievance@triam.ai — see the grievance page.