Privacy Policy

Last Updated: January 16, 2026

1. Introduction

Litiga Tax Counsel ("we," "our," or "us") operates the GSTFlow platform at gstflow.cloud. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our VAT compliance SaaS platform.

By using GSTFlow, you agree to the collection and use of information in accordance with this policy. If you do not agree with our policies and practices, please do not use our services.

2. Business Information

GSTFlow (gstflow.cloud) is operated by:

Litiga Tax Counsel (Sole Proprietor)

Owner: Bilal H. Zaidi
Address: B201, Zum Zum Terrace, Block 4, Gulshan Iqbal, 75300, Karachi.
WhatsApp: 0300 8231043
Email: support@gstflow.cloud

3. Information We Collect

3.1 Information You Provide to Us

We collect information that you voluntarily provide when using our services:

Account Information: Name, email address, password, company name
Organization Data: Tax Registration Number (TRN), business address, emirate, license number
Transaction Data: Sales, purchases, VAT calculations, supply categories
Financial Information: Payment details processed through Lemon Squeezy or PayFast (we do not store full credit card numbers)
Communications: Support requests, feedback, and correspondence

3.2 Information Automatically Collected

When you access our platform, we automatically collect:

Usage Data: IP address, browser type, device information, pages visited, time spent
Session Data: Login times, actions performed, features used
Cookies and Tracking Technologies: Essential cookies for authentication and functionality

3.3 Information from Third Parties

Payment Processors: Lemon Squeezy and PayFast provide transaction completion status
OAuth Providers: If you sign in with Google or Microsoft, we receive your email and name

4. How We Use Your Information

We use your information for the following purposes:

Service Delivery: To provide VAT return preparation, calculation, and compliance features
Account Management: To create, maintain, and secure your account
Compliance: To fulfill UAE Federal Tax Authority (FTA) requirements
Billing: To process payments through Lemon Squeezy and/or PayFast
Communications: To send service updates, security alerts, and support responses
Analytics: To improve our platform performance and user experience
Legal Obligations: To comply with applicable laws and regulations

5. Data Retention

We retain your data in accordance with:

Active Accounts: Data is retained while your account is active
UAE VAT Law: Transaction records and VAT returns are retained for 5 years as required by UAE Federal Tax Authority
Audit Logs: Security and compliance logs are retained for 1-5 years based on your subscription tier
Deleted Accounts: After account deletion, we retain data necessary for legal compliance (5 years), then permanently delete

6. Data Sharing and Disclosure

We do not sell your personal information. We may share your data only in these circumstances:

6.1 Service Providers

Lemon Squeezy: Payment processing (international customers)
PayFast: Payment processing (Pakistan-based customers)
Cloud Infrastructure: Secure hosting providers (AWS, Vercel, Supabase)
Email Services: Transactional email delivery

6.2 Legal Requirements

UAE Federal Tax Authority: If legally compelled by tax audit or investigation
Law Enforcement: In response to valid legal requests
Legal Claims: To defend against legal claims or protect rights

6.3 Business Transfers

In the event of a merger, acquisition, or sale of assets, your information may be transferred with proper notice.

7. Data Security

We implement industry-standard security measures:

Encryption: AES-256 encryption for data at rest, TLS 1.3 for data in transit
Access Controls: Role-based access control (RBAC) and multi-factor authentication (2FA)
Infrastructure: Secure cloud providers
Monitoring: Security monitoring and logging
Backups: Regular encrypted backups

Despite our safeguards, no internet transmission is 100% secure. You are responsible for maintaining the confidentiality of your account credentials.

8. Your Data Rights

You have the right to:

Access: Request a copy of your personal data
Correction: Update inaccurate or incomplete information
Deletion: Request deletion of your account (subject to 5-year UAE VAT retention requirements)
Export: Download your data in machine-readable format (CSV, JSON)
Objection: Object to processing for marketing purposes

To exercise these rights, contact us at support@gstflow.cloud or via WhatsApp at 0300 8231043.

9. Cookies and Tracking

We use the following types of cookies:

Essential Cookies: Required for authentication and security (cannot be disabled)
Functional Cookies: Remember your preferences and settings
Analytics Cookies: Aggregate usage statistics (anonymous)

You can manage cookie preferences in your browser settings.

10. Third-Party Links

Our platform may contain links to third-party websites (FTA portal, documentation). We are not responsible for the privacy practices of external sites.

11. Children's Privacy

GSTFlow is a business-to-business (B2B) service. We do not knowingly collect information from individuals under 18 years of age.

12. International Data Transfers

Your data is primarily stored in secure cloud data centers. If transferred internationally, we ensure adequate protections through:

Standard Contractual Clauses (SCCs)
Data Processing Agreements (DPAs)
GDPR-compliant safeguards

13. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of material changes via:

Email notification to your registered address
In-app notification upon login
"Last Updated" date at the top of this policy

Continued use after changes constitutes acceptance of the updated policy.

14. Contact Us

For privacy-related questions or requests, contact:

Litiga Tax Counsel

Owner: Bilal H. Zaidi
Address: B201, Zum Zum Terrace, Block 4, Gulshan Iqbal, 75300, Karachi.
Email: support@gstflow.cloud
WhatsApp: 0300 8231043
Website: gstflow.cloud