Privacy Policy — Duly

Last updated: 6 November 2026

Duly ("Duly", "we") is a product of Vismit Creation, India. It is a Chrome extension that helps you track GST return filing status, ledger balances, TDS due dates and downloads for the GSTINs you manage on the Indian GST portal (gst.gov.in). This policy explains what Duly stores, where, and what it never does.

What Duly stores on your computer

Everything Duly works with is kept on your own computer, in Chrome's storage for the extension:

  • company names, PAN, GSTINs, trade and legal names, constitution of business, and the registration status the GST portal reports;
  • return filing status and filing dates, and cash and credit (ITC) ledger balances, as read from the GST portal;
  • the TDS details you enter yourself: TANs, deposit and statement dates, amounts and notes;
  • the GST portal username and, only if you choose to save it, the portal password for each GSTIN. Saved passwords are stored encrypted (AES-256-GCM). You can leave the password blank and type it on the portal yourself;
  • a record of the files Duly downloaded for you, a log of the requests it made to the GST portal, and a health log of whether portal pages answered as expected (no return data, only page names and counts);
  • only if you switch on the "Portal data recorder" in Tools (or run Tools → Test every download): the GST portal's replies seen during that time, kept on your computer for troubleshooting until you clear them.

Your Duly account

Using Duly requires a free Duly account, created the first time you open it. While you are signed in, a copy of your companies, GSTINs, filing status, ledger balances and TDS entries is stored in our database (Supabase, hosted in Mumbai, India), so it follows your account to other computers and to colleagues you invite to your organisation. Your account e-mail and password are handled by Supabase's sign-in service; sign-in and password-reset codes are sent to your e-mail. If you choose Continue with Google, Google tells us only your name, e-mail address and profile picture so we can create or open your account; we never see your Google password and get no access to your Gmail, Drive or other Google data.

Saved GST portal logins are stored encrypted at rest (via PostgreSQL's pgcrypto) under a key specific to your organisation that only the database's own functions can use. They are sent, over an encrypted connection, only to signed-in members of your organisation — never to anyone else, and never into search, analytics or logs. Because the key is held in our database, a forgotten account password can be reset by e-mail with nothing lost; this also means we, as the operator of the database, could technically access those keys. We do not, except where strictly needed to keep the service running or where the law requires it. Removing a member from your organisation cuts their access at once, and the data leaves their computer at its next refresh.

What leaves your computer

Duly makes network requests only to:

  • the GST portal (*.gst.gov.in), as part of your own use of it: the portal's public filing-status search, pages and files from your own logged-in session, and filling your saved login on the official login page;
  • our database (Supabase), while you are signed in, to sync your organisation's data as described above;
  • a small "portal rules" file from our server, a list of field names and button labels that lets us keep Duly working when the GST portal changes its pages. It contains no personal data, nothing about you is sent to fetch it, and it is never executed as code.

There is no advertising, no analytics or tracking, and no sale or sharing of your data with anyone.

What Duly never does

Duly never files, submits, pays or changes anything on the GST portal. It never reads, solves or bypasses a captcha — you type every captcha yourself. It never uses your data for advertising, credit scoring or lending.

Your rights and choices

You can view, correct or delete any company, GSTIN or TDS entry in the app at any time, export a backup (Tools → Download a full backup), and clear the recorder and logs. Deleting your organisation's data from the cloud, or your account, can be requested at support@getduly.in and is done within 30 days. Uninstalling the extension removes everything it stored in Chrome on that computer; the copy in your account stays until you ask us to delete it.

Under the Digital Personal Data Protection Act, 2023 you may ask us what personal data we hold about you, ask us to correct or erase it, and nominate someone to exercise these rights for you. Write to us at the address below; we reply within 30 days.

Security

Data is sent only over encrypted connections. Saved portal passwords are encrypted on your computer and at rest in our database. If a security incident affects your data we will notify you and the authorities as the law requires.

Children

Duly is a business tool and is not meant for anyone under 18.

Changes

If this policy changes we will update the date above and, for significant changes, tell you in the extension before they take effect.

Contact and grievances

Questions, requests or complaints about privacy: support@getduly.in.

Duly is operated by Vismit Creation. It is an independent tool, not affiliated with, endorsed by or connected to the Goods and Services Tax Network (GSTN) or the Government of India.