Last updated: 2026-10-22

This privacy notice explains how Yieldwise Farmtech Private Limited ("we", "us", or "Hyperfiling") processes personal data when you use the Hyperfiling web application, marketing site, or any related service. Yieldwise Farmtech Private Limited is the Data Fiduciary, in the sense of section 2(i) of the Digital Personal Data Protection Act, 2023 (DPDPA), for the account, usage, billing and communications data described below. For personal data in the documents a firm uploads to a workspace, the firm is the Data Fiduciary and we process that data on its behalf as a Data Processor, as the Data Processing Addendum sets out.

1. Categories of personal data we collect

• Account data: name, work email, role (CA / CS / Firm Partner / Other), firm name, password hash.
• Usage data: pages viewed, queries submitted, documents uploaded, timestamps, IP address, user agent, audit log entries.
• Content data: notices, filings, drafts, and other documents that you or your firm choose to upload into a workspace.
• Billing data: business name, GSTIN, billing address, invoice history. Card numbers are processed and held by our payment processor. Hyperfiling does not store them.
• Communications: messages you send through forms, chat, or support channels.
• Records received from YieldWise: where a firm's client is a farmer producer organisation that uses the YieldWise platform, that platform can send the client's records to a Hyperfiling workspace held for that client, which it identifies by the workspace or by the client's PAN or CIN. The records are procurement batches, which name the farmer who supplied the produce and may include the farmer's phone number; grant expenses, which name the vendor paid; statutory due dates; and sales invoices, which may name the buyer and give the buyer's email address and GSTIN. The farmer's name, the vendor's name and the buyer's details are stored in the workspace as content data.

2. Purposes of processing

• Operate the service and answer your queries with cited sources.
• Show a client's records from the YieldWise platform in the workspace held for that client, where that platform sends them.
• Bill the subscription and issue GST-compliant tax invoices.
• Maintain audit logs of authenticated mutations for accountability.
• Detect fraud, abuse, and security incidents.
• Improve product quality through aggregate, de-identified analytics.

3. Lawful basis

Under section 4 of the DPDPA, personal data may be processed only for a lawful purpose for which the Data Principal has given consent, or for certain legitimate uses. Consent must meet the conditions in section 6, and the legitimate uses are those listed in section 7. The Act has no separate ground for performing a contract and no general legitimate-interest ground.

Sections 3 to 17 of the DPDPA, which hold these grounds, the obligations of a Data Fiduciary and the rights of a Data Principal, come into force eighteen months from the publication, in the Gazette of India of 13 November 2025, of the Central Government's commencement notification under section 1(2) of the Act (G.S.R. 843(E)). The one exception among them, section 6(9) on the registration of Consent Managers, comes into force one year from that publication. Section 44(2), which omits section 43A of the Information Technology Act, 2000, comes into force on the same eighteen-month date. The definitions in section 2 are in force now.

For the personal data for which we are the Data Fiduciary, we rely on:

• Your consent for marketing emails, such as our newsletter. You may withdraw it at any time by writing to privacy@hyperfiling.com.
• The legitimate use in section 7(a): processing for the specified purpose for which you have voluntarily provided personal data, such as creating an account, using the service, paying for a subscription or writing to us, unless you tell us that you do not consent to that use.
• The legitimate uses in section 7(d) and 7(e) where a law in force in India obliges us to disclose information to the State or any of its instrumentalities, or where we must comply with a judgment, decree or order.

For personal data in the documents a firm uploads to a workspace, the firm, as the Data Fiduciary, determines the ground on which it is processed.

4. Retention

Account and content data are retained for the life of the workspace. Deleting a workspace removes its records from the database immediately. Copies remain in our backups until those backups are deleted. As a rule, each nightly backup is deleted from our server within 16 days of being made, and the encrypted copy in AWS S3 expires 35 days after it is made and is removed permanently by S3 7 days after that. Copies made by hand before a software deployment, and copies kept for recovery from an incident, are not part of that schedule and may be retained longer. They are held on our server in Mumbai, and some of them also in AWS S3 in the Mumbai region (ap-south-1). We are separately building deletion of the underlying stored files, which is not yet complete, and we would rather say so than imply otherwise. Audit log entries are held in a table that cannot be altered or deleted through the application, so they persist for accountability. Billing records are retained as required by Indian tax law.

5. Recipients and sub-processors

We share personal data with the following recipients, only to the extent required to operate the service. We do not sell personal data.

• Hostinger hosts the server in Mumbai, India, that runs the application and holds the database, uploaded documents and the nightly backups. Hostinger also provides the hyperfiling.com mailboxes, so it receives and stores the email you send us, including privacy, grievance, billing and support requests.
• Amazon Web Services (AWS) provides AWS Bedrock, which generates text when our local model is unavailable, reads the text in uploaded images, and converts research questions and searches into embeddings (section 6), and AWS S3, which holds an encrypted copy of the nightly backups in the Mumbai region (ap-south-1).
• Resend delivers the emails the service sends.
• Razorpay processes subscription payments.
• Vercel hosts this website and serves the pages of the web application.
• Google Fonts supplies the typefaces of the web application. Your browser requests them from Google, which receives your IP address and browser details.
• Plausible Analytics receives details of visits to this website, such as the page viewed and the referring site, to produce aggregate visit statistics.
• The Government of India's open government data platform receives the company names and CINs the service looks up there, such as a name or CIN typed into company search, and returns the company's record.
• The DuckDuckGo and Bing search engines may receive a company name or CIN typed into company search when the government's company data does not find the company (section 6).

6. Where personal data is processed

The application server, the database, uploaded documents and the backups on our server are in Mumbai, India. The encrypted backup copy in AWS S3 is in the Mumbai region (ap-south-1).

Text the service generates with a language model, including research answers, drafts and the analysis of uploaded documents and notices, is generated first by a local language model, Gemma 4 (31B), which runs on computing hardware we operate in Karnataka, India. Our server reaches it over an encrypted SSH tunnel. If that model cannot be reached, times out, returns an error or no answer, or has just failed several times in a row, the request is sent instead to the Claude Sonnet 4.5 model on AWS Bedrock. That request enters AWS in the Mumbai region (ap-south-1), but it uses a global cross-region inference profile, so AWS may process it in another region, inside or outside India.

Text in uploaded images is read by the same model on AWS Bedrock, through the same global inference profile, so an image may be processed outside India. The local model is not used for images. Research questions and searches are converted into embeddings by AWS Bedrock in the Mumbai region (ap-south-1).

A company name or CIN typed into company search is looked up first in our copy of the government's MCA company master data and, if it is not found there, on the Government of India's open government data platform. If neither finds the company, the text typed may be sent to the DuckDuckGo search engine and, if that fails or finds nothing, to Bing, which may process it outside India. The text of a research question is not sent to any search engine.

Resend, Vercel, Google, Plausible Analytics and Hostinger's email service may process the data they receive outside India.

Section 16 of the Digital Personal Data Protection Act, 2023 empowers the Central Government to restrict, by notification, the transfer of personal data to a country or territory outside India that it notifies. Rule 15 of the Digital Personal Data Protection Rules, 2025 permits personal data to be transferred outside India, subject to any requirements the Central Government specifies, by general or special order, for making that data available to a foreign State or to a person or entity under the control of, or an agency of, such a State. Section 16 and rule 15 come into force eighteen months from the publication, in the Gazette of India of 13 November 2025, of the commencement notification (G.S.R. 843(E)) and of the Rules (G.S.R. 846(E)).

7. Your rights

The rights of a Data Principal under sections 11 to 14 of the Digital Personal Data Protection Act, 2023 come into force eighteen months from the publication, in the Gazette of India of 13 November 2025, of the Central Government's commencement notification under section 1(2) of the Act (G.S.R. 843(E)). We do not wait for that date. As a matter of contract, you may ask us today to:

• Access the personal data we hold about you.
• Correct or update inaccurate personal data.
• Erase your personal data, subject to legal retention obligations.
• Raise a grievance with our Grievance Officer (contact below).
• Nominate an individual to exercise these rights on your behalf in the event of your death or incapacity.

8. How to exercise your rights

Email privacy@hyperfiling.com from the email associated with your account. Identify the right you wish to exercise. We will respond within thirty days. We may need to verify your identity before acting on the request.

9. Grievance Officer

The Grievance Officer for Yieldwise Farmtech Private Limited is reachable at grievance@hyperfiling.com. Designation: Grievance Officer, Hyperfiling.

10. MCA Sync Companion browser extension

The MCA Sync Companion is an optional Chrome extension that copies company details from an MCA21 V3 page you are viewing into the Hyperfiling client workspace for that company. This section describes version 1.0.5. The extension runs only on pages under mca.gov.in, where it adds a small "Sync with Hyperfiling" button to the corner of the page. It reads the page in front of you only when you click that button, which shows you what it read and sends nothing, or when you open its popup. If an MCA tab was opened before the extension was installed or updated, the popup loads the extension's own page-reading script into that tab, and no other code.

• What it reads: six MCA21 V3 pages. From each it reads the name and CIN or LLPIN of the company or LLP the records belong to, and only the following.
  • Company or LLP Master Data: the company or LLP name and its CIN or LLPIN, and nothing else.
  • View Signatory Details: each signatory's DIN or DPIN, full name, designation and appointment date, and the cessation date and DIR-3 KYC status where the page shows them. These are the names and identification numbers of the company's directors or the LLP's designated partners.
  • View Index of Charges: each charge's ID, charge holder, amount, creation, modification and satisfaction dates, and status.
  • The SRN filing history of one company: each filing's SRN, form, description, filing date and status, the CIN or LLPIN and company name where its row shows them, and the web address of a link in its row to a document or challan, where there is one. The extension does not open that link.
  • Application History: for the tab shown, each application's form, CIN or LLPIN, company or LLP name, SRN, status and Modification/Submission/Resubmission Date. It does not read the Filed by column or the Payment Status tab. An application that is not identified by a CIN or LLPIN, or that cannot be recorded as the page shows it (for example one not yet submitted, with no SRN), is listed in the popup and not sent.
  • The Document Details list of View Public Documents: the company name in the page heading; the company's CIN or LLPIN, its name and the document category you chose, as MCA's page keeps them in that browser tab's session; and, for each document listed, its category, name, form, file type, date of filing and year, and its SRN where the list shows one. It reads the list, not the documents.
• When it sends, and where: only when you press a sync button in the popup: "Ingest company to Hyperfiling", or, on a page that lists several companies such as Application History, the button that syncs the matched clients. It then sends what it read from that page over HTTPS to the Hyperfiling API. On a page about one company, the records go to the client workspace you select, which must be recorded with that company's CIN or LLPIN or have none recorded, in which case the workspace takes the page's. On a page that lists several companies, each company's records go only to the workspace recorded with its CIN or LLPIN, and those of a company with no such workspace are not sent. The extension refuses any server address that is not an https address on hyperfiling.com. Opening the popup also asks Hyperfiling for the list of your client workspaces; that request carries your sign-in and nothing from the MCA page.
• Your Hyperfiling session: it reads one cookie, your Hyperfiling sign-in cookie on hyperfiling.com, and sends it only to the Hyperfiling API, so that you do not have to paste a token. It reads no cookie on any other site, and it creates, changes or deletes none.
• What it keeps on your computer: in the extension's own storage in your browser, the address of the Hyperfiling API it sends to and, if you entered one by hand, a sign-in token, once you save them under its Advanced settings; and a record of the most recent failure, for the diagnostic report. That record holds the error code, the step at which the failure happened and, for an error returned by the Hyperfiling API, the HTTP status, the API's error code and the names of the fields it named. It holds no error message and no CIN, name or other value from the page. A later failure replaces it, and a saved token that Hyperfiling refuses is deleted. The extension keeps no page content, no company data and no record of the pages you visit.
• What it does not do: it does not sign in to the MCA portal, fill in or submit its forms, enter or solve a captcha, make a payment, or open or download a document, and it sends no request of its own to the MCA portal. Any sign-in, captcha or payment that MCA asks for, you complete yourself.
• Diagnostic report: the popup's "Copy diagnostic report" button copies a report to your clipboard and shows it in the popup, for you to send to Hyperfiling support if you choose. The extension does not send it. The report holds structure only: the extension version; the failure record described above; the page's address with numbers and identifiers removed; the hosts of its frames; the id and class names, headings, visibility and row counts of its tables, and the labels of its fields, with every word that is not one of the portal's own label words replaced or left out; how many records the extension read, and the reasons it did not read some rows or could not identify the company; and, if the page could not be read, the reason Chrome gave. It holds no CIN, LLPIN, name, amount, date or document name.

Records the extension syncs become content data in that workspace. They are retained, shared and deleted as described in sections 4 and 5, like anything else you add to the workspace. We do not use them for any other purpose, and we do not sell them.

11. Updates

We may update this notice. Material changes are announced in-product and on this page. The "last updated" date at the top reflects the most recent change.