Privacy policy

Effective date: 9 October 2026

This policy covers the website nanolabshq.com, NanoLabs Access and the India Tax & GST Helper, used through AI assistants such as ChatGPT and Claude (together, "the Service"). NanoLabs HQ is a brand of Mercury Online Solutions Pvt Ltd, a private limited company registered in India (CIN U72900DL2010PTC204781), registered office A-403, Hind Apartments, Plot No. 12, Sector 5, Dwarka, Delhi 110075, India, correspondence address A103, Enigma, Sector 110, Dwarka Expressway, Gurugram, Haryana 122018, India ("we", "us"). For the purposes of the Digital Personal Data Protection Act, 2023 ("DPDP Act"), we are the Data Fiduciary for the limited data described here.

In short. The tools calculate an answer from what your AI assistant sends and send it back. We do not store your inputs or results. We keep only anonymous usage counts so we can see how often each tool is used and fix errors. The website sets no cookies and runs no analytics.

1. India Tax & GST Helper: data we receive and what we do with it

Category	Examples	Why	Kept?
Tool inputs your AI assistant sends	salary and deduction amounts, rent, city type, invoice party names and addresses, GSTINs, line items	to compute the answer or build the invoice you asked for	Not stored. Processed in memory for the request; not written to our logs or a database.
Tool outputs	tax figures, invoice PDF/HTML	returned to you	Not stored. Invoice download links expire after 15 minutes. The link itself carries the invoice details in encrypted form and the invoice is re-created from it when opened, so nothing is saved on our side; our hosting provider's request logs may record the (encrypted) link.
Anonymous usage record	date and time, which tool was called, success or failure, an anonymous key, a coarse "surface" label	to count usage, unique users and repeat use, and to find errors	Yes, for 13 months (section 2).
Technical request data	IP address, user-agent	used in memory only, to derive the anonymous key when the assistant supplies no identifier; and by our hosting provider for normal operation and security	We do not store them. Our hosting provider may keep standard infrastructure logs under its own policy (section 5).
Emails you send us	your email address and message	to answer you	Kept in our mailbox only as long as needed to handle your request and any follow-up.

The website nanolabshq.com is a set of static pages. It has no sign-up, no forms, no cookies, no analytics and no advertising.

2. India Tax & GST Helper: anonymous usage metrics, exactly what is logged

For each tool call we store: timestamp, app, tool name, an anonymous key, success or failure with a coarse reason (validation, unsupported, restricted input, internal), and a coarse surface label (claude, chatgpt or other) worked out from the connection address, request metadata or user-agent.

The anonymous key is a shortened one-way hash (HMAC-SHA-256 with a server-side secret) of an identifier supplied by the AI assistant if it supplies one, or otherwise of the IP address and user-agent combined with a value that changes daily. When you use an assistant such as Claude, the IP address we see is likely to be the assistant provider's server, not yours. We never store the raw identifier, IP address, GSTINs, names, addresses, amounts, invoice numbers or any content of the request.

We keep these records for 13 months and then delete them. We cannot tell who you are from them, which also means we cannot find or delete a particular person's records on request.

3. NanoLabs Access

When you ask your assistant to check a website, NanoLabs Access receives the web address and loads the public page (and, for a site check, a few pages linked from it or listed in its sitemap) in a browser on our hosting provider, as any visitor would. It returns a summary of the issues found. We do not store the pages, the addresses checked or the results; they are processed in memory for the request.

To apply the free monthly scan limit and rate limits, we keep a counter keyed by a salted one-way hash of the connecting IP address (normally your assistant provider's server, not you). The counter is kept in memory only, is not written to a database and resets each calendar month or when the service restarts. We do not log requests apart from error messages. Please check only websites you are allowed to test, and do not ask it to check pages that need a login or contain personal data.

4. Please do not send us

Aadhaar, PAN, card or bank details, passwords or OTPs, or health information. The tools try to detect and reject such text, and even if some slips through it is not stored. A GSTIN is a business identifier; it is processed only to check it or print it on your invoice.

5. Who else processes data

We do not sell data, show ads or share data for marketing. Our only processor today is our hosting provider, Vercel Inc. (USA). The India Tax & GST Helper runs in Vercel's Mumbai region and NanoLabs Access in Vercel's US (Washington, D.C.) region; the website is served from Vercel's global network, and Vercel's infrastructure logs may be processed outside India under Vercel's own privacy policy. If we add another processor (for example a database for the anonymous usage counts), we will name it here before we start using it. We disclose information only when Indian law requires it.

Your conversation with ChatGPT, Claude or another assistant is governed by that provider's own terms and privacy policy. We only see the tool inputs the assistant sends to us.

6. Your rights under the DPDP Act

Because we do not keep personal data from tool use, there is normally nothing for us to access, correct or erase. You can still write to us with any question, request or complaint about your data at info@nanolabshq.com (subject "Privacy"). We will respond within 30 days. If you are not satisfied with our response, you may complain to the Data Protection Board of India.

Grievance Officer, for data questions and grievances: Gulshan Mehta, Mercury Online Solutions Pvt Ltd, A103, Enigma, Sector 110, Dwarka Expressway, Gurugram, Haryana 122018, India, info@nanolabshq.com.

7. Children

The Service is meant for adults handling their own tax and invoicing or checking websites. We do not knowingly process children's personal data.

8. Security

All traffic uses HTTPS. Administrative functions need a secret token. We keep the data we hold to the minimum described above.

9. Changes

If our practices change we will update this page and its effective date before the change takes effect.