Privacy notice
Last updated 3 November 2026.
This notice explains how Fast GST Refund handles information when you use our website, free preparation pack, MCP tools or plugin (named RefundJSON for Indian GST from version 1.4.0), or contact us.
Information we collect
We collect the contact details and information you share when making an enquiry, and the records and documents you give the JSON generator. We also collect basic information about website usage, referral sources, devices and general location.
Browser PDF tool
Details entered in the RCM self-invoice maker and PDFs selected for combining are processed locally in your browser. They are not uploaded to Fast GST Refund. Website analytics may record that the page was used, but we do not send the form values, GSTIN, document names or PDF contents to analytics.
MCP and Codex plugin
The five guidance tools process inputs in memory to return the requested result. The allocation tool accepts anonymous row numbers and INR paise; keep taxpayer identifiers, passwords and document contents local. We do not store these public-tool arguments or results in our application database or send them to analytics.
Statement 3 and Annexure B JSON generator
What you enter in the JSON generator is kept in your browser's storage and checked there. It is also saved to our server as you work: the GSTIN and period, document numbers, dates and values, and for Annexure B the supplier, tax and eligibility details. We also keep every JSON file you choose to import, as it is, whether or not the page can read it, and any returns or other documents you upload.
We keep these so that your work is not lost, so that we can prepare your files from your documents when you ask us to, and to find the cases the generator does not handle well and improve it. When you sign in, they are linked to your account. We keep them for two years and then delete them; write to us to have them deleted sooner. Clear allremoves the entries from your browser only. The generator does not need your GST password, an OTP or access to your mailbox.
Before anything is saved, the page uses Cloudflare Turnstile to check that a person, not an automated script, is using it: again each day to keep saving, and every half hour before documents are uploaded or sent. Turnstile runs in your browser, and Cloudflare processes information about the browser and the connection to make that check. The page then keeps a cookie that identifies its saved work; the cookie holds a random value, not your details. Signing out ends it in that browser.
If you send us documents, you sign in and pay for the GSTIN and period, and we use the documents to prepare your Statement 3 and Annexure B. We receive an email about each set of documents you send, with your email address, the GSTIN and period, the names of the files and any note you add, and again when it is paid for.
When you download a file, it is created from your entries. We keep an encrypted copy of the created file for 24 hours so that a connected assistant can fetch it again, up to the 50 most recent files for an account. An hourly job deletes expired copies, and a storage rule deletes them as a backstop.
When an AI assistant sends entries to our MCP tools or API to be checked, they are processed in memory and not stored. When it creates a link for you, the entries are stored encrypted for 24 hours. The encryption key is derived from the link, which we do not keep, so the stored copy can be opened only with the link. Anyone who has the link can open the entries until it expires, so share it only with people who should see them. Your assistant and any connectors it uses have their own data-handling policies.
For your account we keep your email address, and for each claim its GSTIN, From and To periods and payment status. A claim that you asked a file for, but did not pay for, start paying for or send documents for, is removed after a day; your saved entries are kept as described above. Sign-in codes are kept only as a keyed hash; the code works for 10 minutes and its record is removed within about an hour. Browser sessions last 30 days and are stored as hashes. After you sign in, your browser also keeps a note that it has signed in, without your address, so that every page can show “Signed in” in its menu; signing out removes it. Sign-in emails are sent through Amazon Simple Email Service, which receives your email address and the code. Before a code is sent, the Cloudflare Turnstile check described above confirms that a person asked for it.
If you connect an assistant to your account, we keep the name and return address it registered, and hashed access tokens that last one hour and rotating refresh tokens that last 30 days. A connected assistant can create files for claims you have paid for and fetch their stored copies. It cannot read your email address or your list of claims, and it cannot start a payment. You can disconnect an assistant on the account page.
Dodo Payments handles the checkout and its billing details. We send it your email address to fill in the checkout form, and an order reference; we do not send the GSTIN or any entries. We keep the order, product, amount and payment references needed to confirm access, and we do not receive card or UPI details. When you return from checkout, the page address briefly contains your email address and a payment reference; the page removes them at once and they are not sent to analytics.
On the generator and account pages, website analytics records the page view and the names of steps such as “example loaded”, “download selected”, “documents sent”, “payment confirmed” and “assistant connected”. It does not record entries, GSTINs, email addresses or amounts, the page address is reduced to its path before it is sent, and session recording is off. When one of these pages sees a request to our server fail, it tells our server where (for example “download”) and the status code, so that we can fix it.
We send operational events to PostHog: tool name, request method, success/error outcome, duration, protocol and server version, a random request ID, the declared client channel, and the kind of client that called, as one word from a fixed list such as “claude”, “chatgpt” or “other”. We work that word out from the name the client gives for itself and do not keep the name. We also note whether the request was signed in with one of our own accounts, so that our testing is not counted as use; for everyone else this is simply “no”. This measures usage and reliability. The ID relates events within a request; it does not identify returning users. Person profiles and location enrichment are disabled for these backend events.
Set the request header X-GST-Analytics: off to disable MCP analytics. Cloudflare processes network information to serve and protect the endpoint, including IP-based rate limits. Our application failure logs contain operational codes and request IDs, not tool inputs.
Free preparation pack
You can download the pack without an account, email address or payment. The included allocation workspace runs offline. Records entered into it stay on your computer and are not sent to us or to analytics.
We record download requests, the pack version and response status using a random request ID. These events count requests, not identified people or confirmed use of the files. They exclude download URL parameters and document contents. The X-GST-Analytics: off header also disables these download metrics.
How we use information
We use this information to respond to enquiries, follow up about your request, provide and improve our services, understand website use and keep the website secure.
Sharing and security
We use Cloudflare for hosting, application storage and the Turnstile check, Amazon Web Services to send sign-in emails, PostHog US Cloud for usage analytics, and Dodo Payments for checkout and invoices. These providers may process information outside India. We limit access to people and providers who need it for these purposes and take reasonable steps to protect it.
We do not sell your personal information. We may disclose information where required by law.
Keeping your information
Public MCP arguments and results, and records an assistant sends only to be checked, are not retained after the request. What you enter, import and upload in the JSON generator is kept for two years, as described above. Created files and assistant links follow the 24-hour expiry described above. Account, claim and payment records remain in our database to provide access, handle refunds and disputes, and meet applicable record-keeping obligations. They do not have an automatic expiry. Write to support from your account's email address to ask for deletion; we assess which records can be removed and explain any we must retain. Expired tokens and codes are cleared by the hourly job. Usage events remain in our PostHog project until deleted; the provider’s plan-based query window is not automatic deletion. We review the need for retained usage data annually.
We keep information for as long as needed to handle enquiries, operate our services and meet applicable legal obligations.
Your choices
You can request access, correction or deletion of your personal information, or ask us to stop following up on your enquiry.
For privacy questions or requests, contact support@fastgstrefund.com.
We may update this notice as our services change. The latest version will appear on this page.