Privacy notice

Last updated 7 October 2026

This notice explains what EDF Filing collects, why, where it is kept, who else sees it and what you can ask us to do with it. We have written it to be read in five minutes. It applies to this website and the EDF Filing app.

Who we are

EDF Filing is an online document generator for Indian exporters of services. It fills in the Export Declaration Form (EDF) and the covering documents your bank asks for, from details you enter. We are the data fiduciary for the personal data described here under the Digital Personal Data Protection Act, 2023. Not affiliated with HDFC Bank or RBI.

What we collect

Account: your name, email address and a hashed password. If you turn on two-factor authentication, an encrypted secret for your authenticator app.
Exporter profile: legal name, entity type, address, PAN, IEC, GSTIN and default purpose code.
Bank account details: bank name, branch, account number, IFSC, AD code and SWIFT code.
Clients: the names, countries and addresses of the foreign clients you invoice.
Invoices: invoice numbers, dates, currencies, amounts, descriptions, SAC codes and any invoice files you attach.
Signature image: only if you choose to upload one, together with a seal image if you add it.
Generated documents: the PDFs and spreadsheets you generate, and the submission details you record (channel, date, ACK number).
Fields read from a document you upload for fast fill: the suggested values (for example invoice number, amount, GSTIN, account number and IFSC) are shown in the form for you to check. They become your profile, bank or invoice data only when you press Save. The uploaded file is held encrypted only while you review, for at most an hour, and is then deleted unless you choose to attach it to the invoice.
Usage logs: sign-in times, the IP address of your last sign-in, failed sign-in attempts and an audit trail of sensitive actions such as downloads and signature changes.

We do not collect card or payment details. We do not use advertising trackers or third-party analytics cookies.

Why we use it

To generate your documents: your profile, bank details, clients and invoices are what fill the form.
To remind you of deadlines: we email you on the 20th and 28th of the month after you raise invoices, unless you turn reminders off or mark the month as submitted.
To keep your account secure: sign-in logs and audit entries help us spot misuse and answer your questions about activity on your account.
To run the free allowance fairly: we keep a one-way hash of your PAN so one exporter receives the free packs only once.

Legal basis

We process your data on the basis of your consent, given when you create an account and when you upload a signature, and to perform our contract with you, which is to provide the service described in our terms. You can withdraw consent at any time; see "Your rights" below.

Where it is kept

Your data is stored on servers in India. Backups are encrypted and also kept in India. PAN, IEC, GSTIN, account numbers, client details, invoice descriptions and signature images are encrypted at rest with keys held separately from the database.

How long we keep it

We keep your data until you delete your account. When you do, we delete your rows and files within 24 hours. Encrypted backups roll off after 30 days. We keep one audit entry recording that a deletion happened, linked only to a one-way hashed identifier.

Who we share it with

We share data only with the providers we need to run the service:

Our hosting provider, which runs the servers and stores the encrypted data in India.
Our email provider, which delivers verification, reminder and download emails. It receives your email address and the content of those emails.
The document-reading provider, currently OpenAI, if you use fast fill. Only the file you choose to upload (an invoice, a GST registration certificate or a cancelled cheque) is sent, for the time of one request, under zero-retention terms: the provider does not keep it or use it for training. The provider is named in the app at the point of upload. Processing may take place outside India for the Google Gemini API and the OpenAI API; your stored data stays in India. Nothing is sent unless you upload a file, and you can always fill the forms by hand instead.

We do not sell your data and we do not share it for advertising. We never send your documents to your bank or to any authority; you do that yourself. We will disclose data to a government body only when Indian law requires it.

Your rights

Access: everything you entered is visible in the app, and your generated documents can be downloaded at any time.
Correction: you can edit your profile, bank details, clients and invoices in the app.
Deletion: you can delete your account and all your data from Settings. Deletion completes within 24 hours.
Withdraw consent: you can delete your signature image at any time, turn off reminders, or delete your account.
Grievance: you can complain to our Grievance Officer (below) and, if you are not satisfied, to the Data Protection Board of India.

Security

Passwords are hashed. Sensitive fields and signature images are encrypted. Every connection uses HTTPS. Generated documents are stored outside the public web folder and are only served to you through download links that expire after 15 minutes. Sign-in attempts are rate limited and two-factor authentication is available to every user. No system is perfectly secure, so please use a strong, unique password.

Reporting a breach or a vulnerability

If you believe your data or our systems have been compromised, write to security@edffiling.com. If we confirm a personal data breach, we will inform affected users and the Data Protection Board as the law requires.

Grievance Officer

Our Grievance Officer, ToDo IT Services, can be reached at support@edffiling.com. We acknowledge grievances within 48 hours and aim to resolve them within 30 days.

Changes to this notice

If we change how we use your data, we will update this page and change the date at the top. For significant changes we will email you before they take effect.

Questions about this notice: support@edffiling.com.