Binari Software ("Company," "we," "us," "our") is committed to protecting your personal information and your right to privacy. This Privacy Policy applies to all information collected through our website https://novuscompliance.com (the "Site") and any related services, sales, marketing, or events (collectively, the "Services"), including our cloud-based FATCA and CRS reporting platform.
If you disagree with this notice, stop using our Services.
1. What information do we collect?
Personal information you disclose to us
We collect personal information that you voluntarily provide when you register on the Services, express interest in obtaining information about us or our products, or otherwise contact us. This may include:
- Names
- Phone numbers
- Email addresses
- Job titles
- Company names
- Billing addresses
Client Data (Financial Information)
When using our Services — specifically for FATCA and CRS reporting — you may upload data about financial accounts, tax identification numbers, and entity details ("Client Data"). This data may include:
- Account holder names, addresses, and Tax Identification Numbers (TINs)
- Global Intermediary Identification Numbers (GIINs) and ITDREINs
- Account numbers, balances, and payment amounts
- Controlling person and substantial owner details
- Self-certification and due diligence records
We process this Client Data strictly for the purpose of generating the required XML reports and filing them with the appropriate tax authority. We do not use Client Data for any other purpose.
Desktop Application — Zero Storage Processing
If you use the Novus Compliance Desktop Application, all client financial data you upload is processed locally on your machine — in memory only. The Desktop Application does not transmit, store, or persist any client financial data to our servers, to any database, or to any cloud storage. Data is:
- Loaded into memory when you initiate processing
- Validated and converted to XML in that session
- Discarded from memory immediately after the XML file is generated
No persistent record of your client data remains on the Desktop Application or on our servers after processing completes.
Information automatically collected
Some information — such as your Internet Protocol (IP) address, browser type, and device characteristics — is collected automatically when you visit our Services. This information is primarily used to maintain the security and operation of our Services, and for internal analytics and reporting purposes.
2. How do we process your information?
We process your information to provide, improve, and administer our Services, communicate with you, protect against fraud, and comply with applicable law. Specifically:
- To facilitate account creation and logon. To create your account and securely authenticate you.
- To deliver our services. Specifically, generating FATCA and CRS XML reports and facilitating filing with tax authorities.
- To send administrative information. Product, service, and new feature updates; information about changes to our terms, conditions, and policies.
- To protect our Services. As part of our efforts to keep our Services safe and secure — including fraud monitoring and prevention.
- To comply with legal obligations. Where required by applicable law, regulation, or valid legal process.
3. When and with whom do we share your personal information?
We do not sell your personal information or Client Data. We share information only in the specific situations described below.
Service providers and sub-processors
We engage trusted third-party providers to host, secure, and operate our platform. These sub-processors are bound by written data processing agreements and are permitted to process data only as instructed by us. Categories of sub-processors include:
- Cloud infrastructure providers — for secure hosting and storage
- Payment processors — for billing and subscription management
- Analytics providers — for understanding platform usage
- Email and communication platforms — for transactional and administrative communications
A current list of our sub-processors is available on request from Enable JavaScript to view
Tax authorities (on your behalf)
When you use our platform to file FATCA or CRS reports, your Client Data is transmitted to the appropriate tax authority (such as the IRS via IDES, or the relevant local authority). This transmission is done at your direction, on your behalf, using your credentials or our authorized third-party transmitter status.
Business transfers
We may share or transfer your information in connection with — or during negotiations of — any merger, sale of company assets, financing, or acquisition of all or a portion of our business to another company.
Legal obligations
We may disclose your information where required to comply with applicable law, governmental requests, a judicial proceeding, court order, or legal process.
4. How do we keep your information safe?
We protect your data with technical and organizational security measures. These include:
- Encryption in transit and at rest. All data is encrypted in transit using TLS 1.3, and at rest using AES-256 encryption.
- Field-level encryption of sensitive data. Sensitive fields — including TINs, account numbers, names, addresses, and balances — are encrypted at the field level.
- Role-based access controls. Access to Client Data is restricted to authorized personnel on a need-to-know basis.
- Logical tenant isolation. Each customer's data is logically separated within our platform.
- Regular security audits and penetration testing. Independent third-party firms conduct periodic security assessments.
- Continuous monitoring. We monitor our infrastructure for anomalous activity, fraud, and unauthorized access.
You can read more about our security architecture on our Technology & Security page.
However, no electronic transmission over the Internet or information storage technology can be guaranteed to be 100% secure. We cannot promise or guarantee that hackers, cybercriminals, or other unauthorized third parties will not be able to defeat our security.
5. Do we use cookies and other tracking technologies?
We may use cookies and similar tracking technologies (such as web beacons and pixels) to access or store information. These include:
- Strictly necessary cookies — required for the platform to function (authentication, security, session management)
- Analytics cookies — to understand how the platform is used (Google Analytics, Tag Manager)
- Marketing pixels — for measuring campaign effectiveness (Meta Pixel)
You can manage or disable cookies through your browser settings. Disabling strictly necessary cookies may affect platform functionality. For details on how we use cookies, see our Cookie Notice — available here.
6. Is your information transferred internationally?
Our primary servers are located in India. If you access our Services from outside India, please be aware that your information may be transferred to, stored in, and processed by us in our facilities and by those third parties with whom we may share your information, in India and other countries.
Where we transfer personal data outside the European Economic Area (EEA) or the United Kingdom, we rely on appropriate safeguards such as Standard Contractual Clauses (SCCs) approved by the European Commission, or other lawful transfer mechanisms.
7. How long do we keep your information?
We keep your information for as long as necessary to fulfill the purposes outlined in this Privacy Notice, unless a longer retention period is required or permitted by law.
Data retention & deletion for Client Data (financial reporting data)
We adhere to a strict data minimization policy for the financial data you upload for reporting purposes. Our automated retention cycle operates as follows:
60-day post-filing deletion: All uploaded client financial data and generated reports are automatically and permanently deleted from our servers 60 days after the successful filing of the corresponding report with the tax authority.
Example: If you successfully file your FATCA/CRS report on 30 June 2026, all data related to that filing is purged from our systems by 29 August 2026 (60 days later).
This 60-day window provides enough time to:
- Verify the filing was accepted by the tax authority
- Handle any immediate acknowledgements, rejections, or corrections
- Download your own copy of the filed XML and generated reports
- Complete internal post-filing reconciliation
After the 60-day window, the following are deleted automatically:
- Uploaded Excel/CSV source files
- Generated XML reports and encryption packages
- Intermediate validation outputs
- Associated metadata linked to the filing
We retain only your basic account information — name, email, company name, billing history, and platform audit logs — to maintain your account for future renewals and to comply with legal and tax recordkeeping requirements.
8. Do we collect information from minors?
We do not knowingly collect data from or market to children under 18 years of age. By using the Services, you represent that you are at least 18 years of age.
9. What are your privacy rights?
Your rights under GDPR / UK GDPR (EEA and UK residents)
If you are located in the European Economic Area or the United Kingdom, you have the following rights:
- Right of access — to request a copy of the personal data we hold about you
- Right to rectification — to request correction of inaccurate or incomplete data
- Right to erasure ("right to be forgotten") — to request deletion of your personal data, subject to legal retention obligations
- Right to restrict processing — to limit how we use your data in certain circumstances
- Right to data portability — to receive your data in a structured, machine-readable format
- Right to object — to object to processing based on legitimate interests
- Right to lodge a complaint — with your local data protection supervisory authority
Your rights under DPDP Act (India residents)
If you are located in India, you have rights under the Digital Personal Data Protection Act, including the right to access, correct, and erase your personal data, and the right to grievance redressal.
Your rights under CCPA/CPRA (California residents)
If you are a California resident, you have the right to know what personal information we collect, the right to delete, the right to opt out of the "sale" or "sharing" of personal information (we do not sell or share your data), and the right to non-discrimination for exercising your rights.
Exercising your rights
To exercise any of these rights, submit a request to Enable JavaScript to view. We will respond within the timeframe required by applicable law (typically 30 days). We may need to verify your identity before fulfilling your request.
10. Data breach notification
In the event of a personal data breach that poses a risk to your rights and freedoms, we will notify the relevant supervisory authority within 72 hours of becoming aware of the breach, and will notify affected individuals without undue delay where required by law.
11. Controls for Do-Not-Track features
Most web browsers include a Do-Not-Track ("DNT") feature. At this stage, no uniform technology standard for recognizing and implementing DNT signals has been finalized. As such, we do not currently respond to DNT browser signals.
12. Do we make updates to this notice?
We may update this Privacy Notice from time to time. The updated version will be indicated by an updated "Last updated" date at the top of this page. Material changes will be notified to registered users by email. We encourage you to review this Privacy Notice periodically to stay informed of how we are protecting your information.
13. Contact us
If you have questions or comments about this notice, or wish to exercise your privacy rights, you may contact us at:
Binari Software
Survey No 81/5/1/2, Office No. 309, Floor No. 3
Runwal Arcade, Warje
Pune, Maharashtra 411058
India
Email: Enable JavaScript to view
Phone: +91 88884 84178
- Technology & Security — How we protect your data
- Terms & Conditions — Your agreement with us
- Cookie Policy — How we use cookies
- Contact Us — Get in touch with our team