Last updated 7 October 2026

Pack privacy notice

This notice explains what Pack handles in the browser extension, on this website, and when you contact us.

Scope

Pack browser extension

Pack runs in the user's browser, uses Chrome extension storage inside the current browser profile, and writes selected downloads to the user's machine.

  • No extension analytics or telemetry.
  • The local-download workflow does not upload GST files or document contents to ComplyEaze.
  • Extension local and session storage hold install metadata; run, plan, recovery and review state for downloads you start; the latest safe GST page context and tab ID; and the local demo manifest. The Extension Storage section of the Pack README lists each key in the current source. Selected document bytes may be staged temporarily in browser-local storage (OPFS) during capture or ZIP assembly; Pack removes them after a confirmed export or an explicit discard, and keeps them with a cleanup-pending status if that cleanup fails.
  • Clear local Pack data removes Pack local/session extension state after active or unresolved recovery state is resolved.

GST Portal interaction

The user opens and authenticates to the GST Portal directly. Pack acts only on exact GST Portal hosts from the active browser session and does not ask for or store GST Portal credentials, OTPs, CAPTCHA responses, cookies, or session tokens.

  • https://www.gst.gov.in/*
  • https://services.gst.gov.in/*
  • https://return.gst.gov.in/*
  • https://gstr2b.gst.gov.in/*

Pack website

The Pack website is separate from the browser extension. GST credentials, session tokens, and downloaded GST files are not sent to ComplyEaze by the extension workflow. Pack does not collect or transmit extension analytics or telemetry.

  • Website page analytics are disabled.
  • Pack's own pages load no analytics, error-reporting, advertising or session-replay scripts, and set no cookies of their own. Fonts and images are served from this site.
  • Pack pages do not use a ComplyEaze account or app session.

Support and security reports

Email support, GitHub issues when available, pull requests, and private security reports receive only what a visitor or reporter chooses to send. Reports must use synthetic or redacted material.

  • Do not send real GST Portal credentials, OTPs, CAPTCHA responses, session cookies, taxpayer files, portal HTML, raw network captures, or unredacted screenshots.
  • Security reports go to security@complyeaze.com; general questions go to contact@complyeaze.com.
  • Public issues, pull requests, screenshots, and support messages must not include taxpayer identifiers, credentials, portal captures, or downloaded GST files.

Pack browser extension

The extension processes supported GST Portal page state locally in your browser to find and trigger filed GSTR‑3B PDF, filed GSTR‑1 summary PDF, optional GSTR‑1 e-invoice details Excel, and auto-drafted GSTR‑2B statement summary PDF downloads.
Rendered GST page text and controls
Read transiently in the browser to classify and operate supported GST Portal pages; raw page text is not transmitted to ComplyEaze.
GST origin and page kind
Reduced to allowlisted context labels and stored temporarily in extension session storage.
Selected financial year and period
Processed locally to identify requested filed GSTR‑3B and GSTR‑1 and auto-drafted GSTR‑2B downloads; local run, full-year ledger, and unresolved target-review state may remain in extension local storage until cleared or the extension is removed.
Download metadata
Examined transiently to correlate the requested GST-origin PDF or Excel file and verify completion; raw filenames, local paths, referrers, and URLs are not transmitted or persisted.
Installation metadata
Stored in extension local storage as pack:install with local extension version, install timestamp, and local-only metadata until cleared or the extension is removed.
Local demo manifest
Stored in extension local storage as pack:last-manifest for the synthetic demo until clear-data runs or the extension is removed.
GST PDF or Excel file
Saved by Chrome to the user's configured download location; Pack does not upload downloaded GST files to ComplyEaze.

GST Portal interaction

You open and authenticate to the GST Portal directly. Pack acts only on exact GST Portal hosts from the active browser session.
  • Pack does not ask for or store GST Portal credentials, OTPs, CAPTCHA responses, cookies, or session tokens.
  • Pack does not automate OTP, CAPTCHA, login, or consent challenges.
  • https://www.gst.gov.in/*
  • https://services.gst.gov.in/*
  • https://return.gst.gov.in/*
  • https://gstr2b.gst.gov.in/*

Pack website

The Pack website is separate from the browser extension. GST credentials, session tokens, and downloaded GST files are not sent to ComplyEaze by the extension workflow. Pack does not collect or transmit extension analytics or telemetry.
Website analytics
disabled
Error diagnostics
None. Pack pages run no error-reporting service.
Infrastructure logs
GitHub Pages, which hosts this site, and Cloudflare, which delivers it, may log ordinary request metadata such as IP address, user agent, timestamp, path, status, and referrer. Cloudflare may insert its own security script and set strictly necessary security cookies to filter automated traffic.
ComplyEaze account or app session
none on Pack pages

Your privacy choices and requests

Use this route for website, support, and security-report data that ComplyEaze can access. Extension-local state that never leaves your browser profile must be cleared locally.
  • Contact contact@complyeaze.com to request access, correction, deletion, or grievance review for Pack website/support data ComplyEaze can access.
  • Send private security reports to security@complyeaze.com, not public issues.
  • ComplyEaze cannot retrieve downloaded GST files, GST Portal credentials, cookies, OTPs, CAPTCHA responses, or extension-local data that never leaves your browser profile.
  • Clear local Pack data removes Pack local/session extension state after active or unresolved recovery state is resolved; removing the extension or browser profile also removes extension-local state.

DPDP 2026 readiness workstream

Engineering readiness target for DPDP 2026 obligations; this is not a legal certification or compliance guarantee.
Data-principal request handling (active)
ComplyEaze Pack maintainer: Maintain a dated response log for Pack website/support access, correction, deletion, and grievance requests.
Support and security intake minimisation (active)
Support maintainer: Keep public support templates and private security-report guidance aligned with the prohibited sensitive attachment list.
Processor and recipient review (active)
Privacy maintainer: Review hosting and delivery logs (GitHub Pages and Cloudflare), GitHub, and email inbox handling before broad public distribution.
Security incident and breach workflow (todo)
Security maintainer: Document intake, triage, user-notification, authority-notification, containment, and post-incident review steps before claiming DPDP compliance.
External legal review (todo)
Legal reviewer: Record legal sign-off against applicable DPDP Act and Rules obligations before any compliance badge or certification wording.

Who receives data

Pack separates browser-local extension processing from website hosting, support, and public-source collaboration.
Chrome browser profile
Stores extension-local Pack state and writes selected downloads to the user's configured download location.
Hosting and delivery logs
GitHub Pages and Cloudflare may process ordinary Pack website request metadata such as IP address, user agent, timestamp, path, status, and referrer.
GitHub issues and pull requests
Receives public reports a visitor chooses to submit, using synthetic or redacted material only.
Email support inboxes
Receives support, privacy, and security-report messages a visitor chooses to send.

Support and security reports

Public issues, pull requests, email support, and private security reports receive only what a visitor or reporter chooses to send.
  • Do not send real GST Portal credentials, OTPs, CAPTCHA responses, session cookies, taxpayer files, portal HTML, raw network captures, or unredacted screenshots.
  • GSTIN, PAN, Aadhaar, taxpayer names, client names, or trade names.
  • Passwords, OTPs, CAPTCHA responses, cookies, session tokens, or credentials.
  • ARNs, return values, tax amounts, downloaded GST files, real filenames, portal HTML, headers, cookies, raw network captures, or unredacted screenshots.
  • Support and security submissions are retained only as needed to respond, investigate, and maintain an audit trail.

Chrome Limited Use

Pack's extension data use is limited to providing or improving the user-facing supported download workflow. Extension data is not used for advertising, lending, creditworthiness, unrelated profiling, or sold to third parties.
  • No extension analytics or telemetry.
  • No advertising or session-replay SDK in the extension.
  • The extension workflow does not upload GST files or GST document contents to ComplyEaze.
  • Local extension data can be cleared through Clear local Pack data after active or unresolved recovery state is resolved, browser extension removal, or browser profile cleanup.