This Privacy Policy describes how T S Black Corporate Consultants Private Limited ("TS Black", "we", "our") collects, uses, discloses and protects personal data when you access https://tsblack.in and the tools listed on it (collectively, the "Service").
For the purposes of the Digital Personal Data Protection Act, 2023 ("DPDP Act") we act as the Data Fiduciary in respect of personal data you provide directly to us. Where you upload files that contain third-party personal data (for example, employee records in our Salary Slip Generator), you are the Data Fiduciary in respect of that data and we act as a Data Processor on your behalf.
| Category | Examples | Source |
|---|---|---|
| Authentication data | Email, name, profile photo URL, Google account ID | You, via Google Sign-In (Firebase Authentication) |
| Optional profile data | Display name, website, phone (if you choose to add) | You |
| Usage data | Page views, tool views, click events, anonymised view counts | Automatic — browser |
| Technical data | IP address (collected by Cloudflare for security), browser user-agent, device type, time zone | Automatic — network/browser |
| Preferences | Theme (light/dark), view layout, last-viewed tools | Browser localStorage |
| User Content | Files you upload to a tool (PDFs, CSVs, images) and inputs you type into a tool | You |
| Communications | Email, WhatsApp, or form submissions you send us | You |
We do not knowingly collect: government identifiers (PAN, Aadhaar), biometric data, financial-account credentials, or special-category personal data (health, religion, sexual orientation, political opinions). If any tool ever requires such data, the tool's page will provide a separate purpose-specific notice and consent.
Under §4 of the DPDP Act, we process personal data on one of these grounds:
Where we rely on consent, you may withdraw consent at any time (see Clause 10). Withdrawal does not affect the lawfulness of processing before withdrawal.
We do not sell or rent personal data. We share personal data only with the following recipients and only as necessary:
| Recipient | Role | Purpose |
|---|---|---|
| Google LLC (Firebase, Google Sign-In) | Data Processor | Authentication, data storage, hosting |
| Cloudflare Inc. | Data Processor | Content delivery, DDoS protection, edge caching |
| Payment gateway providers (when paid tools are launched) | Data Processor | Process payments under PCI DSS standards |
| Statutory or law-enforcement authorities | Recipient under law | Where disclosure is required by a binding legal order |
| Professional advisors (auditors, lawyers) bound by confidentiality | Recipient | Where strictly necessary for our compliance |
We require each Data Processor to implement appropriate technical and organisational measures and to process personal data only on our documented instructions.
Some of our processors (notably Google / Firebase and Cloudflare) operate globally and may process personal data outside India. Such transfers are made consistent with §16 of the DPDP Act. Where the Central Government notifies a list of restricted countries, we will not transfer personal data to those jurisdictions.
We use the following client-side storage:
localStorage — for your preferences (theme, view mode, dismissed banners). No personal data is sent to our servers from localStorage.sessionStorage — for rate-limiting sign-in attempts (counter only)._ga, _ga_*) — measure aggregate, anonymous usage of the Service so we know which tools are useful. IPs are anonymised; ad-personalisation signals are disabled.We do not use advertising cookies or cross-site tracking pixels. You can clear local storage and cookies at any time via your browser settings.
You can turn analytics off entirely on this device. Your preference is stored locally and respected on every TS Black page from then on. We also automatically honour your browser's Do Not Track and Global Privacy Control signals.
| Data | Retention period |
|---|---|
| Account data (email, name, photo) | Until you delete your account, then permanently erased within 30 days subject to legal hold |
| Tool view counts | Aggregated indefinitely; individual events not stored |
| Server-side User Content (when a tool requires it) | Processed transiently and deleted within 24 hours unless the tool's page states otherwise |
| Client-only User Content | Never sent to our servers; controlled entirely by you |
| Support communications | Up to 3 years from last interaction |
| Financial records (where paid tools are used) | 8 years, as required by §128 of the Companies Act 2013 and §36 of the CGST Act 2017 |
We implement reasonable security practices and procedures consistent with the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 ("SPDI Rules") and the security guidance under the DPDP Act, including:
Despite these measures, no internet transmission or storage system is 100% secure. If we become aware of a personal-data breach that poses risk to you, we will notify you and the Data Protection Board of India in accordance with §8(6) of the DPDP Act.
You have the following rights in respect of your personal data:
To exercise any right, write to [email protected] from the email associated with your account. We will respond within the timelines required by the DPDP Act and, in any event, within 15 days for grievance complaints under IT Rules 2021.
The Service is not directed to individuals below 18 years of age. We do not knowingly process personal data of children. If you believe a child has provided us with personal data, please contact the Grievance Officer so we can erase it.
We may update this Privacy Policy from time to time. Material changes will be notified by updating the "Last updated" date and, where appropriate, by an in-product notice or email to your registered address. If the change reduces your rights, we will seek fresh consent where required.
In accordance with the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021 (Rule 3(2)) and the DPDP Act 2023 (§8(10)), our designated Grievance Officer is:
If you are unable to obtain a satisfactory resolution from the Grievance Officer, you may approach the Data Protection Board of India in accordance with §27 of the DPDP Act.
General privacy questions: [email protected]. See the Contact page for office hours and other channels.