Binari Software (“Company,” “we,” “us,” “our”) is committed to protecting your personal information and your right to privacy. This Privacy Policy applies to all information collected through our website novuscompliance.com (the “Site”) and any related services, sales, marketing or events (collectively, the “Services”), including Novus Cloud, our FATCA and CRS reporting platform.
If you disagree with this policy, please stop using our Services.
1. What information do we collect?
Personal information you disclose to us
We collect personal information that you voluntarily provide when you register on the Services, join a waitlist, download a template, comment on the blog, express interest in obtaining information about us or our products, or otherwise contact us. This may include:
- Names
- Phone numbers
- Email addresses
- Job titles
- Company names
- Billing addresses
Client Data (financial information)
When you use our Services for FATCA, CRS or IRS 1099 reporting, you may upload data about financial accounts, tax identification numbers and entity details (“Client Data”). This data may include:
- Account holder names, addresses and Tax Identification Numbers (TINs)
- Global Intermediary Identification Numbers (GIINs) and ITDREINs
- Account numbers, balances and payment amounts
- Controlling person and substantial owner details
- Self-certification and due diligence records
We process Client Data strictly to validate it and to generate the required XML reports and encrypted filing packages. You upload those packages to the relevant tax authority yourself. We do not use Client Data for any other purpose.
Novus Desktop: local processing
Novus Desktop is in private testing, with early access opening in 2027. When you use it, the client financial data you load is processed locally on your machine, in memory. Novus Desktop does not transmit, store or persist client financial data to our servers, to any database or to any cloud storage. Data is:
- Loaded into memory when you start processing
- Validated and converted to XML in that session
- Discarded from memory once the XML file is generated
The air-gapped deployment, available to Enterprise customers, runs on an isolated machine with no network connection.
Information collected automatically
Some information, such as your Internet Protocol (IP) address, browser type and device characteristics, is collected automatically when you visit our Services. It is used mainly to keep the Services secure and running, and for internal analytics and reporting. On our website’s forms, we store a salted hash of your IP address for abuse prevention, not the address itself.
2. How do we process your information?
We process your information to provide, improve and administer our Services, communicate with you, protect against fraud and comply with applicable law. Specifically:
- To create and secure your account. To set up your account and authenticate you.
- To deliver our Services. Validating Client Data and generating FATCA and CRS XML reports, encrypted filing packages and IRS 1099 files for you to submit.
- To respond to requests. Demo bookings, waitlist sign-ups, template downloads and support questions.
- To send administrative information. Product, service and feature updates, and changes to our terms, conditions and policies.
- To protect our Services. Including fraud monitoring and prevention.
- To comply with legal obligations. Where required by applicable law, regulation or valid legal process.
4. How do we keep your information safe?
We protect your data with technical and organisational security measures, including:
- Encryption in transit and at rest. Data is encrypted in transit with TLS 1.3. Sensitive fields, including TINs, account numbers, names, addresses and balances, are encrypted at rest at the field level with per-customer 256-bit keys, so no plaintext Client Data is stored.
- Encrypted filing packages. IDES packages are encrypted with AES-256-CBC, with the key and IV wrapped using the recipient’s RSA public key.
- Role-based access controls. Access to Client Data is restricted to authorised personnel on a need-to-know basis.
- Logical tenant isolation. Each customer’s data is logically separated within our platform.
- Regular security assessments. We review and test the security of our platform periodically.
- Continuous monitoring. We monitor our infrastructure for anomalous activity, fraud and unauthorised access.
You can read more about our security architecture on our Technology & Security page.
However, no electronic transmission over the Internet or information storage technology can be guaranteed to be 100% secure. We cannot promise or guarantee that hackers, cybercriminals or other unauthorised third parties will not be able to defeat our security.
6. Is your information transferred internationally?
Our primary servers are located in India. If you access our Services from outside India, your information may be transferred to, stored in and processed by us, and by the third parties with whom we share it, in India and other countries.
Where we transfer personal data outside the European Economic Area (EEA) or the United Kingdom, we rely on appropriate safeguards such as Standard Contractual Clauses (SCCs) approved by the European Commission, or other lawful transfer mechanisms.
7. How long do we keep your information?
We keep your information for as long as necessary to fulfil the purposes in this Privacy Policy, unless a longer retention period is required or permitted by law.
Client Data: 60 days after filing
We follow a strict data minimisation policy for the financial data you upload for reporting. All uploaded client financial data and generated reports are automatically and permanently deleted from our servers 60 days after you confirm the successful filing of the corresponding report.
For example, if you successfully file your FATCA or CRS report on 30 June 2026, all data related to that filing is purged from our systems by 29 August 2026.
The 60-day window gives you time to:
- Verify the filing was accepted by the tax authority
- Handle any acknowledgements, rejections or corrections
- Download your own copy of the filed XML and generated reports
- Complete internal post-filing reconciliation
After the 60-day window, the following are deleted automatically:
- Uploaded Excel and CSV source files
- Generated XML reports and encrypted filing packages
- Intermediate validation outputs
- Associated metadata linked to the filing
We retain only your basic account information (name, email, company name, billing history and platform audit logs) to maintain your account and to comply with legal and tax record-keeping requirements.
8. Do we collect information from minors?
We do not knowingly collect data from or market to children under 18 years of age. By using the Services, you represent that you are at least 18 years of age.
9. What are your privacy rights?
EEA and UK residents (GDPR / UK GDPR)
If you are located in the European Economic Area or the United Kingdom, you have the right:
- Of access: to request a copy of the personal data we hold about you
- To rectification: to request correction of inaccurate or incomplete data
- To erasure: to request deletion of your personal data, subject to legal retention obligations
- To restrict processing: to limit how we use your data in certain circumstances
- To data portability: to receive your data in a structured, machine-readable format
- To object: to processing based on legitimate interests
- To lodge a complaint: with your local data protection supervisory authority
India residents (Digital Personal Data Protection Act, 2023)
If you are located in India, you have rights under the Digital Personal Data Protection Act, including the right to access, correct and erase your personal data, and the right to grievance redressal.
California residents (CCPA / CPRA)
If you are a California resident, you have the right to know what personal information we collect, the right to delete it, the right to opt out of the “sale” or “sharing” of personal information (we do not sell or share your data) and the right to non-discrimination for exercising your rights.
Exercising your rights
To exercise any of these rights, email contact [at] novuscompliance [dot] com. We will respond within the timeframe required by applicable law (typically 30 days). We may need to verify your identity before fulfilling your request.
10. Data breach notification
If a personal data breach poses a risk to your rights and freedoms, we will notify the relevant supervisory authority within 72 hours of becoming aware of it, and will notify affected individuals without undue delay where required by law.
11. Controls for Do-Not-Track features
Most web browsers include a Do-Not-Track (“DNT”) feature. No uniform technology standard for recognising and implementing DNT signals has been finalised, so we do not currently respond to DNT browser signals.
12. Do we update this policy?
We may update this Privacy Policy from time to time. The updated version will be indicated by an updated “Last updated” date at the top of this page. We will notify registered users of material changes by email. Please review this policy periodically to stay informed about how we protect your information.
13. Contact us
If you have questions or comments about this policy, or wish to exercise your privacy rights, contact us at:
Binari SoftwareSurvey No 81/5/1/2, Office No. 309, Floor No. 3
Runwal Arcade, Warje
Pune, Maharashtra 411058
India
Email: contact [at] novuscompliance [dot] com
Phone: +91 88884 84178