Privacy Policy

• Adullam Tools is operated by Adullam Corporation Inc. (Seoul, Republic of Korea), which is responsible for the personal data described in this policy. "We" in this policy means Adullam Corporation Inc.
• Amounts entered into a calculator are processed in your browser and are not transmitted unless you use the saving features.
• Accounts are optional. Every calculator and document generator works without one. If you create an account we store your email address and a password hash.
• An account stores only the company profile (name, address, state, CIN, company PAN), GST registrations, a company logo, counterparty presets, the invoice number register and anonymous payroll templates. Employee names, PAN, UAN, ESIC and bank account numbers, and individual pay amounts, are never stored — with or without an account.
• Display preferences (theme, language, secondary currency) are kept only in your browser.
• Web server access logs, including IP address, are retained briefly for security and troubleshooting.
• Our own usage statistics — which pages are opened and how often — are counted without cookies. No visitor identifier is created, so repeat visits cannot be tracked, and the query string that carries calculator inputs is not recorded. Sections 2(e) and 6 give the detail.
• Google Analytics measures how the site is used — which pages are viewed, how visitors arrive and what kind of device they use. Page addresses are sent with the query string removed, so calculator inputs, search terms and GSTINs never reach Google Analytics. Section 6 explains what it receives and how to refuse it; section 4 lists its cookies.
• Google AdSense serves advertising, and advertising vendors set their own cookies and identifiers.
• The company search republishes Indian government open data (MCA / data.gov.in) under GODL-India; section 17 explains it and how to request removal or correction.

The information involved falls into six groups.

(a) What you type into a calculator — salary, basic percentage, rent paid, state of employment, years of service and so on. These values are used for computation inside your browser and are not sent to our server unless you use the saving features. They are reflected in the URL query string so results can be bookmarked and shared, so bear in mind that a link you send may contain salary information.

(b) Automatically generated access records — in serving a request the web server records the IP address, timestamp, requested path, response code and user agent. These are used for security incident response and fault diagnosis, never for advertising or marketing.

(c) Information collected by third parties — advertising vendors such as Google AdSense may collect cookies, device identifiers and approximate location in order to serve and measure advertising. That processing is governed by their own privacy policies. Google Analytics, which we use to measure how the site is used, also sets cookies and receives device and browser information; section 6 sets out what it receives.

(d) Account information — only if you create an account. We store your email address, a password hash (never the password itself), whether the address has been confirmed, your language preference and your login session records. Anything you then choose to save — company profile, logo, invoice number register, anonymous payroll templates — is kept on the server as well. Section 16 lists every item, and everything we deliberately do not store.

(e) Usage statistics — to see which pages are used, our own server records the time of the request (to the second), the page's route name, the language, the two-letter country code (present only on requests that arrive at the old address orvano.in through Cloudflare, which supplies it), whether the device is mobile or desktop, the host name of the referring site, and the name of an action such as running a calculation. No cookies are set and no visitor identifier is created, so repeat visits by the same person cannot be recognised. The IP address and the raw user-agent string are not stored — the user agent is used only to filter bots, then discarded — and the URL query string is not stored either, because it carries the salary figures you entered. These records cannot identify an individual; they are never shared with third parties and never used for advertising.

(f) Registering interest — only if you ask to be notified about a paid tool we are preparing. We store your email address, which tool you asked about, the page you asked from, and the language. We do not ask for your name, company or phone number. The address is used once, to tell you when that tool is ready; it is never used for newsletters or advertising and is never shared. Write to the contact address below and it is deleted immediately.

We never ask for and never accept national identification numbers, passport numbers, bank account numbers or card details. No feature transmits an employee name, PAN, UAN, ESIC number or bank account number to our server — those fields do not exist in any server-side data structure.

The following values are stored in your browser only. They are never transmitted, and you can clear them at any time from your browser settings.

• Theme preference (light / dark / system) — localStorage
• Secondary currency selection — localStorage
• A short-lived cache of the exchange-rate response — sessionStorage, cleared when the tab closes

These are display settings; none of them identifies a person.

We set exactly two cookies of our own (the Google Analytics cookies are listed further down):

• NEXT_LOCALE — remembers the display language you selected. One year lifetime. It does not identify you.
• orvano_session — identifies a signed-in session. It is not set unless you sign in, and it is removed when you sign out. It is httpOnly and SameSite=Lax, so page scripts cannot read it.

Google Analytics (section 6) sets two cookies on this domain: _ga, which tells browsers apart, and _ga_5XK8KXTRLX, which keeps the state of a visit. Each lasts up to two years from the last visit (less in some browsers). They are not set for visitors in the European Economic Area, the United Kingdom or Switzerland. Any other cookie comes from the third-party advertising vendors described in section 5. Blocking cookies in your browser means the language choice will not persist, but every calculator continues to work.

The usage statistics described in section 2(e) use no cookies at all. No visitor identifier is created, so blocking every cookie does not change how they are recorded.

Advertising on this site is served through Google AdSense. In connection with that:

• Third-party vendors, including Google, use cookies to serve ads based on your prior visits to this and other websites.
• Google may use the DoubleClick DART cookie for ad serving.
• Advertising vendors may process IP addresses and device identifiers for impression and click measurement, fraud prevention and frequency capping.
• We cannot read or control the contents of vendor cookies, and we never pass your calculator inputs to any advertising vendor.

If you do not want personalised advertising, you can opt out here:

• Google Ad Settings: https://adssettings.google.com
• How Google uses advertising cookies: https://policies.google.com/technologies/ads
• Digital Advertising Alliance (US): https://optout.aboutads.info
• European users (EDAA): https://www.youronlinechoices.eu
• Network Advertising Initiative: https://optout.networkadvertising.org

Opting out does not remove advertising; it means the ads you see are no longer interest-based.

Three forms of traffic measurement run on this site. The first two set no cookie and create no visitor identifier; Google Analytics does both, as described below.

• Our own usage statistics — the items listed in section 2(e), recorded directly on our own server. No external analytics provider is involved and the records are not shared.
• Cloudflare Web Analytics (old address orvano.in only) — a script inserted automatically by the CDN provider in front of that address (Cloudflare, Inc.). The current address, tools.adullamcorp.com, does not pass through Cloudflare, so this script is not there. It sends the page address, the referring site and page loading performance metrics to Cloudflare. The page address is sent with the query string removed, so the salary figures you enter in a calculator are not included.
• Google Analytics 4 (Google LLC) — measures which pages are viewed, how visitors arrive (the referring site and any utm_ campaign tag), how long a visit lasts, page scrolling, clicks on links to other sites and on file downloads, and the type of device and browser with an approximate location. Google states that Google Analytics 4 does not log or store IP addresses; the address is used in transit to work out the approximate location and to protect the service, and for visitors in the EEA, the UK and Switzerland it is used only for location and discarded immediately.
• What we send to Google Analytics — the page address with the query string removed (only utm_ campaign tags are kept), the referring address trimmed to its site and path, the page title, and for links to other sites and file downloads the address of the link clicked. The salary figures you enter, company search terms and GSTINs are in the query string, so they never reach Google Analytics.
• What we have switched off — Google signals, ad personalisation, user-provided data collection, form interaction tracking, site search tracking, page tracking based on browser history changes, and sharing Analytics data with Google for its own products and services or for modelling contributions and business insights. Google Analytics is not loaded at all if your browser sends a Global Privacy Control signal.
• Visitors in the European Economic Area, the United Kingdom and Switzerland — analytics and advertising storage are denied by default, so no Google Analytics cookie is set and Google receives only cookieless signals that do not directly identify a person (such as browser type and screen size), which it uses for statistical modelling.
• Retention — we have set Google Analytics to keep user- and event-level data for 14 months; Google deletes older data each month. Aggregated reports, such as page view counts, are not affected by this setting.

If you want none of this, the Google Analytics opt-out browser add-on (https://tools.google.com/dlpage/gaoptout) stops Google Analytics, and an ad or tracker blocking extension can block requests to googletagmanager.com, google-analytics.com, static.cloudflareinsights.com and /api/events on this site. Every feature — the calculators and the document generators — keeps working when they are blocked. How Google uses information from sites that use its services: https://policies.google.com/technologies/partner-sites

If this changes — if another analytics tool is introduced, or any of the settings above (what is switched off, the retention period, the default consent) is changed — this policy will be revised beforehand to state what it collects and how to refuse it.

• Delivering the service and remembering display settings — performance of your request and legitimate interests
• Providing accounts, email confirmation, password reset, and saving a company profile, logo and invoice numbering — performance of a contract at your request
• Detecting and responding to security incidents, diagnosing faults — legitimate interests
• Rate limiting sign-in, sign-up and email sending to prevent brute force and email abuse — legitimate interests
• Measuring how the site is used (our own statistics, Cloudflare Web Analytics at the old address orvano.in only, and Google Analytics, section 6) — legitimate interests; for visitors in the EEA, the UK and Switzerland, Google Analytics cookies require consent and are denied by default
• Serving advertising and reconciling revenue — consent where interest-based advertising requires it, otherwise legitimate interests

We do not sell information and we do not build user profiles for disclosure to third parties.

• Web server access logs: deleted after no more than 90 days
• Account data and anything you saved (company profile, logo, number register, payroll templates): until you delete the account
• Login sessions: expire and are deleted 30 days after last use
• Email confirmation and password reset tokens: deleted once used or expired (24 hours and one hour respectively)
• On account deletion: removed from the database immediately. Encrypted operational backups may retain a copy for up to 30 days before they rotate out.
• Browser storage values: until you clear them — they never exist on our server
• Calculator inputs: not retained — they never leave the browser unless you use the saving features
• Google Analytics user- and event-level data: 14 months, then deleted by Google (aggregated reports are kept)
• Cookies and identifiers held by advertising vendors: per their own policies

We do not sell or disclose your information to third parties. We do rely on the following providers to operate the service, and access information may be transferred to the countries where their servers are located.

• Google LLC — advertising (Google AdSense), web analytics (Google Analytics, section 6) and web font delivery
• Exchange rate API provider — serving the rate lookup, which carries no salary data
• Cloudflare, Inc. — CDN, security proxy and web analytics for the old address orvano.in (section 6). Only web requests to orvano.in pass through it; requests to the current address, tools.adullamcorp.com, do not.
• Hosting provider — serving web requests and storing access logs
• Email delivery provider — sends confirmation and password reset messages for account holders only. Never used for marketing.

Where an international transfer occurs it relies on the transfer mechanism offered by that provider, such as standard contractual clauses.

For visitors without an account we hold no name or email address. Google Analytics does keep a usage record tied to its own cookie identifier (_ga) for the period in section 8; clearing cookies means later visits are recorded under a new identifier, but it does not delete what is already there. To have that record deleted, send the value of your _ga cookie to the contact address below. Account holders can access, correct and delete their data from the account screen itself.

• Access and correction — sign in and open account settings (/account) to see and edit the stored email address, company profile and logo. The same screen carries a table naming every item that is stored on the server and every item that is not.
• Deletion — "Delete account" in account settings removes everything immediately once you confirm with your password: the account, company profile, logo, invoice number register, payroll templates and sessions on every device. It cannot be undone. You can also delete just the company profile or logo and keep the account.
• Portability — for a copy of anything not downloadable from the screen, write to the contact address below. We verify ownership through the account email address and respond within 30 days.
• Clearing cookies and site data in your browser removes every stored preference.
• You may use tracking protection or an ad blocker.
• You may opt out of personalised advertising using the links in section 5.

Requests to access or delete access-log entries can be sent to the contact address below. Because logs often contain nothing that identifies an individual, we may need the approximate time of your visit and the IP address in order to locate the relevant records.

Where the EU General Data Protection Regulation or the UK GDPR applies:

• Controller: Adullam Corporation Inc., 6F F61, 602 Yeongdong-daero, Gangnam-gu, Seoul, Republic of Korea.
• Legal bases: legitimate interests (Art. 6(1)(f)) for delivering and securing the service, performance of a contract (Art. 6(1)(b)) for accounts, email confirmation and the saving features, and consent (Art. 6(1)(a)) for non-essential cookies and interest-based advertising.
• You have rights of access, rectification, erasure, restriction, objection, portability, and withdrawal of consent.
• Under the ePrivacy Directive, non-essential cookies may only be set after consent. There is no consent banner on this site yet, so for users in the EEA, the UK and Switzerland analytics and advertising storage are denied by default. A consent banner through a Google-certified consent management platform will be added before interest-based advertising starts, and this section will be revised then.
• Google Analytics sets no cookie for visitors in the EEA, the UK and Switzerland and receives only cookieless signals that do not directly identify a person (section 6).
• We carry out no automated decision-making or profiling that produces legal effects concerning you.
• You have the right to lodge a complaint with a supervisory authority — the data protection authority in your country of residence, or the UK Information Commissioner's Office.

We have not appointed a representative in the EU. Please direct requests and questions to the contact address below.

To the extent India's Digital Personal Data Protection Act, 2023 applies, we act as a Data Fiduciary and seek to observe the following.

• Purpose limitation — data is processed only for the purposes set out in section 7.
• Data minimisation — only what the service needs. Calculator inputs are not collected, and no employee personal data is collected even for account holders.
• Consent and withdrawal — creating an account is your choice, and deleting it in account settings stops the processing at once.
• Web analytics — Google Analytics (section 6) uses a cookie identifier and page addresses with the query string removed. You can refuse it with a Global Privacy Control signal, the Google Analytics opt-out add-on or a tracker blocker.
• Data Principal rights — access, correction, erasure and grievance redressal are recognised.
• Grievance redressal — grievances are handled by Inae Lim, CEO of Adullam Corporation Inc., through the contact address below.

This service is not directed at children and we do not knowingly collect children's personal data.

To the extent Korea's Personal Information Protection Act applies, the personal information we process is the email address and password hash of account holders, plus the IP addresses in access logs. The items, purposes and retention periods appear in sections 2, 7 and 8, and account data is destroyed immediately on deletion of the account. IP addresses in access logs are used only in a form that does not identify an individual unless combined with other information. Through Google Analytics we also process a cookie identifier and the usage record tied to it (behavioural information). It is transferred over the network to Google LLC (United States) each time a page is viewed, kept for the period in section 8, and can be refused as described in section 6.

• Privacy officer: Inae Lim, CEO of Adullam Corporation Inc. Requests and complaints about personal information can be sent to the contact address below.
• You may request access, correction or deletion, and suspension of processing. Account holders can do this directly in account settings (/account); other requests go to the contact address below.
• We send no marketing email or SMS.
• Complaints may also be directed to the Korea Internet & Security Agency's privacy centre (privacy.kisa.or.kr, 118) or the Personal Information Protection Commission (pipc.go.kr).

This service is aimed at HR and finance professionals and is not directed at children as defined by the applicable law of the user's country. If we learn that a child's personal data has been collected, we delete it.

• All traffic is encrypted over HTTPS.
• Because calculation happens in the browser, salary data belonging to visitors who do not use the saving features is never exposed in transit.
• Passwords are never stored. We keep only a scrypt hash with a per-user salt, and comparisons are constant-time.
• Session tokens are stored server-side only as hashes, and the cookie is httpOnly, SameSite=Lax and Secure. Changing a password revokes every session.
• Sign-in, sign-up, password reset and email resends are rate limited per IP address and per email address, which blocks brute force and email abuse.
• Uploaded logos are validated by their actual bytes, and SVG — which can carry scripts — is refused. A stored logo is reachable only from that account’s own signed-in session.
• Account data is reachable by the minimum number of operators needed to run the service, access leaves a server-side record, and database backups are stored encrypted.
• The other server-side database is the public company register described in section 17, which holds nothing beyond what the Government of India already publishes.

No transmission over the internet is ever perfectly secure, and we do not claim absolute safety.

Accounts are optional. Every calculator, plus payslip, board resolution and GST invoice drafting, works without one. An account matters only if you want a company profile, logo and invoice numbering to follow you between devices.

This is the complete list of what is stored on the server.

• Account — email address, password hash (scrypt), confirmation status, language preference, created and updated timestamps
• Login sessions — a hash of the session token, expiry and last-used time
• Company profile — legal name, trade name, address, city, postcode, state, country code, CIN or LLPIN, company PAN, secondary currency
• GST registrations — GSTIN, state code, branch label and which registration is the default. Registration is per state, and a state may hold more than one (CGST Act s.22(1), s.25(2)). There are no columns for branch contact names or phone numbers.
• Counterparty presets — a counterparty’s legal name, address, state, GSTIN, default place of supply, default HSN/SAC, default rate and payment terms. Business information; contact names, emails and phone numbers are not stored.
• Company logo — the uploaded image (PNG, JPG or WebP, up to 512KB)
• Invoice number register — series prefix, last number, financial year, issue date, total and recipient GSTIN. This is the minimum needed to keep invoice numbering unbroken and unique as Indian GST rules require.
• Anonymous payroll templates — component names, percentages, state, financial year, EPF options and CTC structure. Nothing that ties a template to a named person.

Conversely, the following never reaches the server even for account holders, and stays in your browser.

• Employee names or display names — on payslips we suggest an employee code or initials rather than a real name.
• Employee PAN, UAN, ESIC number and bank account numbers
• Individual pay amounts and TDS projection results
• Director lists and the text of board resolutions
• Invoice line item detail — not stored unless you explicitly choose to save it
• Theme, secondary currency and the exchange-rate cache

This boundary is not held together by policy wording alone. The items listed as "not stored" have no server-side data structure to live in, and when a payroll template is saved we mechanically reject it if any field name means an employee name, PAN, bank account number or similar.

Access, correction and deletion procedures for account data are in section 10. Deleting an account removes every server-stored item listed above immediately, and removes it from encrypted backups within 30 days.

We may use an external email provider to send confirmation and password reset messages. In that case the recipient address and message body pass through that provider; we will update this policy if the provider changes. We send no marketing email.

The company search at /company republishes an open dataset of the Indian company register. This section explains where it comes from and how to ask us to remove or correct an entry.

Source and licence. The data is the "Registrars of Companies (RoC)-wise Company Master Data" resource published on data.gov.in by the Ministry of Corporate Affairs (MCA), Government of India, under the Government Open Data License - India (GODL-India). Attribution is given on every page that shows it, together with the date of the snapshot we hold. We are a republisher, not the source of record.

What is shown. Sixteen fields per entity: identifier (CIN, LLPIN or, for some foreign companies, FCRN), name, registrar, category, sub-category, class, authorised and paid-up capital, date of incorporation, registered office address, listing status, status, state, Indian or foreign, NIC code and industrial classification. Alongside them we show only explanations worked out from those same fields (registrar office, industry heading, age, currency conversions); nothing is added from other sources, and we hold no director names, DINs, financial statements, charges or litigation records.

Registered addresses. The registered office is a company's official address, but small Indian companies frequently register at a director's home, so an address in this dataset can be residential. We therefore publish addresses exactly as the government does and go no further:

• No maps, no geocoding and no coordinates.
• No search or filtering by address - the address field is deliberately excluded from the search index.
• No reverse lookup of which companies share an address, and no bulk export of the dataset from this site.

Removal and correction requests. Write to the contact address below with the CIN or LLPIN, the URL of the page concerned, what is wrong or what you want removed, and your relationship to the entity. Two things to know before you write:

• We cannot change the register. If the underlying record is wrong, the correction has to be made at the MCA first; once the corrected data reaches the data.gov.in release, our next refresh picks it up.
• What we can do immediately is de-index a specific page, so it drops out of search engines, and suppress it from our own search results while a request is assessed. Requests are acknowledged and handled within 30 days.

Legal basis for this processing: our legitimate interest in making official public-register information accessible and understandable to foreign businesses operating in India, together with the terms of GODL-India. Where local law gives you a right to object to that processing, the contact address below is the channel for it.

We revise this policy when the law changes, when features are added, or when the advertising or analytics set-up changes. Each revision updates the last-updated date on this page and is recorded below with what changed. Continued use after a revision means you accept the revised policy.

• 2026-11-15 — The service was renamed from Orvano to Adullam Tools and moved to tools.adullamcorp.com. The new address does not pass through Cloudflare, so everything Cloudflare is involved in (the country code in section 2(e), Cloudflare Web Analytics in section 6 and the processor entry in section 9) is now limited to the old address orvano.in. The address for questions and deletion requests also changed (see the contact box at the end of this page). The operator and the data processed are unchanged.
• 2026-10-14 — Google Analytics 4 introduced: what it receives, its cookies and how to refuse it (sections 4 and 6), with matching changes to purposes, retention, transfers, your rights and the regional notices (sections 7 to 13).
• 2026-10-12 — The operator, Adullam Corporation Inc., named as the party responsible for personal data, and a privacy officer designated (sections 1, 11, 12 and 13).