CtrlFirm

Privacy Policy

Last updated:

This policy explains how ("CtrlFirm", "we") collects, uses, stores and shares personal data when you use the CtrlFirm practice management platform. It is published under the Digital Personal Data Protection Act, 2023 ("DPDP Act"), the Information Technology Act, 2000 and the rules made under them.

1. Who is responsible for what

  • Your account data. For the details of the firm and its users (names, emails, phone numbers, login and billing records), CtrlFirm decides how the data is used and is the Data Fiduciary.
  • Your clients' data. For the data a firm enters about its own clients (names, PAN, GSTIN, contact details, documents, portal credentials, tasks, invoices and messages), the firm is the Data Fiduciary and CtrlFirm processes it only on the firm's instructions, as a Data Processor. The firm is responsible for having a lawful basis and giving its clients any required notice.

2. Data we collect

  • Account details: firm name, FRN, user names, email addresses, phone numbers and roles.
  • Client records entered by the firm, including uploaded documents and encrypted portal credentials.
  • WhatsApp messages sent and received through the firm's connected WhatsApp Business number.
  • Billing records: subscription and credit purchases, invoices and payment references. Card and bank details are handled by our payment gateway; we do not store them.
  • Technical data: IP address, browser, device and activity logs used for security and troubleshooting.

3. How we use it

  • To provide the service: compliance tracking, tasks, documents, billing and WhatsApp messaging.
  • To process payments and issue GST invoices for our own charges.
  • To secure accounts, prevent abuse and investigate incidents.
  • To send service notices such as password resets, billing alerts and changes to these terms.
  • To meet legal obligations, including tax record keeping.

We do not sell personal data and do not use client data for advertising.

4. Service providers we share data with

We share data only as needed to run the service, with providers bound by confidentiality and security obligations:

  • Supabase: database, authentication and file storage.
  • Vercel: application hosting.
  • Meta Platforms (WhatsApp Business Cloud API): delivery of WhatsApp messages the firm sends.
  • Resend: transactional email such as password resets.
  • Razorpay: payment processing.

Some of these providers may process data outside India. Where they do, we rely on their contractual and security commitments, and on transfers permitted under the DPDP Act.

We may also disclose data where required by law, court order or a government authority.

5. Security

Data is encrypted in transit. Each firm's data is isolated from other firms by database access rules. Client portal credentials are stored encrypted, and revealing them is permission-controlled and logged. No system is perfectly secure. If a personal data breach affects you, we will notify you and the Data Protection Board as the DPDP Act requires.

6. Retention

We keep data while the firm's account is active. After an account is closed, we delete or anonymise it within 90 days, except records we must keep by law. For example, tax invoices are kept for the period required under the GST law.

7. Your rights

Under the DPDP Act you may ask to access, correct, update or erase your personal data, withdraw consent, and nominate another person to exercise these rights. A firm can also ask for an export of its data or for its account to be deleted. Clients of a firm should contact that firm first, because the firm controls their data. Write to . We respond within 30 days.

8. Cookies

We use only the cookies needed to keep you signed in and to secure your session. We do not use advertising or cross-site tracking cookies.

9. Children

The service is meant for professional firms and is not directed at anyone under 18.

10. Grievance Officer


Email:
,

We acknowledge grievances within 48 hours and aim to resolve them within 30 days. If you are not satisfied, you may complain to the Data Protection Board of India.

11. Changes

We may update this policy. We will tell account owners about material changes by email or in the app before they take effect.