Privacy Policy

If you are a firm's client: the firm decides what information about you is collected and why. The firm is responsible for it (the “Data Fiduciary”), and AuditSetu processes it on the firm's behalf. For most requests about your data, contact your firm first. We will help them respond.

If you are a firm owner or staff member: we are responsible for your account information, and for how we run the platform.

• Account details — name, email, phone number, and your password, which is stored only in scrambled (hashed) form. If you turn on two-factor authentication, the key that generates your codes.
• Business and tax identity — company name, address, PAN, GSTIN, CIN and TAN, and Aadhaar number where it is needed for an income tax return.
• Financial and tax records — documents you upload (such as returns, statements, invoices and Form 16), bank transactions, GST and TDS entries, income tax computations, and invoices and payments.
• Employment records, for a firm's own staff — check-in and check-out times, leave, salary, payslips and expense claims.
• Messages — team chat messages and files, direct messages, meeting arrangements, and WhatsApp messages sent to a firm that uses WhatsApp. Video meetings are not recorded.
• Website enquiries — when a firm uses our form on its own website: the name, email, phone number and message a visitor sends, with the page, IP address and browser it came from. We collect these for the firm.
• Technical information — IP address, browser and device type, sign-in sessions, a log of actions taken in the account, and error reports.

We do not track your location.

• to provide the service: onboarding, documents, tax work, tasks, attendance, payroll, invoicing and messaging;
• to check details such as GSTIN, PAN and CIN against government records, when a firm asks for it;
• to read details from uploaded documents, where a firm has that switched on;
• to send account and notification emails;
• to keep the platform secure: limiting repeated requests, keeping logs, and investigating misuse;
• to find and fix errors, and to understand how the product is used, without linking that to your name or email;
• to meet legal obligations.

We use the following services to run AuditSetu. Each receives only what it needs for its purpose.

We use Anthropic's commercial service, whose terms do not allow it to use your documents to train its models.

Our application and database run on servers in Singapore. Some of the services above may process data in other countries. Where data leaves India, we rely on those services' contractual commitments to protect it, and on any limits the law places on such transfers.

• Team chat messages and their files: deleted automatically after 100 days.
• Activity logs: deleted automatically after 180 days.
• Website enquiries: kept until the firm deletes them.
• Everything else: kept while the account is active, and afterwards for as long as the law requires — tax records in particular have legal retention periods.

Data is encrypted in transit, and our database and storage providers encrypt it at rest. Each firm's data is kept separate, passwords are stored only in hashed form, two-factor authentication is available, and repeated or suspicious requests are limited. No system is completely secure; if a breach affects your data, we will notify you and the authorities as the law requires.

Under the DPDP Act, you can:

• ask for a summary of the personal data held about you and how it is processed;
• ask for it to be corrected, completed or updated;
• ask for it to be erased, unless the law requires it to be kept;
• withdraw consent you have given, though this may stop parts of the service working for you;
• nominate someone to exercise these rights if you die or cannot act;
• have a complaint dealt with by our Grievance Officer, and then by the Data Protection Board of India.

If you are a firm's client, send requests to your firm first, as it is responsible for your data. You can also contact us directly, and we will pass the request on.

We use cookies that are needed to keep you signed in and to protect forms against misuse. Our usage analytics (PostHog) stores an identifier in your browser to count visits. We do not use advertising cookies.

AuditSetu is not intended for anyone under 18, and we do not knowingly collect data about children except where a firm holds it as part of a client's tax records.

[Grievance Officer name], [Registered company name]. Email: [grievance email, e.g. grievance@auditsetu.com].

We will update this policy when our practices change. The version and effective date above show which text applies, and we will tell you about significant changes. See also our Terms of Service.