Privacy Policy

This Privacy Policy explains how Chartered Books ("Chartered Books", "we", "us") collects, uses, stores, shares and protects personal data when you use our cloud accounting service, and the rights you have. It is published under the Information Technology Act, 2000 and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 ("SPDI Rules"), and is meant to meet the notice and consent requirements of the Digital Personal Data Protection Act, 2023 and the rules made under it (together, the "DPDP Act"), as they come into force.

Our roles differ by data. For information about you as our customer (your account, billing and usage), we decide why and how it is processed, so we are the Data Fiduciary. For the Customer Data you put into the Service about your own customers, vendors, employees and others, you are the Data Fiduciary and we are your Data Processor, acting on your instructions under our Terms of Service.

• Account and contact details: your name, email address, mobile number, password (stored only as a salted hash), country and state, organisation name, and your role in the organisation.
• Organisation and billing details: company name, address, GSTIN, PAN, base currency, fiscal-year settings, plan, and payment information held by our payment provider (we receive only limited details such as card brand, last four digits and payment status).
• Customer Data: the accounting and business records you enter or import, such as invoices, bills, ledgers, bank statements and feeds, tax filings, payroll and timesheet records, documents and attachments. These can include personal data of your customers, vendors and employees (for example names, contact details, PAN, GSTIN, bank account details, salary details). Please enter only what you need and are permitted to hold.
• Sign-in with Google: if you choose it, your name, email address and profile identifier from Google. We do not receive your Google password.
• Usage and device information: IP address, browser and device type, pages and features used, timestamps, error reports and security logs, collected automatically.
• Support communications: messages you send us and the information in them.

Some of this is "sensitive personal data or information" under the SPDI Rules, in particular passwords and financial information such as bank account or payment details. We collect it only with your consent and only for the purposes below.

• To create and secure your account, authenticate you and apply the roles and permissions you set.
• To provide the Service: store your records, produce reports and tax and payroll computations, send documents you ask us to send, and sync integrations you connect.
• To bill you, issue GST invoices and manage your plan and limits.
• To support you, respond to requests and tell you about service, security and billing changes.
• To keep the Service safe, prevent fraud and abuse, debug problems and meet our security obligations (including audit trails and logs).
• To improve the Service using aggregated or de-identified usage information.
• To comply with law, and to establish, exercise or defend legal claims.

We do not sell personal data, and we do not use Customer Data to show advertising.

We process your personal data on the basis of your consent, given when you tick the agreement box at sign-up and when you use features that need it (for example connecting a bank feed), and for the legitimate uses the law permits without consent, such as performing a function required by law or responding to a legal obligation or medical, safety or disaster-related emergency. You may withdraw consent at any time by writing to us or by closing your account; withdrawal does not affect processing already done, and may mean we can no longer provide the Service to you. For Customer Data about other people, the Data Fiduciary (you) is responsible for giving them notice and obtaining any consent needed.

We share personal data only as needed to run the Service, with:

• Your organisation: Authorised Users you invite can see data according to the roles and permissions your administrators set.
• Service providers (data processors) bound by confidentiality and security obligations. These currently include cloud hosting and database providers (such as Railway, Supabase, Vercel and Cloudflare for file storage), payment processing (Stripe), authentication (Google, if you choose it), email delivery, and error monitoring (Sentry). The list may change as the product grows; the current list is available on request.
• Integrations you connect, such as your bank feed provider or government portals, limited to the data needed.
• Professionals and advisers (lawyers, auditors) bound by confidentiality, and in a merger, acquisition or sale of the business, to the successor, who must honour this policy.
• Courts, tax and regulatory authorities and law-enforcement agencies where required by law or a lawful order (for example under the Information Technology Act, 2000 or the CGST Act, 2017), or to protect rights, safety and security.

Our providers may store and process data on servers inside or outside India. Where personal data is transferred outside India we do so only to providers that apply security safeguards at least as protective as this policy requires, and not to any country or territory that the Government of India restricts under the DPDP Act. By using the Service you consent to these transfers for the purposes in this policy.

We follow reasonable security practices appropriate to the data we hold, as the SPDI Rules require. These include encryption of data in transit, encryption of sensitive secrets such as bank-feed credentials at rest, hashed passwords, role-based access control, multi-factor authentication for our administrators, audit logs, access limits for our staff, and regular backups. No system is perfectly secure, so please also use a strong, unique password and protect your own devices.

If a personal-data breach occurs we will investigate promptly, report it to CERT-In within the time its directions require, notify the Data Protection Board of India and affected people as the DPDP Act requires, and tell affected customers so they can meet their own obligations.

• Account and Customer Data are kept while your account is active.
• After you close your account you have 30 days to export your data. We then delete it from live systems and it leaves backups in the ordinary backup cycle, unless we must keep it to meet a legal obligation, resolve a dispute or enforce our agreements.
• Billing and tax records about your subscription are kept for the period required by the CGST Act, 2017, the Companies Act, 2013 and income-tax law.
• System and security logs are kept for at least 180 days, as CERT-In’s directions require.

Indian law requires many businesses to keep their own books and records for several years. Please keep your own copies of anything you must retain.

Under the DPDP Act and the SPDI Rules you can:

• ask for a summary of the personal data we process about you and the third parties we have shared it with;
• ask us to correct inaccurate or incomplete data, update it, or erase it when it is no longer needed for the purpose it was collected or for legal retention;
• review and amend the information you gave us, and withdraw consent at any time;
• have a grievance heard and resolved, and nominate another person to exercise your rights if you die or become incapacitated.

To use any of these rights, write to info@charteredbooks.com from your registered email address. We aim to respond within 30 days. If you are not satisfied with our response, you may complain to the Data Protection Board of India. Requests about Customer Data of your own customers or employees should be made to the organisation that holds it, which is the Data Fiduciary.

We use essential cookies and local storage to keep you signed in, protect your session against cross-site attacks, and remember settings such as your selected company. We do not use advertising cookies. You can block cookies in your browser, but the Service will not work without the essential ones.

We also use Vercel Web Analytics to understand how the Service is used and to find problems. It records page views and basic technical details such as the page visited, the referring site, approximate country, browser and device type. It does not use cookies and does not follow you across other websites. It is not used for advertising, and it does not read the contents of your accounting records: before a page view is reported we remove query strings, fragments, record identifiers and tokens from the page address. Vercel acts as our service provider for this purpose.

The Service is for businesses and is not directed at anyone under 18. We do not knowingly collect personal data from children. If you believe a child has given us personal data, contact us and we will delete it.

The Service and our emails may link to other websites or services. We do not control them and are not responsible for their privacy practices.

We may update this policy from time to time. We will give notice of material changes by email or in the application before they take effect, and the version and date at the top of this page will change. Where the law requires fresh consent for a new use, we will ask for it.

Grievance Officer: [Name and designation]. Chartered Books, [Registered office address]. Email: info@charteredbooks.com. We acknowledge grievances within 48 hours and aim to resolve them within 30 days.