Privacy Policy

Two different relationships exist on this platform, and they matter for your rights:

• For firms that subscribe to Keetu PRM: we are the data fiduciary. We decide how your account data is handled and are answerable to you directly.
• For a firm's own clients: the firm is the data fiduciary and we are a data processor acting on their instructions. If you are a client of a CA firm using Keetu PRM, contact that firm first — they control your records, and we act on their behalf.

• Account data — name, work email, phone number, password (stored only as a bcrypt hash, never in readable form).
• Firm verification data — registered name, constitution, PAN, GSTIN, registration numbers, and documents you upload such as incorporation certificates or a Certificate of Practice. Used solely to verify that a firm is genuine.
• Client and compliance records — the client, entity, filing, document and invoice data a firm enters while using the product.
• Operational logs — IP address, timestamps and actions taken, retained for security, abuse prevention and audit trails.

We do not collect payment card details. Online payments are handled by regulated payment gateways, and card data never reaches our servers.

To provide and secure the service: authenticating logins, generating compliance calendars, sending notifications you have configured, verifying firms, issuing invoices, and investigating security or abuse. We do not sell personal data, and we do not use client records to train machine-learning models.

Data is hosted in India (AWS Asia Pacific, Mumbai). The database is encrypted in transit; uploaded documents are stored in private object storage that is not publicly reachable and is served only through access-checked routes after authentication.

Sub-processors used strictly to run the service: our cloud infrastructure provider (AWS), our application host, our email delivery provider, and — only where a firm enables them — messaging and payment providers. Each receives the minimum data needed for its function. We disclose data to authorities only where compelled by law.

Account and firm data is kept while the account is active. After closure we retain what tax and company law requires us to retain (invoices and financial records), and delete the rest within 90 days. Verification documents are deleted once verification is complete and the retention period for the decision has passed.

Under the Digital Personal Data Protection Act, 2023 you may request access to your data, correction of inaccuracies, erasure, and a summary of processing; you may also nominate someone to exercise these rights on your behalf. Write to privacy@keetuprm.in and we will respond within 30 days. If you are unsatisfied, you may complain to the Data Protection Board of India.

We set one essential cookie to keep you signed in. It is httpOnly, same-site and expires after seven days. We do not use advertising or third-party tracking cookies.

Material changes will be announced in the app before they take effect. Questions about this policy: privacy@keetuprm.in, or see our contact page.