Privacy Policy

Two different relationships exist on this platform, and they matter for your rights:

• For firms that subscribe to Keetu PRM: BrightLabs Infrasoft Solutions Pvt. Ltd. is the data fiduciary. We decide how your account data is handled and are answerable to you directly.
• For a firm's own clients: the firm is the data fiduciary and we are a data processor acting on their instructions. If you are a client of a CA firm using Keetu PRM, contact that firm first — they control your records, and we act on their behalf.

• Account data — name, work email, phone number, password (stored only as a bcrypt hash, never in readable form).
• Firm verification data — registered name, constitution, PAN, GSTIN, registration numbers, and documents you upload such as incorporation certificates or a Certificate of Practice. Used solely to verify that a firm is genuine.
• Client and compliance records — the client, entity, filing, document and invoice data a firm enters while using the product.
• Billing data— the firm's billing name, address, GSTIN, the invoices we raise, and the payment references returned by the gateway.
• Operational logs — IP address, timestamps and actions taken, retained for security, abuse prevention and audit trails.

We do not collect or store card, UPI or netbanking credentials. Online payments are handled on the hosted payment pages of Razorpay Software Private Limited, an RBI-regulated payment gateway. What comes back to us is the payment status, amount, method type and a gateway reference — enough to mark the right invoice paid and nothing more.

For payments a client makes to a CA firm, the firm is the merchant of record and Razorpayprocesses the payment under the firm's own merchant account; BrightLabs Infrasoft Solutions Pvt. Ltd. never receives the funds. Razorpay handles that data as a controller in its own right, under its own privacy policy.

To provide and secure the service: authenticating logins, generating compliance calendars, sending notifications you have configured, verifying firms, issuing invoices and collecting subscription fees, and investigating security or abuse. We do not sell personal data, and we do not use client records to train machine-learning models.

Data is hosted in India (AWS Asia Pacific, Mumbai). The database is encrypted in transit; uploaded documents are stored in private object storage that is not publicly reachable and is served only through access-checked routes after authentication.

Sub-processors used strictly to run the service: our cloud infrastructure provider (AWS), our application host, our email delivery provider, Razorpay Software Private Limited for payment processing, and — only where a firm enables them — messaging providers. Each receives the minimum data needed for its function. We disclose data to authorities only where compelled by law.

Account and firm data is kept while the account is active. After closure we retain what tax and company law requires us to retain (invoices and financial records — normally eight years), and delete the rest within 90 days. Verification documents are deleted once verification is complete and the retention period for the decision has passed. See also the data section of our Refund & Cancellation Policy.

Under the Digital Personal Data Protection Act, 2023 you may request access to your data, correction of inaccuracies, erasure, and a summary of processing; you may also nominate someone to exercise these rights on your behalf. Write to privacy@keetuprm.in and we will respond within 30 days. If you are unsatisfied, escalate to grievance@keetuprm.in, and thereafter you may complain to the Data Protection Board of India.

We set one essential cookie to keep you signed in. It is httpOnly, same-site and expires after seven days. We do not use advertising or third-party tracking cookies.

Material changes will be announced in the app before they take effect. Questions about this policy: privacy@keetuprm.in, or see our contact page for our postal address and phone number.