CA Assist (caassist.app), operated by Cognitive Automation ("CA Assist", "we", "us")
1. About this policy
CA Assist is a software platform that helps chartered accountancy firms ("CA Firms") keep their clients' documents organised, answer document requests on WhatsApp, and collect their fees. This policy explains what personal data we handle, why, who we share it with, how long we keep it and what rights you have.
We handle personal data in two roles:
| If you are | Our role | Read |
|---|---|---|
| A visitor to caassist.app, or a partner or staff member using a CA Firm's account | We decide how your data is used (Data Fiduciary) | Sections 2 to 13 |
| A client of a CA Firm whose documents or phone number the CA Firm keeps in CA Assist | We process your data on the CA Firm's behalf and on its instructions (Data Processor). The CA Firm is responsible for it. | Section 14 |
2. Who to contact
Grievance Officer and data protection contact: Grievance Officer, Cognitive Automation
Email: admin@caassist.app (or our contact form) | Postal address: Gujarat, India
We acknowledge every complaint within 24 hours and resolve it within 7 days. If a matter needs a CA Firm to act, we tell you so, pass it on the same day and tell you when to expect an answer.
3. Personal data we collect
3.1 Account data. Your name, email address, mobile number, designation and role in the firm, your firm's name, and your profile preferences (such as language).
3.2 Firm verification data. ICAI firm registration number, firm PAN, GSTIN and business address, and the result of our checks. We use these to confirm that an account belongs to a genuine firm, to prevent duplicate trials, repeat refund claims and referral abuse, and to keep one firm from registering twice. For duplicate checks we store keyed one-way hashes of these identifiers, not readable copies.
3.3 Billing data. Billing name, address, state, GSTIN, billing email, our GST invoices and credit notes to you, payment references and status, refund requests (including the reason you give) and their outcome, and, if you turn on automatic renewal, Razorpay's references to your mandate (customer and mandate ids, whether it is UPI AutoPay or a card, the maximum amount you approved and its status). You enter card, UPI and netbanking details only on Razorpay's secure checkout. We never receive or store them.
3.4 Sign-in and security data. Sign-in events, IP address, browser and device information, session cookies, and two-factor authentication settings. If you choose Sign in with Google, Google shares your name, email address and profile picture with us; we do not receive your Google password.
3.5 Usage data. Pages and features used, performance and error information. Usage data does not include the contents of documents.
3.6 Communications. Messages you send to our support team, and records of the service emails and in-app notifications we send you (for example plan expiry reminders).
3.7 Legal records. Which version of our terms and policies you accepted (with the SHA-256 fingerprint of that version's exact text), when, and from which IP address and browser.
3.8 Referral data. Your referral code and the status and dates of firms you referred. A referrer sees only the status and date of each referral, never the referred firm's data. If your firm receives referral rewards as money, the UPI ID your firm's owner gives for those payments (stored encrypted; shown to you only in part) and the amount, date and bank transaction reference (UTR) of each payment. We never ask for a bank account number for this.
3.9 Reviews. If you are a firm's owner or admin and choose to review CA Assist: your star rating, what you wrote, the name you want shown, your firm's name, and whether you agreed to show the review on caassist.app. If you agree, we also keep a small copy of your profile photo (if you have one) to show beside it. We also record when we asked you for a review and whether you chose Not now or Don't ask again.
3.10 What we never ask for. We do not ask for or store passwords to the GST or Income-tax portals, card numbers, bank account numbers or Aadhaar numbers, and our WhatsApp assistant never requests them from anyone.
4. How we collect it
From you when you register, set up your firm or contact us; automatically when you use the platform; from Google if you sign in with Google; from public sources used to verify a business (for example GSTIN status); and from our payment and messaging providers about the status of payments and messages.
5. Why we use it, and on what basis
| Purpose | Examples | Basis |
|---|---|---|
| Provide the platform | Create and secure your account, run the dashboard and WhatsApp assistant, store documents, provide support | Your consent given at sign-up, and to perform our contract with your firm |
| Verify firms and prevent abuse | Firm verification, duplicate-trial and fraud checks, referral integrity | Consent and legitimate uses permitted by law |
| Billing and tax compliance | GST invoices, payment records, accounting | Contract and legal obligation |
| Pay referral rewards | Sending money rewards to the UPI ID your firm gives, keeping the payment records | Contract (the Referral Program Terms) and legal obligation |
| Keep the platform secure | Detecting misuse, incident response, audit logs, automatic sign-out after 7 days without use, and a check that the sign-up, log-in, password-reset and contact forms are used by people rather than automated programs | Legitimate uses permitted by law, legal obligation (CERT-In directions) |
| Tell you what you need to know | Plan expiry and renewal reminders (7, 3 and 1 day before), payment receipts, security alerts, changes to terms, service announcements about changes to the platform or interruptions | Contract |
| Tell you about our referral programme | While the programme is open: one email to your firm's owner during the free trial, and an invitation on the dashboard that you can dismiss or switch off. Every such email has an unsubscribe link; you can also switch it off under My account | Your consent given at sign-up; withdraw it any time with the unsubscribe link or under My account |
| Show announcements in the app | Pop-ups on the dashboard about CA Assist's features, offers and the referral programme, chosen by your role and your firm's plan. Each one has Don't show again. We record which pop-ups you were shown, clicked or turned off, so we do not show them more often than set | Your consent given at sign-up, and to perform our contract with your firm |
| Ask for and show reviews | After your firm has used CA Assist for a while (30 days by default), we may ask its owner and admins once on the dashboard for a review, with Not now and Don't ask again. A review is shown on caassist.app, with the name you chose, your firm's name and your profile photo, only if you tick the box agreeing to it (it is never pre-ticked). We show reviews of at least 3.5 stars whose words read as positive, checked automatically on our own servers; other reviews are read only by our staff to improve CA Assist, and our staff may hide any review | Your consent, which you can withdraw at any time by deleting the review under My account |
| Tell you about CA Assist's news, events, offers and tips | By email and in the app. Every such email has an unsubscribe link, and you can switch them off under My account at any time | Your consent given at sign-up; withdraw it any time with the unsubscribe link or under My account |
| Improve the platform | Aggregated usage statistics that do not identify you | Legitimate uses permitted by law |
We do not sell personal data. We do not use documents or client data to train AI models, ours or anyone else's. Automated reading of documents is used only to suggest how a document should be filed (see §12).
You may withdraw consent at any time, as easily as you gave it: write to the Grievance Officer, or delete your account under My account. This does not affect processing already done. Withdrawing consent to data we need to run your account means we can no longer provide the platform to you.
6. Where your data is stored
Our databases and document storage are in India (Mumbai, AWS ap-south-1). Some providers listed in §7 process limited data outside India to do their job (for example WhatsApp message delivery by Meta, or email delivery). We transfer personal data outside India only as the law permits, and we will follow any restriction the Government of India notifies under the DPDP Act.
7. Who we share it with
We share personal data only with the providers that run parts of the platform for us, under contracts that require them to protect it and use it only for us, and with authorities when the law requires.
| Provider | What they do for us | Data involved | Where |
|---|---|---|---|
| Amazon Web Services | Application servers and encrypted document storage | All platform data | India (Mumbai) |
| Supabase | Database and sign-in service | Account, firm and platform data | India (Mumbai) |
| Vercel | Serves the caassist.app website and app pages; counts visits to our public pages and measures their speed (Web Analytics, Speed Insights) | Page requests, IP address; for visit counts and speed: the public page, the site you came from, country, browser, device type and page speed | India (Mumbai) for app functions; global network for page delivery and statistics |
| Razorpay | Payment processing for CA Assist plans | Billing name, email, amount; payment details go directly to Razorpay | India |
| Resend | Sending service emails | Email address, name, email content | Japan (Tokyo) |
| Meta (WhatsApp Business Platform) | Delivering WhatsApp messages for CA Firms | Phone numbers, message content, documents sent | Global |
| Sign in with Google (only if you choose it) | Name, email, profile picture | Global | |
| Cloudflare (Turnstile) | Checks that the sign-up, log-in, password-reset and contact forms are used by people, not automated programs | Technical signals from your browser and device during the check, such as your IP address and browser characteristics; never what you type into the form | Global network |
| Google Workspace | Our company mailbox, admin@caassist.app | What you write to us by email | Global |
| Professional advisers | Legal, tax and audit advice to us | As needed | India |
| Government and regulators | When required by law or a lawful order | As required | India |
If CA Assist is merged, acquired or its assets sold, personal data may pass to the new owner under the same protections, and we will tell you first.
8. Cookies
We use only strictly necessary cookies: to keep you signed in (session cookies from our sign-in service), to sign you out automatically after 7 days without use, and to protect forms against misuse. Inside the app we also set one preference cookie (ca_sidebar) that remembers which sections of the side menu you opened, so the menu looks the same on your next visit without a flicker; it holds only those section names, no personal data, is never sent to anyone else and expires after 1 year. We do not use advertising or cross-site tracking cookies. If we add analytics cookies in future we will ask for your consent first. Blocking necessary cookies will stop you signing in.
Security check on forms. On the sign-up, log-in, password-reset and contact forms, a check from Cloudflare (Turnstile) runs in a small frame to tell people from automated programs. Usually you see nothing; occasionally it asks you to tick a box. Cloudflare uses what it reads during the check only for that purpose and for keeping its service secure, not for advertising.
Visit statistics without cookies. On our public pages (the home page, pricing, security, contact, sign-up, log-in and these legal pages), Vercel Web Analytics counts visits and Vercel Speed Insights measures how fast the pages load. They set no cookies and store nothing on your device. Visitors are told apart by a one-way code made from the request, which is discarded after 24 hours, so the statistics cannot be tied to you. They record the page, the site you came from, your country, browser and device type, and page speed. Nothing is measured inside a firm's workspace, and no document, client or account data is included.
9. How long we keep it
| Data | How long |
|---|---|
| Account and profile data | While the account exists, then 3 years for legal claims and accounting, then deleted or anonymised |
| GST invoices, credit notes, payment, refund and billing records | 8 years from the end of the relevant financial year, as tax law requires |
| Documents and client data kept for a CA Firm | Until the CA Firm deletes them. If the firm's account closes, they are kept for 60 days so the firm can export them, then deleted; backup copies are cleared within 90 days |
| An account you delete yourself (My account → Delete account) | Deactivated for 30 days so you can restore it, then deleted. For the owner this includes the firm's workspace (clients, documents, WhatsApp history). Our GST invoices, payment records, audit and consent log entries, terms acceptance records and the one-way anti-abuse hashes are kept as listed here, with the records they point to anonymised; stored files are removed with it, raw webhook copies within 30 days, and backup copies within 90 days |
| An account deleted because its owner claimed the 7-day refund (Cancellation and Refund Policy 5.4) | Deleted immediately when the owner confirms the claim, with no restore period: the firm's workspace, clients, documents, WhatsApp history and every member's access. We keep our GST invoices and credit notes, payment and refund records, the record of the claim and its confirmation (time, IP address, browser, policy version), audit and consent log entries and the one-way anti-abuse hashes, as listed here; stored files and backups are cleared as for any deleted account |
| Accounts that never paid after the free trial | Suspended at trial end, closed after 60 days, then deleted as above |
| The UPI ID given for referral rewards | Until your firm removes or replaces it, or the account is deleted. The records of money already paid (amount, date, UTR and the masked UPI ID) are kept for 8 years from the end of the financial year, as tax law requires |
| One-way hashes used to stop repeat free trials, repeat refund claims and referral abuse | Up to 7 years after closure; they cannot be read back into identifiers |
| Security and access logs | At least 1 year, kept in India (CERT-In directions and DPDP Rules), up to 2 years |
| Terms acceptance and consent records | For the life of the account plus 3 years |
| Support messages | 2 years |
| Which dashboard pop-ups you were shown, clicked or turned off | While your account exists; deleted with it |
| A review of CA Assist, and its photo copy | Until you, or your firm's owner or an admin, delete it under My account, or your account or your firm's account is deleted. It leaves our website within an hour of being deleted |
| When we asked you for a review and your answer | While your account exists; deleted with it |
| Which messages from CA Assist you were sent, and whether the email was delivered | While your account exists; deleted with it |
We may keep data longer where the law requires it or to deal with a legal claim.
10. How we protect it
- Firm-by-firm isolation enforced in the database itself (row-level security), so one firm can never see another firm's data, even through a software bug in one screen.
- Encryption in transit (HTTPS/TLS) and at rest (database and document storage).
- Access control: role-based permissions inside each firm (owner, admin, staff, viewer), optional two-factor authentication, and automatic sign-out after 7 days without use.
- Least-privilege infrastructure: no long-lived keys on servers, secrets kept in a managed secrets store, every administrative server action logged.
- Files are virus-scanned before they are stored.
- Audit logs of sensitive actions such as sending, downloading and deleting documents.
- Payment details never touch our systems.
- An incident response process with CERT-In reporting within 6 hours where the directions apply.
No system is completely secure. If you think your account has been misused, write to us straight away.
If a breach affects your personal data, we will inform you and the Data Protection Board of India as the DPDP Act requires, and where we hold data for a CA Firm we will tell the firm promptly and help it meet its own duties.
11. Your rights
Subject to the law, you can ask us to:
- tell you what personal data we hold about you and how we use it, and who we have shared it with;
- correct, complete or update it;
- erase it, where we no longer need it and the law does not require us to keep it;
- stop using it for anything you consented to (withdraw consent);
- resolve a grievance about how we handled it; and
- let a person you nominate exercise these rights if you die or become unable to.
Write to the Grievance Officer (§2). We may need to confirm your identity first. You can correct most account details yourself under My account, and delete your account there too: we confirm by email, keep it deactivated and restorable for 30 days, remind you 7 and 2 days before, and then erase it. An owner who claims the 7-day refund instead has the firm's account erased at once, with no restore period, as the Cancellation and Refund Policy explains. If you are not satisfied with our answer, you may complain to the Data Protection Board of India once its complaint procedure applies. If your complaint is about content on the platform under the IT Rules, you may instead appeal to the Grievance Appellate Committee (gac.gov.in) within 30 days of our decision.
12. Automated processing
When a CA Firm uploads a document, CA Assist reads it automatically to suggest which client, return type and period it belongs to. Suggestions it is unsure about go to the firm's review queue for a person to check. These suggestions only help file documents; they do not make decisions about you.
13. Children
CA Assist is for businesses and is not meant for anyone under 18. We do not knowingly collect children's data. If you think a child's data has reached us, contact us and we will delete it.
14. If you are a client of a CA Firm
Your CA Firm uses CA Assist to keep and send your documents. Your CA Firm is the Data Fiduciary for your data; we process it only on its behalf and on its instructions.
- What we process for the CA Firm: your name, phone number, business name, GSTIN or PAN, the documents your CA Firm prepared for you, your document requests and WhatsApp messages with the firm's assistant, whether you paid a document fee, and your consent or opt-out.
- Why: to send you the documents you ask for on WhatsApp, to confirm payment when your firm charges a fee, and to keep a record of what was sent.
- Your choices: reply STOP on WhatsApp at any time to stop messages. To see, correct or delete your data, contact your CA Firm. If you write to us, we will pass your request to your firm and help it respond. Your firm may need to keep some records under professional or tax rules.
- Fees you pay go straight to your CA Firm's own payment account through its payment gateway. CA Assist never receives your money or your card, UPI or bank details.
- WhatsApp is operated by Meta, which handles message content and metadata under its own terms and privacy policy.
15. Links to other sites
CA Assist links to other services (for example Razorpay, WhatsApp or government portals). Their privacy practices are their own.
16. Changes to this policy
We will give at least 30 days' notice by email and in the app before a material change takes effect, and ask you to accept it again where the law requires. The "Last updated" date shows the latest version.
17. Governing law
This policy is governed by the laws of India. Disputes are resolved as set out in our Terms and Conditions. This policy is written in English; on request we provide it in any language listed in the Eighth Schedule to the Constitution of India.