Privacy Policy
Last updated: 20 August 2026
Kagajbook ("we", "us", "our") is a Practice Management CRM & Client Portal built for Chartered Accountants, GST Practitioners, Tax Consultants and their clients. This Privacy Policy explains what information we collect through our website, mobile app (PWA / Android), and WhatsApp integration, how we use it, and the rights you have. By using Kagajbook you agree to this Policy.
1. Our Core Data Promise
- We do not sell, rent, or share your personal or financial data with advertisers or third-party marketers — ever.
- Your documents (PAN, Aadhaar, GST returns, invoices, bank statements, contracts, etc.) are stored in encrypted, industry-grade third-party cloud storage. Kagajbook stores only the references (file name, size, timestamp, secure URL) needed to display them back to you.
- You own your data. You can export or permanently delete it at any time from your account settings.
2. Information We Collect
a) Account & Profile: name, email, mobile number, business/firm name, GSTIN, PAN, membership number (for CAs / GSTPs), password (hashed with bcrypt).
b) Client & Practice Data: client contact details, tax filings, compliance dates, tasks, notes, invoices, and documents you or your team upload.
c) Payment Data: handled entirely by Razorpay. Kagajbook never sees or stores card / UPI / net-banking credentials — only a transaction ID and status.
d) Communication: messages, OTPs, and PDF invoices sent through the official Meta WhatsApp Business Cloud API. We store delivery status but never read the contents of your personal WhatsApp inbox.
e) Technical: IP address, browser type, device model, app version and basic analytics (page views, feature usage) — used only to improve stability and detect abuse.
3. How We Use Your Information
- To create and secure your account and authenticate logins (OTP, password reset).
- To provide the CRM services you signed up for: client management, compliance calendar, DMS, billing, reports.
- To send transactional notifications (OTPs, invoice PDFs, compliance reminders) via WhatsApp / email.
- To process subscription payments through Razorpay.
- To respond to your support requests and to improve the platform.
- To comply with Indian tax, accounting and legal obligations where applicable.
4. Legal Basis
We process personal data based on: (a) the contract between you and Kagajbook when you subscribe, (b) your explicit consent when you enter client data or upload documents on behalf of your clients, (c) our legitimate interest in providing and securing the service, and (d) compliance with applicable Indian law (IT Act 2000, DPDP Act 2023, Income-Tax Act, GST Act).
5. Roles: Controller vs Processor
For data that a Tax Professional uploads about their Clients, the Tax Professional acts as the Data Controller and Kagajbook acts as the Data Processor. Clients using the Client Portal should contact their appointed CA / GSTP for any data-related requests. Kagajbook will support the Controller in fulfilling such requests promptly.
6. Security Measures
- HTTPS / TLS 1.2+ encryption for all data in transit.
- Encryption-at-rest on cloud storage for uploaded documents.
- Passwords are salted and hashed with bcrypt — we can never see them.
- Per-tenant data isolation: no professional or client can access another tenant's data.
- Role-based access control (Super Admin / Professional / Staff / Client).
- Rate-limiting and WhatsApp OTP for sensitive actions (login, password reset).
7. Third-Party Services We Use
- Razorpay — payment processing (their Privacy Policy).
- Meta WhatsApp Business Cloud API — OTPs, notifications and invoice PDF delivery (their Privacy Policy).
- Cloud storage providers (AWS S3 / Google Cloud Storage / Azure) — encrypted document hosting.
- MongoDB Atlas — encrypted database hosting (India / Asia region).
We only share the minimum data these services need to perform their function. We do not authorize them to use your data for their own marketing.
8. Data Retention & Deletion
- Active accounts: data is retained as long as your subscription is active.
- Cancelled accounts: data is retained for 30 days for possible restore, then permanently deleted.
- Financial / GST / tax records may be retained up to 8 years to comply with Indian tax law even after deletion, in an encrypted archived form, if required by statute.
- You can request immediate deletion at any time by emailing us (see Contact section).
9. Your Rights (DPDP Act 2023)
- Access & Portability: download a copy of your data from Settings → Export.
- Correction: edit any incorrect data directly in your account.
- Erasure: delete your account and associated data at any time.
- Withdraw consent: revoke consent for WhatsApp / email notifications from your profile.
- Grievance: escalate to our Grievance Officer (see below).
10. Children's Privacy
Kagajbook is a B2B professional service and is not intended for use by anyone under 18. We do not knowingly collect personal information from children. If you believe we have inadvertently collected such data, please contact us and we will delete it promptly.
11. Cookies
We use only essential cookies required to keep you logged in and to remember your UI preferences (theme, row density). We do not use advertising cookies or third-party tracking pixels.
12. Cross-Border Data Transfer
Data is primarily stored in India / Asia-Pacific cloud regions. Where transfer outside India is necessary (e.g. Meta WhatsApp Cloud API), we rely on the standard contractual clauses and safeguards provided by these certified vendors.
13. Changes to This Policy
We may update this Privacy Policy from time to time. Material changes will be notified via email and in-app announcement at least 7 days before they take effect. The "Last updated" date at the top always reflects the current version.
14. Contact & Grievance Officer
For any privacy-related question, data-access request, or complaint, please contact: