Privacy Policy

1. Who we are & what this policy covers

Duefy (“Duefy”, “we”, “our”, or “us”) provides a compliance-workflow platform for Chartered Accountant (CA) firms, available at duefiling.com and the application at app.duefiling.com. This Privacy Policy explains how we handle information when you visit our website, create an account, or use the Duefy application (together, the “Service”).

By using the Service you agree to this Policy. It should be read together with our Terms of Service.

2. Whose information is involved

Duefy is used by CA firms to manage their own clients' compliance. Two kinds of information flow through it:

• Firm & user information — details about the firm and the people who log in (partners, managers, accountants, trainees, admins).
• Client data entered by the firm — information a firm records about its clients (company names, compliance items, due dates, documents, fee/outstanding-balance figures, and similar records).

For the client data a firm puts into Duefy, the firm is the data controller and Duefy is the data processor — we process that data only to provide the Service to the firm, and only on the firm's instructions. If you are a client of a firm and have questions about your data, please contact your CA firm; we will support them in responding.

3. Information we collect

3.1 Information you provide

• Account & firm details — name, work email, phone number, firm name, role, and login credentials.
• Client & compliance records — the client, task, due-date, register, document, and status information your firm chooses to enter or upload.
• Billing information — the plan you choose and the fee/outstanding-balance figures your firm records.
• Communications — messages you send us (for example, support requests to support@duefiling.com).

3.2 Information collected automatically

• Usage & log data — actions taken in the app (audit trails), timestamps, and error/diagnostic logs.
• Device & connection data — IP address, browser type, and device information, used for security and to keep the Service working.

3.3 Payment information

Paid plans are processed by our payment provider, Razorpay. Card and bank details are entered directly with Razorpay and are handled under their security standards — Duefy does not see or store your full card number. We receive only confirmation of payment status and basic transaction references needed to activate your plan.

3.4 Please enter only non-sensitive, public business information

Duefy is designed to track compliance — not to hold sensitive credentials. We encourage firms to record only the business information needed to manage compliance, ideally details already available in the public domain, such as company / entity name, GST number, CIN, entity type, and statutory due dates. Please do not store sensitive financial information — such as bank account or card numbers, passwords, PINs, OTPs, or login credentials — about your firm or your clients. We never ask for this information and it is not required to use the Service.

Formats and due dates are for reference only. Any document formats, templates, and due dates shown in the Service are provided for general reference and convenience, not as professional advice. You are advised to consult a licensed Chartered Accountant, Company Secretary, or other qualified professional before executing any document or relying on any due date, and every format and date can be edited to suit your circumstances. Please see our Terms of Service for the full position on this.

4. How we use information

We use information only to run and improve the Service for you, specifically to:

• provide, operate, and maintain the Service and your account;
• authenticate logins and keep accounts secure;
• show reminders, notifications, and reports;
• process payments and manage your subscription;
• respond to your support requests;
• detect, prevent, and investigate abuse, fraud, or security incidents;
• maintain audit trails and meet our own legal and tax obligations; and
• improve reliability and features (using aggregated, non-identifying usage insights where possible).

We do not use your firm's or clients' data to build advertising profiles or to train products for anyone else.

5. We never sell or distribute your data

This is a firm commitment, not just a preference:

• We do not sell, rent, lease, or trade your personal data, your firm's data, or your clients' data to anyone.
• We do not share your data with advertisers, data brokers, or marketing networks.
• We do not distribute one firm's data to another firm — every firm's data is kept logically separated and access-controlled.
• We do not use your clients' confidential compliance information for any purpose other than delivering the Service to you.

6. When we share information

We share information only in these limited situations:

• With service providers (sub-processors) that we use to run the Service, under contracts that require them to protect the data and use it only for us (see Section 7).
• On your instruction — for example, when your firm connects an optional integration such as Zoho.
• For legal reasons — if required by a valid legal request, or to protect the rights, safety, and security of Duefy, our users, or the public.
• In a business transfer — if Duefy is involved in a merger, acquisition, or sale of assets, data may transfer as part of that deal; we will require the successor to honour this Policy, and we will notify you of any material change.

None of these is a sale of your data.

7. Service providers we rely on

We keep our list of providers small and reputable. Today they include:

• Supabase — secure database, authentication, and storage that power the application.
• Vercel — hosting for our website and application.
• Razorpay — payment processing for paid plans.
• Email delivery — to send sign-in links, notifications, and account emails.
• Zoho — only if your firm chooses to connect it, to sync invoice/outstanding-balance data.

Each provider processes data only to help us deliver the Service to you, under confidentiality and data-protection obligations.

8. Data ownership & your control

Your data stays yours. Your firm owns the firm and client data it enters into Duefy. You can access and update most information directly in the app at any time, and you can ask us to help you export or delete it (see Section 11).

Backups are your responsibility. Because your data is yours, you are responsible for keeping your own copies and backups of anything important. Duefy does not provide, and does not represent that it provides, a data backup, archival, or recovery service, and gives no guarantee as to the recoverability of any data. To the maximum extent permitted by law, Duefy is not responsible for any loss, deletion, corruption, or inability to recover data, howsoever caused. In the ordinary course we do not view or review the contents of your data except as needed to operate and support the Service.

9. How we protect your data

• Encryption in transit — all traffic uses HTTPS/TLS.
• Firm-level isolation — row-level security keeps each firm's data separated so users only see data they are authorised to see.
• Access controls — role-based permissions inside the app and least-privilege access to our systems.
• Reputable infrastructure — data is hosted with established cloud providers with their own strong security practices.
• Audit trails — key actions are logged so activity is traceable.

No system can be guaranteed 100% secure, but we work hard to protect your data and to respond quickly if an issue arises.

10. How long we keep data

We keep your data for as long as your account is active and as needed to provide the Service. After an account is closed, we delete or anonymise personal data within a reasonable period, except where we must retain certain records to meet legal, tax, or accounting obligations, or to resolve disputes and enforce our agreements.

11. Your rights & choices

Subject to applicable law, you can ask us to:

• access the personal information we hold about you;
• correct information that is inaccurate;
• export your data in a portable form;
• delete your data; or
• restrict or object to certain processing.

To exercise any of these, email support@duefiling.com. If you are a client of a firm, please raise the request with your firm; as the data processor we will assist them.

12. Cookies

We use only the cookies and local storage needed to sign you in and keep your session working. We do not use third-party advertising or cross-site tracking cookies.

13. Where data is stored

Your data is stored on reputable cloud infrastructure operated by our service providers. Where data is processed in a different location, we take steps to ensure it remains protected to the standard described in this Policy.

14. Children

Duefy is a business tool intended for firms and their authorised staff. It is not directed to children, and we do not knowingly collect personal information from anyone under 18.

15. Changes to this policy

We may update this Policy from time to time. When we do, we will change the “Last updated” date above and, for material changes, take reasonable steps to let you know. Continuing to use the Service after an update means you accept the revised Policy.

16. Contact us

Questions about privacy or this Policy? Email us at support@duefiling.com and our team will help.