Privacy policy

Last updated: 25 October 2026

This policy explains what information Firmora ("we", "us") collects when a CA firm ("you") uses the Firmora web application and the client pages it creates, why we collect it, and the choices you have. It is written with India's Digital Personal Data Protection Act, 2023 in mind.

1. Who this applies to

• Firm users: the CA or firm that signs up for Firmora.
• Your clients: people whose details you enter into Firmora, or who upload documents through a link you send them. For their data, you decide what is collected and why; Firmora processes it on your behalf.
• Website visitors: people who use your firm's public page or chatbot.

2. What we collect

• Account details: your name, firm name, email address, mobile number, and, if you use "Continue with Google", the name and email on your Google account.
• Firm settings: details you enter such as address, GSTIN, PAN, registration numbers, bank details for invoices, and your logo.
• Practice data: client records, compliance items, engagements, checklists, invoices, notes, staff names and similar records you create.
• Client documents: files your clients upload are stored in your own Google Drive, not on Firmora's servers. We store only the file name, size and a link to the file in your Drive.
• Website enquiries: names, phone numbers and chatbot conversations submitted on your firm's public page.
• Security data: a random device identifier and basic browser type (for example "Chrome on Windows") to enforce the two-device limit, and timestamps of activity for automatic sign-out.

3. Why we use it

• To provide the service: show your dashboard, create due dates, send links, generate invoices and reminders.
• To keep accounts secure and stop account sharing.
• To manage your trial and subscription and to contact you about your account.
• To answer support requests.

We do not sell personal data, and we do not use your clients' data for advertising.

4. Where data is stored

Account and practice data is stored with our database provider, Supabase. Client documents stay in your Google Drive. These service providers process data for us:

• Supabase: database, sign-in and server functions.
• Vercel: hosting of the app, this website and your firm's client pages.
• Google: Google Drive (your clients' uploads go to your Drive), "Continue with Google" sign-in, and Gmail, which sends the one-time login codes to your clients.
• Groq: the fee estimator and support assistant inside the app send the text of your question to this AI provider to generate an answer. The chatbot on your firm's public page does not use AI; it matches questions to a fixed FAQ list.

Firmora processes your clients' personal data only on your instructions, as your data processor.

Browser storage: the app keeps a random device ID and your last activity time in your browser for security. Your clients' browsers keep their login on the client page until they log out.

5. Google Drive access

When you connect Google Drive, Firmora asks only for access to files and folders it creates (the "drive.file" permission). It cannot see or change other files in your Drive. You can disconnect at any time from Settings or from your Google account's security page.

6. Who can see your data

Each firm's records are restricted to that firm's account at the database level. Firmora staff access your data only when needed to fix a problem you report, or when required by law.

7. How long we keep it

We keep your data while your account exists, including after a trial ends, so you can export it. If you ask us to delete your account, we delete your practice data within 30 days, except records we must keep by law (such as payment records). Documents in your Google Drive are under your control and are not deleted by us.

Client login codes are deleted within a day. Website enquiries and chatbot conversations stay in your account until you delete them. Device records are removed when a device is signed out.

If there is a data breach: we will tell you without delay, and within 72 hours of becoming aware of it, so you can inform the Data Protection Board and affected clients as the law requires.

8. Your rights

You can access, correct or export your data from within the app, and ask us to delete your account. Your clients may contact you, as the firm that decided to collect their data, to exercise their rights; we will help you respond.

9. Contact and grievances

Firmora is operated by Syed Ismaeel. Grievance officer: Syed Ismaeel. For any privacy question or complaint, email syed.ismaeel33@gmail.com or WhatsApp +91 95732 41686. We aim to respond within 7 days.

10. Changes

If we change this policy, we will update the date above and, for significant changes, tell you inside the app.