Privacy policy

This policy explains how StartupMates Private Limited (“we”, “us”) handles personal data in BusinessMates at businessmates.in. We process personal data in line with the Digital Personal Data Protection Act, 2023 and other applicable Indian law.

Two kinds of data

Account data. When a CA firm signs up, we collect the firm’s name, the names, email addresses and phone numbers of its team, and their passwords (stored only as a one-way hash). For this data we decide how it is used.

Practice data. Firms add their clients’ details (such as names, PAN, GSTIN, TAN, contact details), filing records and documents. For this data the CA firm decides what is collected and why; we process it only to run BusinessMates for that firm. Clients of a firm should contact their CA about their data, and we will help the firm respond.

What we use data for

• To provide the service: sign-in, the dashboards, filings, document requests and notifications.
• To keep it secure: detecting misuse and keeping an activity history of actions in each firm.
• To talk to you about your account, such as trial reminders, billing and service notices.
• To reply when you contact us through the website.

We do not sell personal data, and we do not use practice data for advertising.

Who can see it

• Within a firm, its admins and staff see the firm’s records. Each client login sees only that client’s records.
• A small number of our staff can access data where needed to run, support or secure the service.
• Service providers we rely on, such as our hosting provider, process data on our instructions.
• Authorities, where the law requires us to disclose it.

Cookies

We use one essential cookie to keep you signed in, and store your light or dark theme choice in your browser. We do not use advertising cookies.

How long we keep it

We keep account and practice data while the firm’s account is open. After an account is closed we delete or anonymise it within 90 days, except where the law requires us to keep records for longer. A firm can ask us to export its data before closing.

Security

Data is encrypted in transit with HTTPS. Passwords are hashed, sessions can be ended at any time, and access within a firm is limited by role.

Your rights

You can ask to access, correct or erase your personal data, or to withdraw consent, and you can raise a grievance with us. Write to us using the form on our contact page. If you are a client of a CA firm, your request may need to go through that firm.

Changes

We will post changes to this page and, for significant changes, tell firm admins by email or in the product.