LEGAL
DPDP Compliance
PracticeFlow 360 is built to comply with the Digital Personal Data Protection Act 2023. Below are the rights you have over your personal data and how to exercise them.
What personal data we process
- Account data: name, email, phone, role, organisation.
- Client data your firm uploads: client name, contact details, GSTIN / PAN / TAN, addresses, documents.
- Operational data: tasks, time entries, invoices, payments, communications log.
- Telemetry: error reports (Sentry), product analytics events (PostHog — opt-out available).
Your rights as a data principal
- Right to access: request a copy of all personal data we hold about you.
- Right to correction: edit your profile in-app or contact us.
- Right to erasure: request deletion. We honour it within 30 days, subject to legal retention requirements (e.g. ICAI / CBDT).
- Right to portability: machine-readable JSON export available on request.
- Right to grievance redressal: contact our grievance officer (below).
How to exercise your rights
Sign in to PracticeFlow 360 and visit Settings → Data & Privacy, or email privacy@practiceflow360.com. We respond within 7 working days.
Data retention
- Active firm data: retained while your subscription is active.
- After deletion: 30-day cooling-off before permanent removal (in case of accidental deletion).
- Backups: rotated daily; oldest copies dropped at end of retention window.
- Audit logs: retained as long as the organisation exists (regulatory requirement).
Sub-processors
PracticeFlow 360 uses these vendors. Each is bound by a Data Processing Agreement.
| Vendor | Purpose | Region |
|---|---|---|
| Vercel | Application hosting | Singapore (sin1) / Mumbai (bom1) |
| Neon | PostgreSQL database | ap-south-1 (Mumbai) |
| Supabase | Object storage (documents, PDFs) | ap-south-1 (Mumbai) |
| Resend | Transactional + marketing email delivery | EU / US |
| Sentry | Error tracking | EU / US |
| PostHog | Product analytics (opt-out available) | EU |
Data localisation
Primary customer data (database + documents) is stored in India (ap-south-1). Email delivery is the only cross-border flow and is governed by the vendor DPA.
Grievance officer
Name: Grievance Officer
Email: grievance@practiceflow360.com
Response SLA: 7 working days.
Breach notification
We notify affected users and the Data Protection Board of India within 72 hours of any confirmed personal-data breach, as required under DPDP Act 2023.