DPDP Compliance
PracticeFlow 360 is built to comply with the Digital Personal Data Protection Act 2023. Below are the rights you have over your personal data and how to exercise them.
What personal data we process
- Account data: name, email, phone, role, organisation.
- Client data your firm uploads: client name, contact details, GSTIN / PAN / TAN, addresses, documents.
- Operational data: tasks, time entries, invoices, payments, communications log.
- Telemetry: error reports (Sentry), product analytics events (PostHog — opt-out available).
Your rights as a data principal
- Right to access: request a copy of all personal data we hold about you.
- Right to correction: edit your profile in-app or contact us.
- Right to erasure: request deletion. We honour it within 30 days, subject to legal retention requirements (e.g. ICAI / CBDT).
- Right to portability: machine-readable JSON export available on request.
- Right to grievance redressal: contact our grievance officer (below).
How to exercise your rights
Sign in to PracticeFlow 360 and visit Settings → Data & Privacy, or email taxoneadvisory@gmail.com. We respond within 7 working days.
Data retention
- Active firm data: retained while your subscription is active.
- After deletion: 30-day cooling-off before permanent removal (in case of accidental deletion).
- Backups: rotated daily; oldest copies dropped at end of retention window.
- Audit logs: retained as long as the organisation exists (regulatory requirement).
Sub-processors
PracticeFlow 360 uses these vendors. Each is bound by a Data Processing Agreement.
| Vendor | Purpose | Region |
|---|---|---|
| Vercel | Application hosting | Production region selected for the service |
| Supabase | PostgreSQL database and private document storage | Mumbai production project |
| AWS | Independent encrypted backups and document replicas | Mumbai backup region |
| Resend | Transactional email delivery | As stated in the current vendor DPA |
| Sentry | Error tracking with sensitive-data scrubbing | Selected account region |
| PostHog | Product analytics with opt-out controls | Selected account region |
Data localisation
The production database, primary document store and independent recovery store are configured in India for the major web release. Email and observability providers may process limited service data outside India under their current data-processing terms. The subprocessor record above must be reviewed against live provider settings before GA.
Grievance officer
Name: Grievance Officer
Email: taxoneadvisory@gmail.com
Response target: Requests are acknowledged and handled under the applicable law and the published grievance process.
Breach notification
Confirmed personal-data breaches are assessed, contained, recorded and notified to affected parties and authorities within the time and form required by applicable law.