Skip to content
Docflo

Privacy policy

Last updated: 24 October 2026

This policy explains how Docflo Technologies ("Docflo", "we") processes personal data when you use Docflo. It is written to meet the requirements of the Digital Personal Data Protection Act, 2023 (DPDP Act) and the Information Technology Act, 2000.

Who is responsible for what

Firm accounts. For the details of CA firms and their staff who sign up, Docflo is the data fiduciary.

Client documents. When a CA firm uses Docflo to collect documents from its clients, the firm decides what is collected and why; the firm is the data fiduciary and Docflo processes that data on the firm's behalf as a data processor, only to provide the service.

What we collect

  • Account details: name, firm name, email, mobile number, city, GSTIN and billing address.
  • Client records added by firms: names, business names, mobile numbers, email addresses, PAN, GSTIN and preferred language.
  • Documents and messages that clients upload or send on WhatsApp to a firm using Docflo.
  • Payment records from Razorpay (we never see or store full card numbers or UPI PINs).
  • Technical data: IP address, device and browser type, and sign-in times, used for security.

Why we use it

  • To provide the service: sending document requests and reminders, receiving and organising documents, and showing what is pending.
  • To identify documents and extract data, as described below.
  • To bill subscriptions and issue GST invoices.
  • To keep accounts secure, prevent misuse and meet legal obligations.

We do not sell personal data and we do not use client documents for advertising.

Automated processing by AI providers

To classify documents (for example, "bank statement for October 2026") and extract data such as invoice totals or bank transactions, documents may be processed by OpenAI through its API. Text is extracted on our own servers first wherever possible, and PAN- and Aadhaar-like numbers are masked before sending unless the firm turns this off. Data sent through the API is not used to train OpenAI's models under its API terms. Firms can see every automated result and correct it; nothing is filed or submitted to any government portal automatically.

Consent

Firms confirm, when they add clients, that they have a lawful basis to share those clients' details with us for document collection. Clients can withdraw consent by contacting their CA firm, or us, after which we will stop processing their data for that firm, except where we must keep records by law.

Sharing

We share data only with service providers needed to run Docflo, each bound by confidentiality:

  • Hosting and storage in India.
  • Meta (WhatsApp Business Platform) when a firm connects the official WhatsApp API.
  • OpenAI, for automated document reading as described above.
  • Razorpay for payments, and our email delivery provider for transactional emails.

We may disclose data when required by law or a valid order of a court or government authority.

Storage, security and retention

Documents are encrypted with AES-256 at rest and travel only over HTTPS. Details are on our security page. We keep data while the firm's account is active. Deleted documents can be recovered for 30 days, after which they are permanently removed from active systems and from backups within 14 days. Invoices and payment records are kept for eight years as required by tax law.

Your rights

Under the DPDP Act you may ask to:

  • access a summary of your personal data and how it is processed;
  • correct or complete inaccurate data;
  • erase your data, subject to legal retention requirements;
  • nominate another person to exercise these rights in case of death or incapacity; and
  • raise a grievance with us, and if unresolved, with the Data Protection Board of India.

Firm owners can export all their data and request account deletion from Settings at any time.

Grievance officer

Docflo Technologies

Email: hello@docflo.in

We acknowledge grievances within 48 hours and resolve them within 30 days.

Changes

If we change this policy in a way that matters, we will tell firm owners by email at least 15 days before the change takes effect.