Privacy Policy

Your firm's account data (names, work emails and roles of your team, billing details): Artha decides how this is used and is the Data Fiduciary.

Your clients' data (client names, PAN, GSTIN, contacts, documents, portal credentials, invoices, reconciliation files): your firm decides why it is collected and is the Data Fiduciary. Artha is a Data Processor. We process it only on your firm's instructions and only to provide the service.

• Account details: name, work email, firm name, role and password. Passwords are stored only as a bcrypt hash; we can't read them.
• Two-factor details: if you turn it on, an encrypted authenticator secret and hashed recovery codes.
• Content your firm adds: client records, tasks, documents, reconciliation files, quotations and invoices.
• Client portal: the email a client uses to sign in, and documents they upload through secure links.
• Payments: subscription and invoice payment status from Razorpay. We never see or store card, UPI or bank credentials.
• Technical data: IP address and request logs, used for security (for example, limiting repeated failed sign-ins) and to fix problems. Rate-limit records store a one-way hash, not your email or IP.

• To provide the service your firm signed up for: sign-in, storing your work, and sending the reminders and documents you ask us to send.
• To keep accounts and data secure: two-factor sign-in, rate limiting, an audit log of sensitive actions, and error monitoring.
• To bill your subscription and to contact you about your account, security or changes to the service.
• To meet legal obligations, such as keeping tax records.

• We do not sell personal data or use it for advertising.
• We do not use your firm's or your clients' data to train AI models.
• We do not put analytics or advertising trackers on the site or in the app.
• We do not access a firm's workspace except to provide support you ask for, or where the law requires it.

We use only the cookies needed to keep you signed in. They are all httpOnly, so page scripts can't read them:

• artha_session: your sign-in, for up to 7 days.
• artha_mfa: the 5-minute step between password and two-factor code.
• artha_portal_session: a client's portal sign-in, for up to 30 days.

Because these are strictly necessary, there is no cookie banner.

We use a small number of providers, each allowed to use data only to provide their service to us:

• Zoho Catalyst: application hosting.
• A managed PostgreSQL provider: the database.
• An S3-compatible object store: encrypted document storage and encrypted backups.
• Email and WhatsApp Business providers: reminders and notifications you trigger.
• Razorpay: payments.
• Sentry: error reports, with cookies, request bodies, query strings and link tokens removed before sending.
• Anthropic, only if your firm turns on AI features: drafting suggested actions that your staff review before anything is sent.

Ask us for the current list with the regions where each stores data.

We prefer providers and regions in India. Some providers (for example error monitoring or AI features) may process data outside India. We only transfer data abroad as the DPDP Act allows, never to a country the Government of India has restricted, and with contractual safeguards.

• Each firm's data is kept in its own workspace, checked on every request.
• Client portal passwords and authenticator secrets are encrypted with AES-256-GCM.
• Traffic is encrypted in transit (HTTPS), and documents and backups are encrypted at rest.
• Two-factor sign-in is available, and firms can require it for everyone.
• Sessions end immediately when a team member is deactivated or changes their password.
• Nightly encrypted backups are tested as restorable.

If we become aware of a personal data breach affecting your firm, we will tell your firm's Partners without undue delay, and in any case within 72 hours. We will explain what happened and what we are doing, and help your firm meet its own duty to inform the Data Protection Board of India and the affected people.

• We keep your data while your subscription is active. Firms can delete client records and documents at any time.
• When an account is closed, you have 30 days to export your data. We then delete it from live systems, and it leaves our backups as they expire within 35 days.
• We keep billing and tax records as long as Indian tax law requires.
• Security logs are kept only as long as they are needed for security.

Under the DPDP Act you can ask for a summary of your personal data and how it is processed. You can also ask us to correct, complete, update or erase it, nominate someone to exercise these rights for you, and raise a grievance.

If you are a client of a CA firm that uses Artha, please contact that firm first, because it decides how your data is used. We will help it respond.

Artha is for professionals and isn't meant for anyone under 18. We don't knowingly create accounts for children.

Niyamora Private Limited, Visakhapatnam, Andhra Pradesh. Email contact@arthapractice.in. We acknowledge complaints within 72 hours and aim to resolve them within 30 days. If you are not satisfied, you can complain to the Data Protection Board of India.

If we make a material change, we will email firm Partners before it takes effect. The date at the top shows when this policy was last updated.