Privacy Policy

Effective Date: 20-02-2026

Last Updated: 27-10-2026

1. Introduction

This Privacy Policy explains how BharatTantr Pranali ("Company", "we", "our", "us") collects, uses, stores, shares and protects information when you use caTantr, our practice-management application for Chartered Accountant and tax-consultancy firms, available at https://catantr.in ("Services").

It also explains exactly how caTantr accesses, uses, stores and shares data received from Google APIs when a firm connects Google Drive, Gmail, Google Calendar or Google Contacts.

We follow the Digital Personal Data Protection Act, 2023 (India), the Information Technology Act, 2000 and the Google API Services User Data Policy, including its Limited Use requirements.

2. Who We Are

Business Name: BharatTantr Pranali (Sole Proprietorship)

Owner and Grievance Officer: Rahul Arvind More

Address: Umarga, Maharashtra – 413606, India

Email: bharattantrpranali@gmail.com

Website: https://catantr.in

3. Our Role and Your Firm's Role

caTantr is used by firms ("Firm" or "Tenant") to manage their clients, tasks, documents, billing and communication.

For account, subscription and support information, we decide how the information is used.
For the business records a Firm enters into caTantr (its clients, client contacts, tasks, documents, finance records and messages), the Firm decides what is collected and why. We process those records only on the Firm's instructions to provide the Services.

If you are a client of a Firm and have a question about your information, please contact that Firm first. We will help the Firm respond.

4. Information We Collect

4.1 Account information

Name, email address and profile photo provided by Google Sign-In when you sign in to caTantr.
A password, only if you choose to add one to your account (stored by Firebase Authentication; we never see it).
Your role in the Firm (for example Partner, Manager or Staff) and the permissions given to you.

4.2 Firm profile and subscription

Firm name, type, address, mobile number, contact email, GSTIN and GST settings.
Bank and UPI details the Firm adds so they can appear on its invoices and payment QR codes.
Subscription details: plan, number of users, payment reference numbers (UTR) and referral credits.
A consent record when the Firm is activated: the policy versions accepted, the date and time, the IP address and the browser details.
The Firm's logo, if it chooses one, and a declaration record each time a Partner adopts, changes or removes it: the logo version and its digital fingerprint, the exact declaration wording, the ICAI membership and firm registration numbers given for the CA logo, the Partner's name, account and email, the date and time, the IP address and the browser details.

4.3 Business records entered by the Firm

Clients and client contacts (names, phone numbers, email addresses, PAN, GSTIN, addresses and similar details).
Tasks, due dates, reminders, notes, activity history and time entries.
Invoices, receipts, payments, journals and ledgers.
Messages with clients and records of emails sent through caTantr.
Links to and basic details of documents kept in the Firm's Google Drive (see section 7).

4.4 Client portal and client upload links

Client portal: a Firm's client contact signs in with Google. We use the verified email address only to match it to a contact the Firm has given portal access.
Upload links: a Firm can send a client a private upload link for a task. A person using the link may type a display name and upload files, which go straight into the Firm's Google Drive. To let that browser remove its own uploads, we store a scrambled (hashed) form of a random key kept in the browser.

4.5 Technical information

A secure sign-in session cookie.
The time of each team member's most recent sign-in, used to keep each account signed in on one device at a time.
Information our hosting provider records when you use the Services, such as IP address, browser type, request times and error details.
The time a Firm was last active, used to show account status.

We do not use advertising or analytics trackers.

4.6 Support

Support tickets, feedback and any attachments you send us.
Support attachments (images, PDFs and videos) are stored in caTantr's own Google Drive, in a folder for your Firm, and shared with you by view-only link so they can be opened from the ticket conversation.
When you raise a ticket, or caTantr Support replies to it, we email the person who raised the ticket from caTantr's own Gmail account.
We keep your Firm's name, mobile number and contact email in caTantr's own Google Contacts, and your trial or subscription renewal date in caTantr's own Google Calendar, so our team can contact you about support and renewals.

5. Google Sign-In

You sign in to caTantr with your Google account through Firebase Authentication. Google Sign-In gives us your name, email address, profile photo and a Google account identifier. We use these only to create and secure your caTantr account. Google Sign-In does not give caTantr access to your Drive, Gmail, Calendar or Contacts.

6. Google Workspace Integrations: Overview

Connecting Google services is optional and is switched off until a Partner of the Firm connects it under Settings → Workspace Integration.

Each service (Drive, Gmail, Calendar, Contacts) is connected separately, and each can use a different Google account.
Each connection asks Google for one permission ("scope") only, plus your basic identity so we can show which Google account is connected.
A Partner can pause or disconnect each service at any time.
Within the Firm, role-based permissions decide which members may use each connected service.

6.1 Google permissions we request and why

openid and userinfo.email (basic identity): to identify the Google account being connected and show its email address in caTantr.
https://www.googleapis.com/auth/drive.file (Google Drive): to create and manage the Firm's client folders and the files caTantr uploads. This permission only covers files and folders caTantr creates or that you open with caTantr. It does not give access to the rest of your Drive.
https://www.googleapis.com/auth/gmail.send (Gmail): to send emails that you or your Firm ask caTantr to send. It cannot read, list or delete any email.
https://www.googleapis.com/auth/calendar.app.created (Google Calendar): to create a separate calendar named "caTantr Deadlines" and to add, update and remove task deadline and reminder events in it. This permission only covers calendars caTantr creates. It cannot see or change your other calendars or their events.
https://www.googleapis.com/auth/contacts (Google Contacts): to keep the Firm's caTantr contacts in sync with a Google Contacts label named "caTantr".

7. Google Drive

7.1 What caTantr does in Drive

When Drive is connected, caTantr:

Creates a "caTantr Clients" folder, a folder for each client, and folders by financial year, period and task, each with "Data Inward" and "Reports" folders.
Uploads files that you, your team or your clients add through caTantr (for example reports, client documents, quotations and client ledger statements).
Renames, moves, trashes or deletes these files and folders when you ask (for example when you delete a file).
When a task is deleted, sent for invoicing or cancelled, automatically moves to Drive trash the folders caTantr created for that task only if they are empty. Completing a task alone does not remove folders. Any folder holding a file is kept. Folders outside what caTantr created are never touched.

7.2 What caTantr reads from Drive

caTantr reads file details only: file name, type, link, created and modified dates, and the name of the person who last changed the file. It shows these on the task so your team can find documents quickly.
caTantr does not open, download, read or analyse the contents of your Drive files.
Files uploaded through caTantr pass through our servers on their way to your Drive and are not kept on our servers.

7.3 Link sharing

So that clients can open their reports and folders without a Google account, caTantr sets the task folders and the files it uploads to "Anyone with the link can view". Only people who have the link can open them. The Firm can change the sharing of any file or folder in Google Drive at any time.

7.4 Using the Firm's own existing client folder (shared-folder mode)

A Firm may choose to keep using its own existing client folder:

The Firm shares that one folder, as Editor, with caTantr's service account: catantr-drive-robot@studio-8826167477-c4431.iam.gserviceaccount.com.
The service account can then see the file details (not the contents) of items inside that folder, so caTantr can find existing client folders and avoid duplicates. New files and folders are still created by the Firm's own connected Google account.
caTantr only works inside the folder the Firm shared. Every request is checked to make sure it stays inside that folder.
To stop this access, remove the service account from the folder's sharing in Google Drive. Disconnecting in caTantr does not change Drive sharing.

7.5 Pausing Drive

When pausing Drive, a Partner chooses one of:

Pause and keep the saved file details visible in caTantr.
Pause and hide the saved file details.
Pause and permanently delete the saved file details from caTantr.

Pausing or disconnecting never deletes anything in Google Drive.

8. Gmail

8.1 What caTantr does with Gmail

caTantr uses Gmail only to send emails from the Firm's connected Gmail account, such as:

Task, document-request and fee-reminder emails that a team member writes or confirms.
Client portal invitations.
"Task assigned" emails to clients, only if the Firm switches this on for automatically created tasks.

caTantr never reads, lists, searches, changes or deletes any email in your mailbox.

8.2 What we keep

For accountability, we keep a record of each email sent: who sent it, the connected mailbox, the recipients, CC, subject, related task, time and Gmail's message reference. We do not keep the email body. Only Partners of the Firm can see these records.

8.3 Team use and attribution

A Partner may allow other team members to send emails through the connected Gmail account. Each email shows which team member sent it, and the record above notes the sender.

9. Google Calendar

caTantr creates its own calendar named "caTantr Deadlines" in the connected Google account and remembers that calendar's ID so it can find it again.
Calendars connected before October 2026 used the wider "calendar" permission. For those, caTantr reads your list of calendars only to find "caTantr Deadlines". Reconnecting Calendar switches to the narrower permission.
It adds, updates and removes task deadline and reminder events in that calendar only. An event shows the task type, client name, due date and a link to the task, or the reminder text.
caTantr does not read, change or delete events in any other calendar, including your primary calendar.
A task's deadline and reminder events are removed automatically when the task is deleted, sent for invoicing or cancelled. Completing a task alone does not remove them. You can delete the "caTantr Deadlines" calendar yourself at any time in Google Calendar.

10. Google Contacts

caTantr creates a contact label named "caTantr". It reads the names of your labels only to find this label.
When a team member runs 2-Way Sync, caTantr imports the contacts in the "caTantr" label only (name, email addresses, phone numbers, birthday, anniversary, notes and website) and adds or updates the Firm's caTantr contacts in that label.
Saving a contact in caTantr updates that contact in Google Contacts.
caTantr does not read contacts outside the "caTantr" label and never deletes any Google contact.
Sync runs only when a team member triggers it. There is no background sync.

11. Google API Services: Limited Use Disclosure

caTantr's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

In particular:

We use Google user data only to provide and improve the user-facing features described in sections 5 to 10, which are clearly shown in caTantr.
We do not transfer Google user data to anyone, except as needed to provide those features, to comply with law, to protect against abuse or security threats, or as part of a merger or acquisition with your prior consent.
We do not use Google user data for advertising, including personalised, retargeted or interest-based advertising.
We do not sell Google user data, and we do not give it to data brokers or information resellers.
We do not use Google user data to decide creditworthiness or for lending.
No person reads your Google user data unless you give us permission (for example in a support request), it is needed for security or to investigate abuse, it is required by law, or the data has been aggregated and anonymised for internal operations.
We do not use Google user data to develop, improve or train generalised or non-personalised artificial-intelligence or machine-learning models, and we do not send Google user data to any AI model.

12. AI Features

caTantr offers optional AI features powered by Google's Gemini API:

AI Consulting (Partners only, unless a Partner allows others): sends the selected client's profile (without Drive links), the client's task list, the Firm's basic profile (name, type, location and GST details), your question and any documents you choose to attach from your device.
GST certificate reading: sends the GST certificate you upload to fill in client details.
Suggestions for due dates and master-data defaults: sends task names, periods and the text you enter.

These features never use data from your Google Drive, Gmail, Calendar or Contacts. The content you submit is used only to produce the answer shown to you. We do not use it to train AI models. AI answers can be wrong and are not professional advice; please check them before relying on them.

13. How We Use Information

We use information to:

Provide the Services and the features you or your Firm turn on.
Sign you in, keep accounts secure and apply the Firm's role permissions.
Send emails, create calendar events, sync contacts and manage Drive folders when asked.
Create recurring tasks and, if the Firm switches them on, the related Drive folders, calendar events and client emails.
Manage subscriptions, trials and referral credits.
Provide support, fix problems, prevent abuse and meet legal duties.

We do not use your information for advertising, and we do not sell it.

14. Who We Share Information With

We share information only as described below.

Google Cloud and Firebase (Google LLC): hosting, database, sign-in and background processing.
Google Workspace (Google LLC), caTantr's own account: storage of support attachments (Drive), support emails (Gmail), Firm contact details (Contacts) and Firm renewal dates (Calendar), as described in section 4.6.
Google Workspace APIs: when your Firm connects Drive, Gmail, Calendar or Contacts, we send data to those services on your instruction (for example the email you send or the file you upload).
Google Gemini API: only the content described in section 12, when you use an AI feature.
India Post PIN code lookup (api.postalpincode.in): when you enter a PIN code in an address form, your browser sends only that PIN code to fill in the city and state.
WhatsApp: when you choose to message a client on WhatsApp, caTantr opens WhatsApp on your device with the message filled in. We do not send messages through WhatsApp's servers.
Legal and safety: when required by law, court order or a government authority, or to protect the rights and safety of users or the public.
Business transfer: in a merger or acquisition, under the same protections. Google user data is transferred only with your prior consent.

We do not use a payment gateway. Subscriptions are paid by bank transfer or UPI, and we record only the payment reference you give us.

15. Where Data Is Stored

The caTantr database and background processing run on Google Cloud in Mumbai, India.
Firm logos are stored in Google Cloud Storage in Mumbai, India.
The application servers run on Google Cloud in Singapore.
Files, emails, calendar events and contacts created through the integrations stay in the Firm's own Google account.

16. How We Protect Information

All connections use encryption (HTTPS/TLS). Data is encrypted at rest by Google Cloud.
Google access tokens are stored on our servers only. They are never sent to browsers and cannot be read by caTantr users.
We request the narrowest Google permissions that support each feature (for example Drive access limited to files caTantr creates).
Role-based permissions inside each Firm limit who can use each feature.
Client upload links are signed, tied to one task, expire when the task is closed and can be reset by the Firm.
Sign-in sessions use secure, HTTP-only cookies.
Sensitive actions, such as sending emails, are recorded for accountability.

No system is completely secure, but we work to protect your information and will notify affected Firms and authorities of a personal-data breach as the law requires.

17. How Long We Keep Information

Account, Firm and business records: while the Firm's account is active, or until the Firm deletes them.
Google access tokens: until the service is disconnected or the Firm account is deleted, when we revoke them with Google and delete them.
Saved Drive file details: until the file is removed, the Firm deletes them using the Drive pause option, or the Firm account is deleted.
Records of sent emails: while the Firm's account is active.
Support tickets: as long as needed to resolve them and keep a support history.
Firm logos and logo declarations: while the Firm's account is active, and afterwards for as long as needed to establish or defend legal claims about the logo's use (up to 8 years after the Firm account is deleted). Only the logo files and declaration records are kept for this purpose.
Server logs: for a limited period set by our hosting provider.

18. Disconnecting Google and Deleting Your Data

18.1 Disconnect a Google service

In caTantr, a Partner can disconnect any service under Settings → Workspace Integration. We revoke caTantr's access with Google and delete the stored tokens.
You can also remove caTantr's access from your Google Account at https://myaccount.google.com/permissions.
For shared-folder mode, also remove caTantr's service account from the folder's sharing in Google Drive.

18.2 Delete the Firm account

The Partner who registered the Firm can permanently delete the Firm account in caTantr. This revokes all Google access, deletes the stored tokens, and deletes the Firm's records, team memberships and the sign-in accounts of team members who do not belong to another Firm. Logo files and logo declaration records are kept as described in section 17.

18.3 What stays in your Google account

caTantr does not delete what it created in your Google account when you disconnect or delete your Firm account. You can delete these yourself:

Files and folders in Google Drive (including the "caTantr Clients" folder).
The "caTantr Deadlines" calendar in Google Calendar.
Contacts in the "caTantr" label in Google Contacts.

18.4 Ask us to delete data

You can email bharattantrpranali@gmail.com to ask us to delete your personal data or any remaining Firm data. We will confirm and complete the request within 30 days, unless the law requires us to keep it.

19. Cookies and Browser Storage

caTantr uses one secure sign-in session cookie.
To load faster, caTantr keeps some of your Firm's data and your display preferences in your browser's storage on your device. You can clear it at any time in your browser settings.
We do not use advertising or analytics cookies.

20. Your Rights

Under the Digital Personal Data Protection Act, 2023 and other applicable law, you may:

Ask for a summary of your personal data and how it is used.
Ask us to correct, complete or update it.
Ask us to delete it.
Withdraw consent (this may stop some features from working).
Nominate another person to act for you in case of death or incapacity.
Raise a grievance with our Grievance Officer, and if you are not satisfied, with the Data Protection Board of India.

Firms can also export many of their records (such as clients, contacts, tasks and finance data) from caTantr. Email us at the address in section 2 to use any of these rights. We respond within 30 days.

21. Children

caTantr is for professional use. We do not knowingly collect information from anyone under 18.

22. Changes to This Policy

When we change this Policy, we will publish the new version on this page with a new "Last Updated" date. If a change materially affects how we use Google user data, we will tell Firms in caTantr or by email before it takes effect and ask for consent where required.

23. Contact and Grievance Officer

Rahul Arvind More, BharatTantr Pranali

Umarga, Maharashtra – 413606, India

Email: bharattantrpranali@gmail.com

Website: https://catantr.in

We acknowledge grievances within 7 days and aim to resolve them within 30 days.