Privacy Policy

1. Who we are

FirmStack (“FirmStack”, “we”, “us”) is a client portal for CA and CS firms. It is built and run by Fusion Labs, Alwar, Rajasthan, India proprietorship.This policy explains what information we collect, why we collect it, and what you can do about it. We have tried to keep it plain and short.

2. Who is responsible for what

FirmStack has two kinds of data, and our role is different for each.

Your firm’s account data (the owner’s and staff’s names, emails, and login details, plus billing details). We decide how this is used to run the service. For this data, we are responsible under Indian data protection law.
Your clients’ data (documents, invoices, tasks, and details your firm puts into FirmStack about its own clients). Your firm decides what goes in and why. We only store and process it for your firm, on your instructions. For this data, the firm is responsible for having the right to collect it and for telling its clients how it is used.

If you are a client of a CA firm that uses FirmStack, your firm is the one to ask first about your documents. You can also write to us, and we will help.

3. What we collect

Information you give us

Name, email address, phone number (if you give it), and firm name.
Login details. We do not store passwords in plain text.
Documents and files uploaded by firms, staff, and clients.
Invoices, tasks, notes, and other content created in the product.
Messages you send to us, such as support requests, beta feedback, and forms (for example, the beta sign-up form).

Information collected automatically

Device and browser type, IP address, and approximate location from the IP address.
Pages and features used, and error reports.
Activity records inside the product (such as who uploaded or changed what and when). These help firms keep an audit trail and help us fix problems.

Payment information When payments are switched on, they are handled by our payment partner, Razorpay. We do not see or store your full card or bank details. We keep records such as the plan, amount, date, and payment status.

4. How we use your information

We use it to:

Provide FirmStack: create accounts, store files, show the right people the right data, and send invoices and reminders from your firm.
Send service emails: invites, security alerts, payment receipts, and important notices.
Keep the service safe, and prevent misuse and fraud.
Understand how the product is used, so we can fix bugs and improve it.
Answer your questions and ask for feedback.
Meet our legal duties, such as tax and accounting records.

We do not sell your personal information. We do not use your clients’ documents for advertising. We do not read your firm’s documents unless you ask us to for support, or we must do so to investigate a security problem or follow the law.

We do not use the content of your documents to train AI models.

5. Who we share it with

We use trusted companies to run FirmStack. They can only use the data to provide their service to us.

Supabase: database, login, and file storage.
Vercel: hosting and delivery of the website and app.
Resend: sending emails.
PostHog: product analytics and error tracking.
Cloudflare: security checks and DNS.
Razorpay: payments for FirmStack plans (when payments are active).

We may also share information:

When the law requires it, such as a valid court or government order.
To protect the rights, safety, or property of FirmStack, our users, or others.
If Fusion Labs or FirmStack is sold or merged. We will tell you first, and the new owner must follow this policy.

6. Where your data is stored

Our main database and uploaded files are stored in India (Mumbai region).Some of our service providers (for example, for email, analytics, and hosting) may process limited data outside India. We choose providers that protect data, and we only send what each one needs.

7. How long we keep it

Account data and firm content: while your firm’s account is active.
After you close your account: we keep data for 30 days so you can export it, then delete it.
Backups: removed within 30–60 days after deletion.
Billing and tax records: kept as long as Indian law requires.
Logs and error reports:up to 30 days.

8. How we protect your data

Data is sent over encrypted connections (HTTPS).
Data is stored with providers that encrypt data at rest.
Access is based on roles. Admin, Staff, and Client accounts each see only what their role allows. Staff see only the clients assigned to them.
Two-factor login is available for the firm owner and platform admin.
We review our code and settings for security problems.

No system is 100% secure. If there is a data breach that affects you, we will tell you and the authorities as the law requires.

9. Your choices and rights

Under Indian law, you can ask us to:

Give you a summary of the personal data we hold about you.
Correct or update it.
Delete it, unless we must keep it by law.
Withdraw your consent where we rely on it.
Handle a complaint (see Section 13).

To make a request, email us at connect@fusionlabs.studio. We may ask you to prove who you are. We aim to reply within 3-5 days.

If your request is about documents inside a CA firm’s account, we may need to involve that firm, because the firm controls that data.

10. Cookies and analytics

We use:

Essential cookies to keep you logged in and protect the service.
Analytics (PostHog) to see which features are used.

We do not use advertising cookies. You can block cookies in your browser, but parts of FirmStack may stop working.

11. Children

FirmStack is for professional use by adults. It is not meant for anyone under 18, and we do not knowingly collect data from children.

12. Changes to this policy

We may update this policy. We will change the date at the top. For important changes, we will email account owners or show a notice in the app before the change takes effect.

13. Contact and Grievance Officer

Fusion Labs, Alwar, Rajasthan, India Email: connect@fusionlabs.studio

Grievance Officer: Devesh : Email: connect@fusionlabs.studio We will acknowledge complaints within 48 hours and aim to resolve them within 15 days.

1. Who we are

FirmStack (“FirmStack”, “we”, “us”) is a client portal for CA and CS firms. It is built and run by Fusion Labs, Alwar, Rajasthan, India proprietorship.This policy explains what information we collect, why we collect it, and what you can do about it. We have tried to keep it plain and short.

2. Who is responsible for what

FirmStack has two kinds of data, and our role is different for each.

Your firm’s account data (the owner’s and staff’s names, emails, and login details, plus billing details). We decide how this is used to run the service. For this data, we are responsible under Indian data protection law.
Your clients’ data (documents, invoices, tasks, and details your firm puts into FirmStack about its own clients). Your firm decides what goes in and why. We only store and process it for your firm, on your instructions. For this data, the firm is responsible for having the right to collect it and for telling its clients how it is used.

If you are a client of a CA firm that uses FirmStack, your firm is the one to ask first about your documents. You can also write to us, and we will help.

3. What we collect

Information you give us

Name, email address, phone number (if you give it), and firm name.
Login details. We do not store passwords in plain text.
Documents and files uploaded by firms, staff, and clients.
Invoices, tasks, notes, and other content created in the product.
Messages you send to us, such as support requests, beta feedback, and forms (for example, the beta sign-up form).

Information collected automatically

Device and browser type, IP address, and approximate location from the IP address.
Pages and features used, and error reports.
Activity records inside the product (such as who uploaded or changed what and when). These help firms keep an audit trail and help us fix problems.

Payment information When payments are switched on, they are handled by our payment partner, Razorpay. We do not see or store your full card or bank details. We keep records such as the plan, amount, date, and payment status.

4. How we use your information

We use it to:

Provide FirmStack: create accounts, store files, show the right people the right data, and send invoices and reminders from your firm.
Send service emails: invites, security alerts, payment receipts, and important notices.
Keep the service safe, and prevent misuse and fraud.
Understand how the product is used, so we can fix bugs and improve it.
Answer your questions and ask for feedback.
Meet our legal duties, such as tax and accounting records.

We do not sell your personal information. We do not use your clients’ documents for advertising. We do not read your firm’s documents unless you ask us to for support, or we must do so to investigate a security problem or follow the law.

We do not use the content of your documents to train AI models.

5. Who we share it with

We use trusted companies to run FirmStack. They can only use the data to provide their service to us.

Supabase: database, login, and file storage.
Vercel: hosting and delivery of the website and app.
Resend: sending emails.
PostHog: product analytics and error tracking.
Cloudflare: security checks and DNS.
Razorpay: payments for FirmStack plans (when payments are active).

We may also share information:

When the law requires it, such as a valid court or government order.
To protect the rights, safety, or property of FirmStack, our users, or others.
If Fusion Labs or FirmStack is sold or merged. We will tell you first, and the new owner must follow this policy.

6. Where your data is stored

Our main database and uploaded files are stored in India (Mumbai region).Some of our service providers (for example, for email, analytics, and hosting) may process limited data outside India. We choose providers that protect data, and we only send what each one needs.

7. How long we keep it

Account data and firm content: while your firm’s account is active.
After you close your account: we keep data for 30 days so you can export it, then delete it.
Backups: removed within 30–60 days after deletion.
Billing and tax records: kept as long as Indian law requires.
Logs and error reports:up to 30 days.

8. How we protect your data

Data is sent over encrypted connections (HTTPS).
Data is stored with providers that encrypt data at rest.
Access is based on roles. Admin, Staff, and Client accounts each see only what their role allows. Staff see only the clients assigned to them.
Two-factor login is available for the firm owner and platform admin.
We review our code and settings for security problems.

No system is 100% secure. If there is a data breach that affects you, we will tell you and the authorities as the law requires.

9. Your choices and rights

Under Indian law, you can ask us to:

Give you a summary of the personal data we hold about you.
Correct or update it.
Delete it, unless we must keep it by law.
Withdraw your consent where we rely on it.
Handle a complaint (see Section 13).

To make a request, email us at connect@fusionlabs.studio. We may ask you to prove who you are. We aim to reply within 3-5 days.

If your request is about documents inside a CA firm’s account, we may need to involve that firm, because the firm controls that data.

10. Cookies and analytics

We use:

Essential cookies to keep you logged in and protect the service.
Analytics (PostHog) to see which features are used.

We do not use advertising cookies. You can block cookies in your browser, but parts of FirmStack may stop working.

11. Children

FirmStack is for professional use by adults. It is not meant for anyone under 18, and we do not knowingly collect data from children.

12. Changes to this policy

We may update this policy. We will change the date at the top. For important changes, we will email account owners or show a notice in the app before the change takes effect.

1. Who we are

2. Who is responsible for what

FirmStack has two kinds of data, and our role is different for each.

Your firm’s account data (the owner’s and staff’s names, emails, and login details, plus billing details). We decide how this is used to run the service. For this data, we are responsible under Indian data protection law.

If you are a client of a CA firm that uses FirmStack, your firm is the one to ask first about your documents. You can also write to us, and we will help.

3. What we collect

Information you give us

Name, email address, phone number (if you give it), and firm name.

Login details. We do not store passwords in plain text.

Documents and files uploaded by firms, staff, and clients.

Invoices, tasks, notes, and other content created in the product.

Messages you send to us, such as support requests, beta feedback, and forms (for example, the beta sign-up form).

Information collected automatically

Device and browser type, IP address, and approximate location from the IP address.

Pages and features used, and error reports.

Activity records inside the product (such as who uploaded or changed what and when). These help firms keep an audit trail and help us fix problems.

Payment information When payments are switched on, they are handled by our payment partner, Razorpay. We do not see or store your full card or bank details. We keep records such as the plan, amount, date, and payment status.

4. How we use your information

We use it to:

Provide FirmStack: create accounts, store files, show the right people the right data, and send invoices and reminders from your firm.

Send service emails: invites, security alerts, payment receipts, and important notices.

Keep the service safe, and prevent misuse and fraud.

Understand how the product is used, so we can fix bugs and improve it.

Answer your questions and ask for feedback.

Meet our legal duties, such as tax and accounting records.

We do not sell your personal information. We do not use your clients’ documents for advertising. We do not read your firm’s documents unless you ask us to for support, or we must do so to investigate a security problem or follow the law.

We do not use the content of your documents to train AI models.

5. Who we share it with

We use trusted companies to run FirmStack. They can only use the data to provide their service to us.

Supabase: database, login, and file storage.

Vercel: hosting and delivery of the website and app.

Resend: sending emails.

PostHog: product analytics and error tracking.

Cloudflare: security checks and DNS.

Razorpay: payments for FirmStack plans (when payments are active).

We may also share information:

When the law requires it, such as a valid court or government order.

To protect the rights, safety, or property of FirmStack, our users, or others.

If Fusion Labs or FirmStack is sold or merged. We will tell you first, and the new owner must follow this policy.

6. Where your data is stored

Our main database and uploaded files are stored in India (Mumbai region).Some of our service providers (for example, for email, analytics, and hosting) may process limited data outside India. We choose providers that protect data, and we only send what each one needs.

7. How long we keep it

Account data and firm content: while your firm’s account is active.

After you close your account: we keep data for 30 days so you can export it, then delete it.

Backups: removed within 30–60 days after deletion.

Billing and tax records: kept as long as Indian law requires.

Logs and error reports:up to 30 days.

8. How we protect your data

Data is sent over encrypted connections (HTTPS).

Data is stored with providers that encrypt data at rest.

Access is based on roles. Admin, Staff, and Client accounts each see only what their role allows. Staff see only the clients assigned to them.

Two-factor login is available for the firm owner and platform admin.

We review our code and settings for security problems.

No system is 100% secure. If there is a data breach that affects you, we will tell you and the authorities as the law requires.

9. Your choices and rights

Under Indian law, you can ask us to:

Give you a summary of the personal data we hold about you.

Correct or update it.

Delete it, unless we must keep it by law.

Withdraw your consent where we rely on it.

Handle a complaint (see Section 13).

To make a request, email us at connect@fusionlabs.studio. We may ask you to prove who you are. We aim to reply within 3-5 days.

If your request is about documents inside a CA firm’s account, we may need to involve that firm, because the firm controls that data.

10. Cookies and analytics

We use:

Essential cookies to keep you logged in and protect the service.

Analytics (PostHog) to see which features are used.

We do not use advertising cookies. You can block cookies in your browser, but parts of FirmStack may stop working.

11. Children

FirmStack is for professional use by adults. It is not meant for anyone under 18, and we do not knowingly collect data from children.

12. Changes to this policy

We may update this policy. We will change the date at the top. For important changes, we will email account owners or show a notice in the app before the change takes effect.

13. Contact and Grievance Officer

Fusion Labs, Alwar, Rajasthan, India Email: connect@fusionlabs.studio

Grievance Officer: Devesh : Email: connect@fusionlabs.studio We will acknowledge complaints within 48 hours and aim to resolve them within 15 days.

1. Who we are

2. Who is responsible for what

FirmStack has two kinds of data, and our role is different for each.

Your firm’s account data (the owner’s and staff’s names, emails, and login details, plus billing details). We decide how this is used to run the service. For this data, we are responsible under Indian data protection law.

If you are a client of a CA firm that uses FirmStack, your firm is the one to ask first about your documents. You can also write to us, and we will help.