Last updated 2 September 2026
Privacy notice
How this system handles information about the firm's clients, its staff, and the documents it holds.
Who this is about
This notice covers the compliance management system operated by SKN & Company, Chartered Accountants at app.sknandcompany.com. The firm is the data fiduciary for everything described here.
The system is not a public service. It is used by the firm’s own staff to carry out statutory compliance work, and by the firm’s clients to see the work done for them. Nobody else has access to it.
What the system holds
About clients
- Identity and registration details — name, entity type, PAN, GSTIN, TAN, CIN, date of incorporation
- Contact details — email addresses and mobile numbers
- A record of the statutory filings prepared for that client: what was due, when, who did it, and the acknowledgement or ARN it produced
- Documents relating to those filings — acknowledgements, computations, challans, and anything a client uploads when the firm asks for it
- Fees raised and what remains outstanding
- Credentials for government portals, where a client has asked the firm to hold them so it can file on their behalf
About the firm’s staff
- Name, mobile number and role
- A password, stored only as a bcrypt hash and never in plain text
- A permanent record of what each person did — every change of status, every document uploaded, every credential viewed
Why it holds it
To do the work the client engaged the firm to do, and to be able to prove it was done. Statutory compliance carries real penalties for lateness — GST at ₹50 a day, TDS at ₹200 a day, ROC filings at ₹100 a day per form with no upper limit. The system exists to make sure deadlines are met and that there is a record afterwards.
Records of who did what are kept permanently and are never edited or deleted. That is deliberate: it is the firm’s own evidence of the work, and it protects clients as much as the firm.
Google account data
The system stores client documents in a Google Drive account belonging to the firm. When the firm connects that account, it grants this application a single Google permission:
- See, edit, create and delete only the specific Google Drive files you use with this app (
drive.file)
This is the narrowest Drive permission Google offers. It lets the application work only with files it created itself. The rest of that Google account — every other file, and the whole of its Gmail — is invisible to this application and always has been. No wider permission is requested, and none would be granted if it were.
The application uses that permission for one purpose: to file documents into a folder tree, and to read them back when a member of staff or a client downloads one. It creates folders by client and financial year, uploads documents into them, and retrieves them on request.
Limited Use disclosure
This application’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Data obtained through Google APIs is used only to provide and improve the document storage described above. It is never sold, never transferred to anyone except as needed to provide that feature, never used for advertising, and never read by a human except where the firm’s own staff open a document in the course of the client’s work, where required by law, or with the account holder’s explicit consent.
The firm can withdraw this permission at any time at myaccount.google.com/permissions. Doing so stops all uploads and downloads immediately. The documents themselves remain in the firm’s Drive, because they belong to the firm rather than to this application.
Who else sees it
Nothing is sold, rented or shared for anyone else’s purposes. The system uses a small number of service providers to function, and each sees only what it needs to:
- Vercel — runs the application
- Neon — the database, hosted in Singapore
- Google — Drive for documents, and Gmail to send email
- Meta — WhatsApp Business, where a client has agreed to be contacted that way
Records are also disclosed to the tax authorities where that is the point of the engagement, and to anyone the law obliges the firm to tell.
Because the database is hosted in Singapore and Google Drive stores data outside India, information covered by this notice is processed outside India. Clients who need their records held within India should raise it with the firm.
How it is protected
- Every page and every document requires a sign-in. Documents are never served from a public link
- A member of staff sees only the work assigned to them. This is enforced when the data is read, not merely by hiding buttons
- A client signs in with their own email address or PAN and a one-time code, and can only ever see their own records
- Government portal credentials are encrypted with AES-256-GCM. The key is held outside the database, so a copy of the database on its own reveals nothing. Every single viewing is recorded against the person who did it
- Staff passwords are stored as bcrypt hashes and cannot be read back
No system is beyond compromise, and it would be dishonest to claim otherwise. If something goes wrong the firm will say so, to the clients affected and to whoever the law requires.
How long it is kept
Client records, filings and documents are kept for as long as the firm acts for that client and afterwards for as long as tax and professional rules require — generally at least eight years, and longer where a matter is open. Records of who did what are kept permanently.
Your rights
Under the Digital Personal Data Protection Act 2023 a client may ask the firm what it holds about them, ask for a correction, and ask for it to be erased where nothing requires the firm to keep it. Some records cannot be erased on request: the firm is obliged to retain evidence of the filings it has made.
A client may also withdraw consent to be contacted on WhatsApp at any time, which stops those messages without affecting anything else.
Contact
Write to SKN & Company, Chartered Accountants at mrassociates.cas@gmail.com, or raise it with the partner who handles your work.