Privacy policy

This policy explains what Anqulas Docs, operated by Anqulas, does with personal data. In short: your firm owns its data, we use it only to run the service, and we never sell it.

What we hold

• Your firm's account: firm name, staff names, emails, and sign-in records.
• What your firm puts into Anqulas Docs: client names and contacts, requests, uploaded documents, comments, invoices, which returns each client files and their filing status, and its register of digital signatures (holder names and PANs, and token PINs only if your firm switches that on). For this data your firm is the data fiduciary and we are its data processor, under our data processing agreement.
• Billing records: plan, amounts and payment references. Card and bank details stay with the payment provider.
• Security logs: IP addresses and browser details of sign-ins and actions, for the audit trail.
• Notifications for staff, only on devices where they turn them on: a delivery address for that browser, or, in our Android app, a device token issued by Google's Firebase. It is used only to deliver notifications and is deleted when the person signs out on that device, removes it under Your account, or leaves the firm. The Android app collects nothing else about the phone: no contacts, location, advertising ID or usage tracking.

How we protect it

• Files are encrypted at rest, and every connection is encrypted in transit.
• Each firm's data is isolated in the database itself, not only by the application.
• Staff sign-in requires a second step; passwords are stored only as Argon2id hashes.

Who else sees it

Only the providers needed to run the service: hosting and database, file storage, email delivery, WhatsApp (Meta) when your firm turns it on, and the payment provider you choose. Staff notifications pass through the push service of the person's browser or, in the Android app, Google's Firebase Cloud Messaging; they carry a client's name and period, never documents. Each receives only what its part needs. We disclose data to authorities only when the law requires it.

If your firm connects its Google Drive, documents it approves are copied, on the firm's instruction, to that firm's own Google account. From then on those copies are the firm's files, held by Google under the firm's agreement with Google, and Google's terms apply to them. We can see only the folders and files we created there, nothing else in the Drive.

How long we keep it

For as long as your firm's account exists. A firm can delete its workspace itself (it is removed 7 days later). A workspace whose plan ended is kept for 90 days, then deleted after two email notices. A signup whose email address was never confirmed is removed after 30 days. Database backups expire within 90 days. We keep only the billing records the law requires. Copies a firm sent to its own Google Drive are not deleted with the workspace: they are in the firm's Google account, and the firm deletes them there.

Your rights

Clients of a firm should contact that firm first, as it controls their documents. Anyone may ask us to access, correct or delete their personal data, or raise a grievance with our grievance officer at the email address on our contact page. We acknowledge within 48 hours and resolve within 30 days. If you are not satisfied, you may complain to the Data Protection Board of India. Full details are on our contact page.