Privacy policy

Codelix operates Audytee and is the data processor for the information a firm puts into Audytee. The firm that opens an Audytee account is the data controller for its clients' information. Reach us at info@audytee.com.

• Account information: your name, email address, phone number, role in the firm and sign-in records.
• Firm information: the firm's profile, GST and PAN details, members, settings, and billing details for the firm's Audytee subscription.
• Client information the firm enters or imports: client profiles, identifiers such as PAN and GSTIN, compliance records, tasks, documents, invoices, receipts, notices and messages.
• Connected services, only when a firm or member connects them: Gmail or Outlook mail (see section 4), WhatsApp messages, payment records from Razorpay, accounting records pushed to Zoho Books or Tally, and GST portal responses fetched through Sandbox.
• Usage information: pages opened, actions taken and errors, used to keep the service working and to improve it.

• To provide the service a firm has asked for: tracking compliance, managing work, billing and communicating with clients.
• To send the emails and messages a firm chooses to send through Audytee, and the notifications members opt in to.
• To secure accounts, prevent abuse and meet legal obligations.
• To understand how Audytee is used so we can improve it. We do not sell personal information and we do not show advertising.

A member may connect a Gmail mailbox so that client emails appear in Audytee next to the client's record, can be turned into tasks and can be replied to from Audytee. When a member does this, Audytee asks Google for permission to read the mailbox and to send email on the member's behalf.

• Audytee stores message headers, the sender, recipients, subject, a short preview and the thread reference. Message bodies and attachments are fetched from Google when a message is opened and are not stored.
• Mail is linked to a client only by matching the sender or recipient address with the client's contacts.
• Google user data is never used for advertising, never sold, and never shared with third parties except as needed to provide the feature to the member who connected the mailbox, for security, or to comply with law.
• Humans at Codelix do not read Google user data unless the member asks for support on a specific message, it is needed for security or legal reasons, or it has been aggregated so that no person can be identified.
• A member can disconnect the mailbox at any time from Settings › Integrations › Mailboxes, which deletes the stored headers and the access token; access can also be withdrawn from the member's Google account permissions page.

Audytee's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements.

Audytee runs on Amazon Web Services in the Mumbai region (ap-south-1). Databases and files are encrypted at rest, connections use TLS, and credentials that a firm enters for its own connected services are encrypted with a key held separately from the database. Sub-processors are Amazon Web Services (hosting, storage and email delivery) and, only when a firm connects them, the providers named in section 2.

What a member can see is decided by the firm's owners through roles and client assignments. Firm owners can see the firm's audit log of who changed what. Codelix staff can see firm-level account and usage information to run the service and support customers; they open a firm's records only with the firm's request.

• Firm data stays for as long as the firm has an account. A firm owner can export all of it from Settings and can ask us to delete the account; deletion completes within 30 days, after which only backups that expire within a further 35 days remain.
• Client data a firm deletes is removed on the firm's instruction, subject to records the firm is legally required to keep.
• Sign-in and security logs are kept for 12 months.

You can ask to see, correct or delete personal information about you, and you can object to a use you think is wrong. Write to info@audytee.com and we will respond within 30 days. If your information was entered by a firm, we will work with that firm to answer you. This policy follows the Digital Personal Data Protection Act, 2023 and the Information Technology Act, 2000.

When this policy changes we update the date at the top and, for changes that matter to how information is used, tell firm owners by email before they take effect.