Privacy

Plainly: what PBC Tracker keeps, where, and what you can ask for.

What is collected

• Your email address, to send you sign-in codes and to know which workspace is yours.
• What you put in your workspace: clients, engagements, PBC lists, notes, and the supports (emails and files) that arrive for your requests, from your mailbox or your clients' upload link.
• Mailbox connection details, if you connect Gmail or Outlook: the account address and an encrypted sign-in token (or app password). Mailbox access is read-only: nothing is sent, deleted, moved or marked as read, and only mail from your clients' email domains is read.
• For abuse protection, a hashed (not readable) record of sign-in code requests, kept for an hour.
• If you buy Pro, a record of each payment: the plan, amount, date, status and Razorpay's order and payment IDs (for your receipts and your plan's end date).

Payments

Payments are processed by Razorpay. Your card, UPI, net banking or wallet details are entered in Razorpay's own checkout and go straight to Razorpay: PBC Tracker never receives or stores them. Razorpay handles them under its own privacy policy and the payment-card and RBI rules that apply to it.

Analytics (Microsoft Clarity)

To understand how the site is used and to fix problems, PBC Tracker uses Microsoft Clarity on its public pages (home, pricing, policies and sign-in) and inside the signed-in app. Clarity records clicks, scrolling and page layout, and sets cookies (such as _clck and _clsk) to tell visits apart. It is never used on the upload page sent to your clients. Inside the app, everything on screen except the menu is masked in your browser before anything is sent, so client names, PBC requests, files, emails and your email address are never recorded; anything typed into a form is masked too, and pages whose address contains a sign-in link or a search term are not recorded at all. Clarity is run by Microsoft under the Microsoft Privacy Statement, and its data may be stored outside India. You can block Clarity with your browser's tracking protection or a content blocker; the site works the same.

Where it is stored

In a Supabase database and storage bucket in the Mumbai (India) region. The application runs on Vercel. Each user's workspace is private: no other user can see or change it.

What is not done

• Your data, and your clients' data, is never sold or shared for advertising.
• The app does not send email to your clients; invites open in your own email or WhatsApp.

Deleting your data

You can delete your workspace yourself at any time from Settings → Delete my workspace. That removes every client, engagement, request, note and stored file in it, and its payment records here. Razorpay keeps its own record of each payment, as the law requires it to. You can also ask for deletion, or for a copy of your data, by email.

Your rights under India's Digital Personal Data Protection Act, 2023

PBC Tracker handles personal data in line with the Digital Personal Data Protection Act, 2023 (the DPDP Act). This section says what personal data is processed and why, on what basis, what your rights are, and whom to write to.

What personal data is processed, and why

• Your account email address: to send your sign-in codes, to know which workspace is yours, and to answer you.
• Your clients' contact details in your PBC data: names and email addresses of your clients' staff (request owners, the contacts you send the upload link to, the domains and addresses their mail comes from), so supports are matched to the right request and you can follow up.
• Mail from your clients' email domains, if you connect a mailbox: the messages and attachments from the domains and addresses you list for a client are read and kept as supports. Other mail is not kept.
• If you buy Pro, the payment records described above; and, for abuse protection, the hashed sign-in records.

On what basis

Your consent, given when you sign up (the sign-in page says that by continuing you agree to the Terms and this Privacy Policy), and the legitimate use of providing the service you signed up for, such as keeping payment records that the law requires. You can withdraw your consent at any time by deleting your workspace; that does not undo processing that already happened.

Your clients' data: you are the data fiduciary

For your clients' personal data that you upload, import or receive into your workspace, you, the auditor or audit firm, are the data fiduciary: you decide why it is processed. PBC Tracker processes it only on your behalf, to provide the service to you. You are responsible for having the right to upload it, for example under your engagement terms or with your client's consent, and for answering your clients' requests about it. PBC Tracker helps you do that: you can correct or remove a client's details at any time.

Your rights

• Access: ask for a summary of the personal data held about you, what it is used for, and a copy of it.
• Correction: correct, complete or update it. Most of it you can change yourself: a client's name and email details on the client's page, requests on the engagement, the workspace name in Settings.
• Erasure: Settings → Delete my workspace erases everything in your workspace at once; you can also ask for erasure by email.
• Grievance redressal: you can raise a grievance with the Grievance Officer named below. If you are not satisfied with the answer, you may complain to the Data Protection Board of India.
• Nominate: you can nominate another person to exercise these rights for you if you die or become unable to do so.

How long it is kept

Your data is kept until you delete it, or delete your workspace. Deleting the workspace erases its clients, engagements, requests, notes, mail and files straight away. Razorpay keeps its own record of each payment for as long as the payment and tax laws require. Hashed sign-in records are kept for an hour.

Grievance Officer

Write to the Grievance Officer for PBC Tracker at arpitmor17@gmail.com with any request, question or complaint about your personal data, including requests to access, correct or erase it, or to nominate someone. You will get a response within 30 days.

Questions or requests: arpitmor17@gmail.com.