Privacy Policy

1. Scope

This Privacy Policy describes how Lekhya ("Lekhya", "we") handles two different kinds of data: personal data about the people who use the Service ("Personal Data"), and the audit data your firm uploads about its own clients ("Client Data", covered contractually under Section 4 of the Terms of Service and referenced here for how it is stored and secured). This policy is written to align with India's Digital Personal Data Protection Act, 2023 ("DPDP Act").

2. Personal Data we collect

• Account data: name, work email, firm name, and a hashed password, when you create an account.
• Billing data: billing contact details and transaction records, handled via our payment processor; Lekhya does not store full card numbers.
• Lead and enquiry data: name, work email, firm size and what you're interested in, if you request a demo, book a call, or submit a form on the marketing site.
• Usage and device data: pages visited, features used, browser and device type, and approximate location from IP address — collected via the analytics described in Section 6.
• Consent records: whether you accepted the Terms of Service and whether you opted in to marketing email, with a timestamp, kept as evidence of consent under the DPDP Act.

3. How we use it

• To create and operate your account, and to provide the Service your firm has subscribed to;
• To process billing and send transactional communications (invoices, security alerts, password resets) — these are sent regardless of marketing preference, as they are necessary to operate your account;
• To send product updates and audit-compliance content by email, only if you have opted in — see Section 5;
• To understand which pages, articles and free tools are useful, so we can improve them — see Section 6;
• To respond to a demo request, a booked call, or a question you send us;
• To meet a legal obligation, including a request from a regulator or law-enforcement authority with lawful power to make one.

4. Legal basis for processing

Where the DPDP Act requires a specific lawful basis, we rely on your consent (for account creation and for marketing email specifically), on the necessity of processing to perform the contract you entered into with us (for providing the Service and for billing), or on a legitimate use recognised under the DPDP Act (for basic security logging and fraud prevention).

5. Marketing email consent, specifically

During account creation, and on some marketing-site forms, you are asked a separate, unticked checkbox asking whether you'd like to receive product updates and audit-compliance content by email. That checkbox is never pre-selected and is never bundled with acceptance of the Terms of Service — the two are recorded as two separate answers. You can withdraw this consent at any time via the unsubscribe link in any marketing email, or by writing to the address in Section 10, without affecting your ability to use the Service.

6. Cookies and analytics

We use Google Tag Manager and Google Analytics to understand site and product usage, gated behind a consent banner that defaults analytics cookies to "denied" until you actively accept them — see the cookie banner shown on your first visit, which you can reopen from the footer. No advertising cross-site tracking is used.

7. Who we share data with

We share Personal Data only with service providers who process it on our behalf under contract — our cloud hosting and database provider, our payment processor, and our analytics provider (Google) — and only to the extent each needs to perform its function. We do not sell Personal Data, and we do not share Client Data with any third party except at your firm's own direction (for example, exporting a working paper you ask us to send to someone).

8. Where data is stored

Account data and Client Data are stored with cloud infrastructure providers; the specific regions and any cross-border transfer are described in full on our Security page, which takes precedence over any general statement here if the two ever appear to conflict.

9. Your rights

Under the DPDP Act, you can ask us to:

• Confirm whether we are processing your Personal Data, and give you a summary of what we hold;
• Correct or update inaccurate or incomplete Personal Data;
• Erase Personal Data we no longer have a basis to keep;
• Withdraw consent (including marketing consent) at any time, as easily as you gave it;
• Nominate another individual to exercise these rights on your behalf in the event of death or incapacity.

To exercise any of these, write to the address in Section 10. We will respond within the timeframe required by the DPDP Act.

10. Grievance Officer and contact

For a question about this policy, or to raise a grievance, write to [email protected]. We aim to acknowledge a grievance within 24 hours and resolve it within 15 days, consistent with the Information Technology Act, 2000 and rules made under it.

11. Changes to this policy

We may update this policy from time to time. For a material change — in particular, any change to how marketing consent is collected or used — we will give notice by email to the account holder, or by a notice within the Service, at least 15 days before the change takes effect.