Privacy Policy

• Full name
• Email address
• Phone number
• Business name and designation
• Postal address (for clients and registered users)

Collected when: You contact us via email or phone, register for a product, begin an Office Sahayogi engagement, or subscribe to any Sahayogi service.

• Business financial data (accounts, invoices, receipts, payables, receivables)
• Employee and payroll data (via BoSS People & Payroll module)
• Inventory records
• Customer and vendor data entered into BoSS
• Compliance and regulatory records
• Business correspondence and documentation

Collected when: You use BoSS, Office Sahayogi, or any operational product.

• Income details and tax returns
• GST registration and filing data
• Investment portfolio information (via My Sahayogi)
• Bank account details (only as required for specific product functionality)
• PAN and Aadhaar-linked data (only where legally required)

Collected when: You use Tax Sahayogi, My Sahayogi, or provide financial information for Office Sahayogi engagements.

• WhatsApp Business messages processed through Chat with Sahayogi
• Email correspondence with Sahayogi
• Chat and support records

Collected when: You communicate with us or use the Chat with Sahayogi product. WhatsApp data is processed subject to Meta’s WhatsApp Business API terms.

• IP address and device information
• Browser type and version
• Pages visited on sahayogi.in and subdomains
• Session duration and navigation data
• Login timestamps and access logs
• Sahayogi AI query data (prompts and responses)

Collected when: You visit our website, use any web-based product, or sign in to Sahayogi AI.

• Creative assets, designs, and brand materials uploaded to Studio Sahayogi
• Campaign briefs and content workflows
• Brand asset library contents

Collected when: You use Studio Sahayogi.

• Files and software data hosted via Sahayogi Cloud (Tally on Cloud, Busy on Cloud, VPS, Dedicated Servers)
• Microsoft 365 data accessed via Sahayogi Cloud services
• Digital signature certificate data

Collected when: You use Sahayogi Cloud infrastructure services.

• Setting up and managing your account on any Sahayogi product
• Delivering Office Sahayogi consulting engagements and Business Health Checks
• Providing BoSS platform access and data management
• Hosting your data via Sahayogi Cloud
• Processing business communications via Chat with Sahayogi
• Providing Tax Sahayogi query resolution, notice drafting, and filing assistance
• Generating AI-powered insights via Sahayogi AI from your connected product data
• Managing personal finance data in My Sahayogi
• Managing creative workflows in Studio Sahayogi

• Compliance with the DPDP Act, 2023
• Compliance with applicable tax, GST, and company law obligations
• Responding to lawful requests from government authorities
• Maintaining records required under Indian law

• Improving product functionality based on usage patterns
• Security monitoring and fraud prevention
• Internal reporting and business analytics
• Communicating service updates, product changes, and important notices to existing users

• Sending marketing communications, newsletters, or product updates (you may opt out at any time)
• Using cookies beyond strictly necessary categories (see Cookie Policy)
• Processing data for Sahayogi AI learning and improvement (where applicable)

We engage third-party service providers who process data on our behalf, under written data processing agreements. These include:

• Cloud infrastructure providers: For hosting Sahayogi products and data (Indian data centres preferred; international processors used only where Indian equivalents are unavailable)
• Microsoft: For Microsoft 365 services provided via Sahayogi Cloud
• Meta (WhatsApp Business API): For Chat with Sahayogi message processing — subject to Meta’s WhatsApp Business API terms and data policies
• Payment processors: For subscription and service payments (where applicable)
• Communication tools: For email delivery and support

All service providers are required to process data only on our instructions and are prohibited from using your data for their own purposes.

We may disclose personal data where required by Indian law, court order, or a lawful request from a government authority. We will, where legally permissible, notify affected users of such requests.

In the event of a merger, acquisition, or restructuring of Sahayogi One Private Limited, personal data may be transferred to the successor entity. You will be notified of any such transfer and your rights to object.

Where you are a client of both Sahayogi One Private Limited and Investor Sahayogi Partnership Firm, data may be shared between these two entities only with your explicit consent and for the specific purpose of providing connected services (for example, connecting My Sahayogi with Investor Sahayogi investment data). Each entity’s data responsibilities are governed separately.

Sahayogi stores personal data on cloud infrastructure located in India wherever possible, in compliance with the Digital Personal Data Protection Act, 2023. Where data is processed or stored outside India (for example, through international cloud providers), we ensure appropriate safeguards are in place.

Sahayogi implements security measures aligned with ISO 27001 principles (note: Sahayogi is not currently ISO 27001 certified) to protect personal data against unauthorised access, disclosure, alteration, or destruction. These measures include:

• End-to-end encryption for data in transit (TLS/HTTPS across all products)
• Encryption of data at rest where technically feasible
• Role-based access controls — data accessible only to authorised personnel
• Access logging and monitoring for all production systems
• Regular security reviews of infrastructure and product architecture
• Employee data handling training and confidentiality obligations

No method of electronic storage or transmission is 100% secure. While we take all reasonable steps to protect your data, we cannot guarantee absolute security.

We retain personal data for as long as necessary to provide our services, comply with legal obligations, and resolve disputes. Retention periods vary by data type:

When data is no longer required, it is deleted or anonymised in a manner that prevents identification.

You have the right to know what personal data we hold about you, the purposes for which it is processed, and the identity of any third parties with whom it has been shared.

You have the right to request a copy of the personal data we hold about you.

You have the right to request correction of inaccurate or incomplete personal data we hold about you.

You have the right to request deletion of your personal data where it is no longer necessary for the purposes for which it was collected, where you withdraw consent (for consent-based processing), or where processing was unlawful. This right is subject to our legal retention obligations.

Where we process your data on the basis of consent, you have the right to withdraw that consent at any time. Withdrawal of consent does not affect the lawfulness of processing before the withdrawal.

You have the right to have grievances regarding your personal data addressed by us promptly and effectively.

You may nominate another individual to exercise your data rights on your behalf in the event of your death or incapacity.