Privacy Policy

What CS Desk is

CS Desk is practice-management software for Company Secretary firms - tracking entities, annual filings, DSC custody, and recurring compliance tasks. We host and run it for you; your firm reaches it in a browser at its own address (yourfirm.csdesk.co.in).

What we hold

Two kinds of information, kept for two different reasons:

• Your firm’s working data - every company, LLP, director, task, filing and DSC record your firm enters, along with the contact details your firm chooses to store against them. This is entered by you and belongs to your firm.
• Account information - the name, email address and role of each person your firm gives a login to, and a record of your firm’s subscription. We need this to authenticate users and bill the right plan.

Every record is scoped to your firm’s account. One firm’s data is never visible to another firm.

What we do with it

We use your firm’s data to provide CS Desk to your firm - storing it, showing it back to your own users, and running the features you use. We do not sell it, share it with third parties for their own purposes, or use it to train any model, and we never use it for advertising.

We also look at how CS Desk is used across firms in aggregate - which forms and statuses firms add for themselves - to improve the defaults every firm starts with. This never involves reading one firm’s records to serve another.

Staff we employ can access it only in two situations: to investigate a support request your firm raises, or where the law requires it of us.

Who else touches it

We keep this list short deliberately. Your firm’s data is stored on servers we operate at a cloud infrastructure provider, and payments are handled by our payment provider, Razorpay - card details go to them directly and are never seen or stored by us. We do not send your firm’s data to any analytics, advertising, or profiling service.

Keeping it safe, and backups

Your firm’s data is hosted on Oracle Cloud Infrastructure, in India (Mumbai). Traffic to CS Desk is encrypted in transit (HTTPS, with certificates renewed automatically), reaching any of it needs a login, and what a signed-in person can then see is limited by the role your firm gives them - and never crosses into another firm’s account, ever.

Two categories of especially sensitive data get a further layer on top of that:

• Passwords are never stored, and never seen by us, as plain text. They are one-way hashed the moment they are set, so even direct access to the underlying database does not reveal a usable password.
• The Gmail OAuth refresh token described below - the one credential the Gmail section on this page covers - is encrypted before it is written to the database, with the encryption key held separately from the data it protects. A copy of the database on its own is not enough to use it.

We take a backup of the database daily, and keep a copy of that backup away from the server it runs on, so a lost or damaged server does not mean lost data. Backups are held with the same protections as the live data and are not shared with anyone.

No system is beyond risk, and we do not claim otherwise. If a breach ever affected your firm’s data, we would tell you.

Gmail integration

CS Desk is a Google OAuth verified application. Google has reviewed how this app requests and uses Gmail access, so the consent screen you see when connecting is the standard one, with no unverified-app warning.

A firm may optionally connect one of its own Gmail accounts so CS Desk can send automated compliance-deadline reminder emails (for example, an upcoming ROC filing due date) on the firm’s behalf, from the firm’s own mailbox.

• CS Desk requests a single Gmail scope, gmail.send, which permits sending mail only. It cannot read, search, modify, or delete any message in the mailbox.
• The only data retained from this is an OAuth refresh token, encrypted before it is stored and held against your firm’s account, used solely to authenticate outgoing reminder emails on that firm’s behalf. No message content, contact list, or mailbox data is read or stored.
• This access is never shared with, or used on behalf of, any third party, and never used for any purpose other than sending your firm’s own reminder emails.
• Access can be revoked at any time from Google Account Permissions, or by disconnecting Gmail from within CS Desk’s Firm Settings page. Disconnecting deletes the stored token.

CS Desk’s use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

How long we keep it, and deleting it

We keep your firm’s data for as long as the account exists. A paid plan ending changes nothing about this - a cancelled or unpaid plan drops your firm to the Free plan, and moving to Free never deletes a single record. There is no expiry date on your data while the account is open.

If you ask us to close the account and delete everything in it, we do that - and we hold a recoverable copy for seven days afterwards, so a deletion asked for in error can still be undone. Tell us within those seven days and we will put it back. After that the deletion is final: the data is gone from the live system, and disappears from our backups as those age out of rotation.

Your rights over your firm’s data

Indian data protection law - the Digital Personal Data Protection Act, 2023 and the Information Technology Act, 2000 - gives the people whose personal data is held a set of rights, and we honour them for every firm and every individual user on CS Desk:

• See what we hold. Ask us what personal data of yours we hold and why, and we will tell you.
• Correct it. Most of it your firm can edit directly inside CS Desk; anything you cannot reach, we will correct on request.
• Take it with you. Ask for an export of your firm’s data in a usable format, at any time, whether or not you are on a paid plan.
• Have it deleted. Ask us to close your account and delete everything in it, and we will - with a seven-day window to change your mind, described above.
• Withdraw Gmail access. Disconnecting Gmail in Firm Settings, or revoking it in your Google account, takes effect immediately and deletes the stored token.
• Complain, and get an answer. Write to us at the address below and we will respond.

Links to other sites

CS Desk links out to a few places - Google’s account permissions page, our payment provider during checkout. Those sites have their own privacy policies, and this one does not cover what they do with information you give them directly.

What we don’t do

No advertising, no tracking or analytics that identify you personally, no selling or sharing of data with third parties for their own purposes, and no use of your firm’s data to train any model.

Changes to this policy

If this policy changes, the update will be posted on this page with a new “last updated” date.

Contact

Questions about this policy, a complaint about how your data has been handled, or a request to delete your firm’s data, can be sent to hello.csdesk@gmail.com, or see our contact page.