1. Information We Collect

We collect firm-related details necessary for platform administration: firm name, practitioner name, professional email address, mobile phone number (for WABA connection), GSTIN, PAN, and credentials for Razorpay API integrations. We also temporarily store client metadata (names, phone numbers, and filing calendar logs) uploaded by you.

2. Professional Client Privilege

We recognize that financial and tax data falls under strict practitioner-client confidentiality privileges in India (in accordance with the ICAI code of ethics). Fynlop will never inspect, share, or sell your clients' tax records, files, or payment histories to third-party auditors or advertising agencies. All document attachments uploaded to the platform are secured via encrypted private storage buckets.

3. Data Security Measures

All traffic between your browser and Fynlop servers is encrypted using TLS 1.3. Databases are locked down using Row Level Security (RLS) policies matching each record's tenant UUID (`firm_id`) directly to the authenticated credentials, rendering unauthorized data access between firms impossible.

4. Third-Party Integrations

Our platform connects to:

• Supabase: For database hosting, authentication sessions, and file storage.
• Razorpay: To process subscription packages and verify invoice settlements securely.
• Meta WhatsApp Cloud API: To send automated reminders to clients on your behalf.

5. Cookie Policy

We use secure, HTTP-only cookie tokens to authenticate sessions. No tracking pixels or advertising cookies are utilized inside the dashboard area.

6. Data Retention & Erasure

When a CA deletes a client profile or invoice, the data is instantly purged from active database columns. Upon account cancellation, you can request full erasure of your firm's historical records.