Privacy Policy

DueFiler (“the Platform”, “we”, “us”) is a multi-tenant compliance practice-management platform for Practising Company Secretary (PCS) firms in India, operated by Spaculus Software, 13th Floor, Vihav Supremus, Off Gotri Rd, Near Iscon Heights, Gotri, Vadodara, Gujarat, India. This policy explains what data we collect, how it is used, and the rights available to both our direct customers (the PCS firms who subscribe to the Platform, “Tenants”) and the individual users those Tenants authorize to use it (“Users”).

DueFiler is business-to-business software. The Platform has no public sign-up and no end-client login — a Tenant firm's own clients are never Users of the Platform and never create accounts here; all client contact happens outside the Platform (email, phone, WhatsApp) as described below.

Account & identity data. Name, username, email address, mobile number, role, and hashed password for every User an Admin creates within a Tenant.

Tenant business data. Everything a Tenant firm enters to run its compliance practice through the Platform: client/entity master records, director and signatory details, task and filing data, uploaded documents and their version history, invoices, and DSC/DIN registry entries. This data belongs to the Tenant firm, not to us, and is stored in that Tenant's own isolated database (see §4).

Communications data, only when a Tenant connects it. If a Tenant chooses to connect an email mailbox (Gmail, Google Workspace, or another IMAP/SMTP provider) or a WhatsApp Business number to the Platform's Unified Inbox, we process the messages and attachments that flow through that connected account — solely to display and triage them inside the Platform on that Tenant's behalf. We do not connect any mailbox or WhatsApp number ourselves, and a Tenant can disconnect at any time (message history already ingested is retained; syncing simply stops).

Usage & log data. Standard application logs (timestamps, actions taken, error traces) and audit trail entries recording who changed what and when, for security, debugging, and the Platform's own maker-checker/compliance requirements.

Cookies. A session cookie to keep a User signed in. We do not use advertising or cross-site tracking cookies.

• To provide, operate, and maintain the Platform's core features for each Tenant.
• To authenticate Users and enforce each Tenant's own role- and permission-based access controls.
• To operate the Unified Inbox for any email/WhatsApp account a Tenant has chosen to connect.
• To send notifications the Platform is configured to send (task escalations, DSC expiry alerts, and similar operational alerts a Tenant's own Admin configures).
• To maintain security logs and an audit trail of business-meaningful actions.
• To bill the Tenant firm for its subscription (plan, storage, and seat usage).
• To provide customer support, including, with a Tenant's awareness, time-limited support-staff access to a Tenant's account (see §6).

We do not sell personal data, and we do not use Tenant business data to train any third-party AI model.

DueFiler uses a database-per-tenant architecture: each Tenant firm's business data lives in its own separate database, never in a shared table alongside another Tenant's data. A single master database holds only platform-level records (the tenant registry, subscription/billing records, and our own operating-team accounts) — never any Tenant's client or compliance data.

Uploaded documents are stored either on encrypted cloud object storage or, for certain deployments, on the hosting server's own disk, with every upload versioned rather than overwritten. Passwords are stored as one-way cryptographic hashes, never in plain text. Sensitive credentials (e.g. a connected mailbox's access token) are stored encrypted at rest.

We do not sell or rent personal data to third parties. Data is shared only with the service providers necessary to operate the Platform, each acting as a processor on our instructions:

• Google (Gmail API, and Google Cloud Pub/Sub) — only for a Tenant's own connected Gmail/Google Workspace mailbox, to sync that mailbox's messages into the Unified Inbox.
• Meta (WhatsApp Business Cloud API) — only for a Tenant's own connected WhatsApp Business number, to send and receive messages through the Unified Inbox.
• Our database hosting provider and, where applicable, our cloud object-storage provider, both of which store data at rest on our behalf and do not use it for their own purposes.

We may also disclose data where required by law, regulation, or a valid legal process applicable in India.

Our own operating team can, for support purposes, temporarily access a Tenant's account (“impersonation”). Every such session is logged (who, which Tenant/User, start and end time), is short-lived, requires the support team member to re-authenticate immediately beforehand, and displays a persistent on-screen banner to the impersonated User for the entire duration — this access is never silent.

Tenant business data is retained for as long as the Tenant's subscription is active, including throughout a free trial period. If a subscription lapses without renewal, the Tenant's account becomes read-only — existing data remains fully viewable and exportable, and nothing is deleted as a result of a lapsed subscription alone. Audit trail records are retained for the life of the Tenant's account and are never pruned on a schedule, given their compliance purpose.

A Tenant firm's own designated retention periods for client documents, emails, and similar records are configurable by that Tenant's Admin and are the Tenant's own responsibility as the data controller for its clients' information.

A User's own account details (name, email, username) can be corrected by their firm's Admin at any time. To request access to, correction of, or deletion of personal data we hold about you, contact us using the details in §10. Where a request concerns data a Tenant firm controls about its own clients (e.g. a director's contact details entered by that firm), we will direct the request to that Tenant, as they are the data controller for that information.

We may update this policy from time to time, for example as new integrations or features are added. The “Last updated” date at the top of this page reflects the most recent revision. Material changes affecting how Tenant business data is handled will be communicated to Tenant Admins directly.

Questions about this policy, or requests relating to your personal data, can be sent to web.ketan@spaculus.info or by phone at +91-740-540-7700.

Spaculus Software
13th Floor, Vihav Supremus, Off Gotri Rd, Near Iscon Heights, Gotri, Vadodara, Gujarat, India