About this policy
Nootus AI ("Nootus", "we", "us") builds Nootus OS, software used by CA, CS, CMA and accounting firms to run their practice and their clients' Finance, Tax and Office work. This policy explains how we handle personal data on this website (www.nootus.ca), in the Nootus OS application, on the client portal and in the WhatsApp and email messages sent through Nootus.
Nootus AI is based in Hyderabad, Telangana, India. We process personal data under the Digital Personal Data Protection Act, 2023 and the rules made under it (together, the "DPDP Act"), and other Indian law that applies.
Our two roles
For data a firm puts into Nootus about its clients, its clients' customers, vendors and employees, and its own staff, the firm decides why and how that data is processed. The firm is the data fiduciary and Nootus is its data processor. We process that data only on the firm's instructions and under our agreement with the firm.
For people who visit this website, fill in a form on it, or write to us, and for the account details of the people who sign in to Nootus, Nootus is the data fiduciary.
If you are a client of a firm that uses Nootus and have a question about your data, please contact the firm first. We will help the firm answer you.
What we collect
Depending on how you use Nootus, we collect or process:
- Account details: name, work email, mobile number, role, firm and branch, sign-in method and preferences.
- Client records a firm keeps in Nootus: books of account, invoices, bills, bank statements, returns and working papers, PAN, GSTIN, TAN, addresses, and payroll data such as salaries, bank accounts, declarations and dependants.
- Messages: the content of WhatsApp, email and portal messages between a firm and its clients, the phone numbers and email addresses used, delivery and read receipts, and the files attached.
- Password vault entries: the government portal logins (such as Income Tax, GST, TRACES, EPFO, ESIC and MCA) a firm chooses to store for its clients, and a log of every time one is viewed.
- Questionnaire answers and documents that clients upload through the portal or WhatsApp.
- Records of AI work: which agent did what, for which client, from which records, and which person it reports to.
- Website enquiries: the details you enter in a demo or partner form, such as name, firm, city, number of clients, role, email or phone, and your message.
- Website analytics: pages visited, approximate location, device and browser details and events such as a form being submitted, collected through Google Analytics 4 (see our cookie notice).
- Security and usage logs: IP address, device, time and action, for sign-ins, sensitive actions and errors.
How we use it
We use personal data only to:
- provide Nootus OS to the firm, including the AI agents, messaging, portal and product features the firm switches on;
- sign people in, keep accounts secure, detect misuse and investigate incidents;
- answer support requests and enquiries, and arrange demos;
- bill firms for their plans and keep financial records;
- understand how the website is used so we can improve it;
- meet our legal obligations, including requests from authorities that the law requires us to answer.
AI and your data
Nootus uses AI models to read documents, answer client questions from the firm's records, draft messages and prepare work for review. The AI works only on the data of the firm it is working for, and only for the purposes the firm has set.
Firm and client data is never used to train or fine-tune any AI model, ours or any provider's. The prompts sent to AI models and the raw answers they return are not logged; we keep a record of what each agent did, for which client and for whom, so the firm can review it.
AI output is a draft for the firm's staff. Filing with a government authority, moving money and changing access always wait for a person at the firm to approve.
Messages on WhatsApp and email
Messages to a firm's clients are sent from Nootus's WhatsApp Business number and Nootus email addresses, on the firm's behalf. The firm is responsible for having its clients' permission to message them.
WhatsApp messages travel through Meta's WhatsApp Business Platform and emails through our email providers, under those providers' own terms and privacy policies. Some of them process data outside India.
Password vault
Portal logins stored in the password vault are encrypted with an additional layer beyond the encryption used for other data. They are shown only to staff the firm has permitted, after a second check, and every view is logged with the person, time and client.
A firm may store a client's logins only with that client's authority.
Website forms and analytics
When you submit a form on this website, it is sent to a small service we run on Microsoft Azure, which checks it, emails it to our team and keeps a copy so nothing is lost. Forms are protected by Cloudflare Turnstile, which checks that a person, not a bot, is submitting them.
Google Analytics 4 loads on every page of this website and sets cookies to count visits and understand how pages are used. Our cookie notice explains what it collects and how to limit it.
We use form details only to reply to you and to talk to you about Nootus. We do not add you to a mailing list without asking.
Where data is kept
Nootus OS is hosted in India, on Microsoft Azure data centres in India. Firm data, documents and backups are stored there.
Some services process data outside India: Meta for WhatsApp, Google for Gmail, Sign-in and Analytics, Cloudflare for Turnstile, and an AI provider a firm chooses where it chooses one. We transfer data outside India only as the DPDP Act permits and never to a country the Government of India has restricted.
How we protect it
Data is encrypted in transit and at rest, and PAN, bank details and portal passwords get an extra layer of encryption. Each firm's data is kept apart, so no other firm can see it.
Access inside a firm follows roles the firm sets, with a separate permission to approve. Nootus support staff can only read, one record at a time, tied to a support ticket and a reason, and every access is recorded. Nootus staff cannot start AI work on a firm's data.
No system is perfectly secure. If a personal data breach affects you, we will tell the affected firms, the Data Protection Board of India and, where we are the fiduciary, you, as the DPDP Act requires.
How long we keep it
We keep data only as long as it is needed for the purpose it was collected for, or as long as the law requires. A firm decides how long its client records are kept, within statutory minimums such as eight years for books of account. Our data retention policy sets out the periods for each kind of data.
Your rights
Under the DPDP Act you have the right to:
- get a summary of the personal data we process about you and how we process it;
- have inaccurate or incomplete data corrected and updated;
- have your data erased when it is no longer needed, unless the law requires us to keep it;
- withdraw consent you have given, without affecting processing done before;
- nominate another person to exercise your rights if you die or become unable to;
- have a grievance addressed by our Grievance Officer, and then by the Data Protection Board of India.
Children's data
This website and Nootus OS are meant for professionals and businesses, not children. Firms may keep data about minors in client records, for example dependants in payroll or minors' income in a family's returns; they do so as fiduciaries and must obtain a parent's or guardian's consent where the DPDP Act requires it. We do not track children or use their data for advertising.
Grievance Officer
Our Grievance Officer handles privacy questions, requests and complaints. Write to privacy@nootus.ai. We acknowledge every message and respond within 7 days.
If you are not satisfied with our response, you may complain to the Data Protection Board of India.
Changes to this policy
We will update this policy when our product or the law changes. The date at the top shows the latest version. If a change is significant, we will tell firms by email or in the application before it takes effect.