Privacy Policy

This policy is published by Total Business Advisory Private Limited (CIN U74999MH2013PTC248991), registered office at Office No. 464, Central Facility Building No. 2, Sector 19, APMC Market 2, Turbhe-Vashi, Navi Mumbai, Thane, Maharashtra 400705, India (“TBA”, “we”, “us”). TBA runs www.totalbusinessadvisory.com, a platform that accountancy and tax practices (“firms”) use to run their client portal, and that their clients use to work with them.

It covers three groups of people, and our role is different for each:

• Visitors — people browsing our public website or writing to us. We decide how this data is used.
• Firms — the owners and staff of firms that subscribe to TBA. We decide how their account and billing data is used.
• Clients of firms — people and businesses who join a firm’s portal. The firm decides why and how their data is used for the professional work (it is the Data Fiduciary under the DPDP Act). We process that data on the firm’s behalf, to provide the platform, and for no other purpose of our own.

If you are a client of a firm, your firm’s own privacy notice also applies, and questions about your case, your documents or what the firm does with them should go to the firm first.

• Account details — your name, email address and profile picture from Google when you sign in with Google; or, for team members who sign in with email, their email and a password (stored only as a secure hash by our authentication provider).
• Firm and booking details — firm name, owner’s name, sign-in email, mobile number and city when a plan is booked; business details the firm adds for its quotes and invoices; staff names, phone numbers and emails the firm adds to its team; the firm’s Razorpay keys (stored encrypted).
• Client details — details a client gives in chat or the firm records — for example business type, state and city, nature of business, approximate turnover, and mobile number.
• Messages — everything written in the portal chat between a client, the firm and the AI assistant, and messages between a firm and TBA.
• Documents — files clients or firms upload — which can include PAN and Aadhaar cards, bank statements, bills, rent agreements and registration certificates — and the text and fields read from them.
• Quotes, contracts and signatures — quotes, contracts, the signature a client draws on screen, and when it was signed.
• Payments — amounts, invoice details and Razorpay order and payment references. Card, UPI and bank details are entered with Razorpay and never reach our servers.
• Forms on this website — what you send through the contact form: name, email, phone and your message.
• Technical data — IP address and email address counted briefly to stop abuse of sign-in and form pages (kept for about two days), server logs, and the session cookies that keep you signed in.

Please don’t share OTPs, passwords or PINs in the chat. The assistant is designed never to ask for them; if one is sent, it is stored as part of the conversation until the firm deletes it.

• To provide the platform: accounts and sign-in, each firm’s portal, chat, document storage, quotes, e-signature, invoices and payment requests.
• To run the AI features a firm has enabled: replying to clients, extracting business details and requirements, reading and categorising documents, and drafting messages and quotes for the firm to review.
• To bill firms for their plan, enforce plan limits and send renewal and usage notices.
• To keep the service secure: rate limiting, detecting misuse, and investigating incidents.
• To answer your enquiries and support messages.
• To meet legal obligations, such as tax records for our own invoices.

The assistant and document reading are powered by Google’s Gemini models, accessed through Google’s paid API. To answer a client, the relevant conversation, the firm’s services and prices and the client’s record are sent to the model; to read a document, the document is sent. Under Google’s terms for its paid API, this data is not used to train or improve Google’s models.

AI output is a draft. Prices in quotes come only from the firm’s own price list, figures in replies are checked against the firm’s records, and anything needing professional judgement is handed to a person at the firm. Document analysis is shown to the firm only, never directly to the client. We do not use AI to make decisions that have legal or similarly significant effects on you without a person at the firm involved.

We do not sell personal data or use it for advertising. We share it only as follows:

• The firm you work with — a client’s data is available to their firm. Other firms on TBA can never see it.
• Service providers who process data for us — Supabase (database, sign-in and file storage), Vercel (website hosting), Google (Google sign-in, Gemini AI and Gmail for sending email, and Google Ads to measure our own ads on the public pages), and Razorpay (payments — for a firm’s client payments, the firm’s own Razorpay account). Each processes data only to provide its service to us.
• When the law requires it — to comply with a valid legal request from a court or government authority, or to protect the rights, safety or property of our users or others.
• If our business changes hands — to a successor, who must continue to protect it as this policy describes.

Some of these providers store or process data on servers outside India. Where they do, we rely on their contractual and security commitments, and we transfer data only to countries the Government of India has not restricted.

• Each firm’s records are separated at the database level by row-level security, and we test that one firm cannot read another’s data.
• Uploaded files and PDFs are stored privately. Every download is checked against your access and served through a link that expires within a minute.
• Firms’ Razorpay secrets are stored encrypted in a vault, readable only by the payment code on our servers.
• All traffic is encrypted in transit (HTTPS). Sign-in is through Google or a hashed password, with limits on repeated attempts.
• Access to data by TBA is limited to what is needed to run, support and bill the service.

We keep account, firm and client data for as long as the firm’s account is active. If a firm’s plan lapses, its data is kept so the firm can renew and continue; a firm can ask us to delete its account and data at any time. Firms may need to keep some records for longer to meet their own professional and tax obligations, and should export what they need before asking for deletion.

Rate-limiting counters are deleted after about two days. Contact messages (and demo requests made before the demo form was removed) are kept while we follow up, and deleted on request. Our own billing records are kept for as long as Indian tax law requires.

Under the Digital Personal Data Protection Act, 2023, you have the right to:

• get a summary of the personal data we process about you and how;
• have inaccurate or incomplete data corrected and updated;
• have your data erased when it is no longer needed for the purpose it was given, unless the law requires us to keep it;
• withdraw consent you have given, going forward;
• nominate someone to exercise these rights if you die or become unable to; and
• have a grievance addressed, and to complain to the Data Protection Board of India if you are not satisfied.

If you are a client of a firm, send requests about your case to the firm — they control that data and can correct or delete it. You can also write to us and we will pass the request on and help the firm respond. Everyone else can write to us directly at tba.support@totalbusinessadvisory.com. We will respond within 30 days and may need to confirm your identity first.

We use the cookies needed to keep you signed in and to keep your session secure. On our public pages only (the home, pricing, checkout and contact pages and the like, never the firm or client dashboards), we also use the Google Ads tag, which sets cookies so we can tell whether a visit from one of our ads led to a plan booking or an enquiry. It sends Google the page visited and that event (with the amount, for a booking), not what you type into our forms. You can turn off personalised ads at adssettings.google.com or block these cookies in your browser; the site works the same without them. If you block all cookies, you can still browse the public pages but won’t be able to sign in.

TBA is for businesses and the people who run them. It is not meant for anyone under 18, and we do not knowingly collect children’s data. If you believe a child has given us personal data, contact us and we will delete it.

We will update this page when our practices change and change the date at the top. If a change materially affects how we use data already collected, we will tell firms by email or in their dashboard before it takes effect.

For any question, request or complaint about privacy, write to our Grievance Officer, Yogesh Dayma, Director, at tba.support@totalbusinessadvisory.com with “Privacy” in the subject. We aim to resolve every grievance within 30 days.

You can also use our contact form.