Privacy Policy

1. Overview & Architecture Philosophy

CAControl Audit Suite is an enterprise-grade desktop audit automation suite built specifically for Chartered Accountants, Tax Auditors, Corporate Finance Teams, and Accounting Practitioners.

Because financial audit practitioners handle highly confidential client accounting books, GST return filings, bank transactions, trade debts, and tax computation records, our software is engineered with an offline-first, zero-cloud data architecture. Unlike conventional SaaS audit applications that require uploading client ledgers to remote servers, CAControl Audit Suite runs 100% locally on your Windows device and does not transmit any local data.

2. Data We NEVER Access, Upload, or Store

During your operation of CAControl Audit Suite, the following categories of confidential information never leave your local computer:

• Client Accounting & Ledger Data: Tally XML backups, Excel ledgers, trial balances, Day Books, and journal vouchers.
• GST and Tax Records: GSTR-2B JSON files, GSTR-1 returns, invoice registers, Form 3CD schedules, and Sec 43B(h) MSME registers.
• Client Identifiers: Client PANs, GSTINs, corporate addresses, banking account numbers, and turnover statistics.
• Generated Audit Working Papers: Excel outputs, reconciliation sheets, and audit notes saved on your local storage.

3. Desktop Application: 100% Offline Processing & Zero Data Transmission

The desktop application is engineered exclusively as an offline tool. It does not transmit any local files, client data, usage analytics, hardware telemetry, or personal information over the internet:

4. Information Collected via Website & Technical Support

When you visit our website (https://audit.cacontrol.online), request a demonstration, download the installer, or purchase an enterprise license, we may collect:

• Contact Information: Name, professional email address, mobile/WhatsApp number, CA firm or corporate entity name, and city of practice submitted voluntarily via our contact and download forms.
• Billing Information: Purchase orders, GSTIN for business invoicing, and transaction IDs.
• Payment Security: Online card, UPI, and Net Banking payments are processed through Razorpay Software Private Limited. We do not store or process your credit/debit card numbers, CVVs, or Net Banking credentials on our servers. Razorpay processes your payment under PCI-DSS Level 1 compliance.
• Technical Inquiries: Transcripts of emails, WhatsApp messages, or support tickets submitted to our technical desk for issue resolution.

5. Windows System Permissions & Hardware Capabilities

In accordance with Microsoft Store App Developer Agreement and Store Policy 10.5, we disclose the following system access declarations:

6. Purpose and Legal Grounds for Processing

We process personal data solely on legitimate statutory and contractual bases:

• Performance of Contract: Delivering valid desktop license keys, enabling software activation, and providing technical support.
• Legitimate Interests: Preventing unauthorized piracy, ensuring node-locked license enforcement, and securing application integrity.
• Legal Compliance: Issuing tax invoices and preserving purchase logs in accordance with the Indian Goods and Services Tax (GST) laws and Companies Act.

We do not sell, rent, monetize, or trade your personal data or your clients' data under any circumstances.

7. Local Storage and Data Security

We enforce industry-standard security measures across all software and web touchpoints:

• Local SQLite Database:Audit files and working sets are stored locally inside the user's secure Windows profile folder. Access is restricted to authorized operating system user accounts.
• Cryptographic HMAC Signatures: License verification uses HMAC-SHA256 signatures, preventing tampering or unauthorized key modification.
• Encrypted Web Communication: Our website and customer support channels utilize TLS 1.3 encryption. The desktop application itself operates 100% offline and does not transmit local data.

8. Compliance with Statutory & Professional Standards

9. User Rights & Data Subject Inquiries

Under applicable data protection laws, you possess the right to:

• Request access to personal contact or billing information we maintain regarding your license.
• Request correction or rectification of outdated contact details.
• Request permanent deletion of your lead, demo, or marketing contact records.
• Revoke consent for receiving product updates or promotional communications.

To exercise any of these rights, contact our Data Grievance Desk at piush@cacontrol.online. Requests are verified and resolved within 7 business days.

10. Data Retention Policy

Contact and licensing information is retained only as long as your license agreement remains active, plus statutory retention periods required by Indian tax legislation for financial accounting records. Marketing inquiries without active licensing are scrubbed after 24 months of inactivity upon request.

11. Changes to this Privacy Policy

We may update this Privacy Policy from time to time to reflect modifications in software architecture, regulatory standards, or Microsoft Store policies. Updates will be published on this page with an updated "Last Revised" date.