Privacy Policy

What Lekhavo is

Lekhavo is a practice-management tool for Chartered Accountants and accounting practices in India. A practice uploads its clients' bank statements; Lekhavo turns them into transactions, applies the practice's categorization rules, matches transfers between a client's own entities, posts entries to a double-entry ledger, and prepares statements such as the Income Statement and Balance Sheet. Clients of a practice can sign in to a portal to review their own transactions and exchange documents.

This policy covers the Lekhavo application at lekhavo.com/app and this website.

Information we collect

Account information from Google Sign-In. When you sign in with Google we receive your name, email address, profile picture URL, and the identifier Google assigns to your account. We request only the basic profile and email scopes, and we store the sign-in tokens Google issues for them; we do not use them to call any other Google API. We never receive your Google password, and we cannot read your Gmail, Drive, Contacts, Calendar, or any other Google service.

Email address, if you sign in with an email code. You can sign up and sign in with a one-time code sent to your email instead of Google. We record the address as your account's email, keep only a hashed copy of each code, which works for five minutes, and keep a record of each code we send and each code checked (the address and the time) for rate limiting, deleted within a day.

Phone number, if you sign in with one. You can sign up and sign in with a one-time code sent by SMS instead of, or as well as, Google, and you can add a phone number to an account. Signing up by phone creates an account that holds your phone number, with your number standing in for your name and a placeholder email address we never write to. We record when a number was verified; when a practice has registered the same number for one of its clients, signing in with it also marks that client's number as verified. Each code works once, for five minutes. We also keep a record of each code we send and each code checked (the number and the time) for rate limiting, and delete it within a day.

Passkeys, if you add one. You can add a passkey to sign in without Google. Your device keeps the private key and checks your fingerprint, face or PIN itself; we store only the passkey's public key, its identifier, a name, and when it was added. Removing a passkey deletes these.

Data a practice uploads or enters. Bank statements and documents contain financial information about the practice's clients: names, account numbers, PAN, transaction descriptions and amounts, balances, and similar details. A practice also enters client and entity details, categories, rules and notes. This information is about the practice's clients, and the practice provides it to us.

Billing details. When a practice buys a plan or credits it pays by UPI or bank transfer outside the application and gives us the payment reference (UTR). We keep the order, the buyer's name, GSTIN, address and state, the reference and the invoice. We do not collect card details.

Product usage. Inside the signed-in application we record which screens and features are used, including page views, clicks and session replays (a recording of what was shown on screen during a session), to understand how Lekhavo is used and to improve it. Replays can include financial information that was on screen. We do not attach your name or email address to these records; a random identifier kept in your browser groups them by device. This website itself has no analytics.

Notification subscriptions. If you turn on browser notifications we store your browser's push subscription and send notifications, such as a statement finishing processing, through your browser vendor's push service.

Technical records. Our servers record the IP address, browser user-agent, timestamp and outcome of requests, with a request identifier used to trace faults, and keep the same details in an audit log of sign-ins and changes. Errors are reported to an error-tracking service so we can fix them.

We do not use advertising networks or tracking pixels, and we set no advertising cookies. Some pages embed YouTube videos in its privacy-enhanced mode; when you play one, YouTube (Google) receives your request and may set its own cookies.

How we use Google user data

The information we receive from Google Sign-In is used only to identify you: to decide which practice or client portal your email address gives you access to, and to show your name and picture so you can confirm which account you are using.

Lekhavo's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We do not transfer, sell or share this information with third parties, except the service providers listed below that run Lekhavo for us; we do not use it for advertising; and we do not use it to train generalised artificial-intelligence or machine-learning models.

No human reads your Google account data except where you have asked us to help with a support issue, where it is necessary for security or to investigate abuse, or where the law requires it.

How we use financial data

Data a practice uploads is used only to provide Lekhavo to that practice and to the clients it invites: to parse statements, categorize and reconcile transactions, post ledger entries, prepare reports and exports, and show clients their own records.

Every record belongs to the practice that created it. People signed in to one practice cannot see another practice's clients, and a client signed in to the portal sees only the records their practice shares with them.

Category suggestions. To suggest a category for a transaction, Lekhavo sends a service provider the transaction description with PAN, phone numbers, UPI handles, account and reference numbers masked, an amount band rather than the exact amount, whether it is a debit or credit, the account type, and the practice's category names. Counterparty names in a description can remain. Suggestions are only suggestions; the practice decides.

We do not sell financial data, use it for advertising, or use it to train our own or anyone else's machine-learning models.

Service providers

Lekhavo runs on these providers, each processing data only to provide its part of the service:

• Vercel hosts the website, application and API (Singapore region).
• Neon hosts the database (Singapore).
• Google Cloud stores uploaded files and runs the statement parser and scheduled jobs (Mumbai), and provides Google Sign-In.
• 2Factor (India) sends the SMS sign-in codes.
• Resend sends the email sign-in codes.
• Browser push services, run by your browser vendor (such as Google, Mozilla or Apple), deliver notifications you turn on.
• YouTube serves the videos embedded on some pages, when you play them.
• PostHog (EU) records product usage inside the application.
• Sentry (EU) receives error reports.
• TypeSafe produces category suggestions from the masked data described above.

Some of these providers store data outside India, as noted. We do not share data with anyone else except within a practice, as described below, or where the law requires it.

Sharing within a practice

A practice's owner can invite partners and staff, and can limit staff to particular clients. Everyone invited can see the clients and records their role allows. A practice can also give a client access to the client portal for that client's own records.

Security

All traffic between your browser and Lekhavo is encrypted with HTTPS. Sessions are held in cookies marked HttpOnly and Secure. Passwords supplied for protected bank statements (kept only until the statement is processed), and the PAN and GSTIN recorded for entities, are encrypted when stored. Access to the production systems is limited to the people who operate Lekhavo.

No system is perfectly secure, and we do not claim otherwise. If we become aware of a breach affecting your data, we will tell affected practices and users without undue delay.

How long we keep it

A practice's data is kept while the practice uses Lekhavo, because it is the practice's working record. When a practice asks us to delete its account, we delete its data, apart from billing records we must keep by law. Backups that contain it expire on their normal schedule.

Your account information is kept while you have access. Technical logs and error reports are kept for a short period for diagnosis and then discarded.

Your choices and rights

You can ask us to show you the personal information we hold about you, to correct it, or to delete it, by writing to info@lekhavo.com. We will respond within 30 days. You can revoke Lekhavo's access to your Google account at any time from your Google Account permissions page; that stops future sign-ins with Google.

Where the information is about a practice's client, the practice decides how it is used, and requests about it are best made to the practice. We act on the practice's instructions for that data and will help it respond.

Children

Lekhavo is a professional tool for accounting practices and their clients. It is not directed at anyone under 18, and we do not knowingly collect information from children.

Changes to this policy

If we change this policy we will update the date at the top of this page. Where a change materially affects how we handle your information, we will tell practices directly.

Contact

Questions about this policy or the data we hold about you: info@lekhavo.com.