Privacy policy

Charter AI is a software service for Indian Chartered Accountants (“CAs”, “you”) provided by Cove Labs Private Limited (“Cove Labs”, “we”). For the account data described below, Cove Labs is the data fiduciary under the Digital Personal Data Protection Act, 2023 (“DPDP Act”). For the data you upload or enter about your own clients, you are the data fiduciary and Cove Labs processes that data on your instruction. By creating an account you accept this policy, which forms part of the terms of service.

• Account data: name, email address, firm details, sign-in and device metadata, and the communications you send us.
• Client data: the client records, notices, documents, registers, statements, returns data and facts you upload or enter to use the service.
• Usage data: the questions you ask, the output produced for you, the pages and features you use, and technical logs needed to run, secure and improve the service.
• Payment data: plan, trial and billing status and transaction references. Card, bank and UPI details are handled by our payment provider and are not stored by us.

To provide the service you have asked for, including drafting, research, reconciliation and the other features you use; to run your account, billing and support; to keep the service secure and prevent abuse; to understand how the service is used and improve it; to send service, billing and product communications; and to meet our legal obligations.

Parts of the service are produced with the help of automated and AI systems operated by us and by our service providers. Data is shared with those systems to the extent needed to produce the output you request. We do not use your clients’ data to train models that serve other customers, and we do not sell personal data.

We share data with service providers who host, process, analyse or support the service on our behalf, including infrastructure, AI processing, email and payment providers, under contracts that limit their use of the data to providing that service. We may also disclose data where the law requires it, to protect our rights or the safety of others, or as part of a merger, acquisition or sale of assets. A list of our current categories of providers is available on request to the contact below.

We apply reasonable technical and organisational safeguards appropriate to the data we hold, including encryption in transit and at rest and access controls. No system is completely secure, and you are responsible for keeping your sign-in credentials confidential and for the devices you use.

Retention periods, as implemented in the service:

Uploaded documents, drafts and research

Kept for the life of your account.

Technical and processing logs

Up to 90 days, without the content of your documents or questions.

Payment and billing records

8 years, as required under Indian tax law. Card, bank and UPI details are not stored by us.

Deleted accounts

Account data and files are removed within 30 days of deletion; backups containing them clear within 35 days.

We may keep data longer where the law requires it, to resolve disputes or to enforce our agreements.

We use cookies and similar identifiers to keep you signed in, to remember your preferences and to measure how the website and the service are used, including the pages opened, features used and interactions with them, linked to a pseudonymous identifier. Analytics data may be processed by a service provider on our behalf. We do not use advertising cookies and we do not share analytics data with advertisers. You can limit cookies in your browser settings; some parts of the service may not work without them. We may share hashed identifiers, such as a one-way hash of your email address, with advertising platforms to measure and improve our campaigns.

Under the DPDP Act, you can:

• Access and correct your account details in Settings, Profile.
• Export a copy of the data we hold about your account from Settings, Profile, Export my data.
• Withdraw consent or request erasure. The service cannot run without your data, so either request ends the service. Request it from Settings. We first cancel any active subscription, then delete the account and its files, normally within 7 days and in any case within 30 days, and confirm by email. Amounts already paid are not refunded except under the refund policy. We may keep the minimum record needed to show the request was honoured, to prevent repeat free trials and to meet legal obligations.
• Raise a grievance with the Grievance Officer, Charter AI by writing to support@charterai.in. We respond within 7 working days.
• Complain to the Data Protection Board of India if a grievance is not resolved to your satisfaction.

Requests about your clients’ data from the individuals it concerns should be made to you as their data fiduciary; we assist you with them as described in the terms of service.

We may update this policy from time to time. The date at the top shows the current version. Where a change materially affects how we use your data we will tell you in the service or by email, and continued use after the change takes effect is acceptance of it.