Prime Practice is built so that the data you are most responsible for — your clients’ records — never sits on our servers. This policy explains what that means in practice, what limited information we do hold, and what you can ask us to do with it.
Who this policy is from
Prime Practice is operated by [LEGAL ENTITY NAME] (“Prime Practice”, “we”, “us”), with its registered office at [REGISTERED ADDRESS], India. You can reach us any time at cashantanusaxena@gmail.com.
This policy covers primepractice.in, every firm workspace hosted under it, the client portal, and the setup wizard.
The part that matters most: where your data lives
Most practice-management software stores every firm’s client list on the vendor’s own servers. Prime Practice does not work that way.
When your firm sets up a workspace, you create a database in your own Google account (a Firebase project, which is Google’s hosted database service). Your clients’ names, PANs, GSTINs, documents, invoices, ledgers, tasks and chat messages are written into that database. It belongs to your firm. We hold no login to it and cannot read it.
Your client data is not ours to lose, sell, mine or hand over. If you stop using Prime Practice, the database stays with you — we do not have a copy to delete, because we never had one.
The practical consequence: for the personal data of your clients, your firm is the Data Fiduciary under the Digital Personal Data Protection Act, 2023. Prime Practice supplies the software that runs against your database; it is not a destination for that data.
What we do collect
We hold a deliberately small amount of information, and only about the firm — not about the firm’s clients.
| What | Why we need it |
|---|---|
| Firm name, workspace address, administrator email | To route primepractice.in/your-firm to the right workspace at login. |
| Subscription status and expiry date | To keep your workspace active and to show trial or renewal reminders. |
| Name, firm, email and phone submitted through the contact form | To reply to your enquiry and set your workspace up. |
| GSTIN and return period, when you use the GST filing-status checker | Passed to a government-data provider to fetch the filing status, then returned to your screen. We do not store the result. |
| Basic technical logs (IP address, browser, timestamps) | Security, abuse prevention and diagnosing faults. |
We do not run advertising trackers, we do not sell data to anyone, and we do not profile you.
Cookies and browser storage
Prime Practice uses browser storage rather than tracking cookies. Specifically:
- Session storage kept by Google Firebase Authentication, so you stay signed in.
- Local storage holding your last-used workspace address, your theme choice and similar preferences. You can clear these from your browser settings, or by using the × on the “welcome back” chip on the home page.
- A service worker cache so the app opens quickly and survives a weak connection.
None of this is shared with third parties or used to follow you across other websites.
Service providers we rely on
Running the product means a small number of vendors process data on our behalf or on yours:
| Provider | Role |
|---|---|
| Google (Firebase, Cloud Functions, Hosting) | Hosts the application, the authentication system and — inside your own Google account — your firm’s database. |
| Transactional email provider | Delivers workspace invitations, client-portal invitations and welcome emails. |
| Government-data provider for GST lookups | Returns public GST filing status for a GSTIN you ask about. |
| Payment gateway | Processes subscription payments. Card details go to the gateway, never to us — we see only whether a payment succeeded. |
We disclose information to anyone else only where the law compels it, and we will tell you unless we are legally barred from doing so.
How we protect what we hold
Traffic runs over HTTPS. Access to a workspace requires an email and password issued by your firm, and staff accounts are limited by the permissions the firm’s administrator grants them. Every significant action inside a workspace is written to an audit log that the administrator can read.
Passwords are handled by Google Firebase Authentication and are never visible to us. Credentials stored in the in-app password vault are encrypted behind a master PIN that only your firm sets — if that PIN is lost, we cannot recover the vault for you.
No system is perfect. If a breach ever affects data we hold, we will notify affected firms and the Data Protection Board as required under the DPDP Act, 2023.
Your rights
Under the Digital Personal Data Protection Act, 2023 you may ask us to:
- tell you what personal data of yours we hold and who we have shared it with;
- correct anything inaccurate, incomplete or out of date;
- erase data we no longer need for the purpose it was given;
- withdraw a consent you previously gave;
- nominate someone to exercise these rights if you die or become incapacitated.
Write to cashantanusaxena@gmail.com and we will respond within thirty days. For data held inside your firm’s own database, the request should go to the firm — we have no access to act on it.
How long we keep it
Directory and subscription records are kept for as long as your workspace exists and for one year afterwards, so a returning firm can be reconnected. Contact-form enquiries are kept for two years. Technical logs are kept for ninety days. Anything we are required to retain for tax or statutory reasons is kept for the period the law prescribes.
Children
Prime Practice is a tool for professional firms and is not directed at children. We do not knowingly process the personal data of anyone under 18. If you believe a child’s data has reached us, write to us and we will delete it.
Grievance officer
In accordance with the Digital Personal Data Protection Act, 2023 and the Information Technology Act, 2000, complaints may be addressed to:
[OFFICER NAME]
[LEGAL ENTITY NAME]
[REGISTERED ADDRESS]
Email: cashantanusaxena@gmail.com
We acknowledge every complaint within forty-eight hours and aim to resolve it within thirty days.
Changes to this policy
If we change how we handle data in a way that affects you, we will update the date at the top of this page and, for anything material, tell you inside the app or by email before it takes effect.