Privacy Policy

CA Sorted
Operated by Nikiru Digital
Proprietor: Nikhil Sonawane

Effective Date: 11 September 2026
Last Updated: 11 September 2026

Nikiru Digital, operated by Nikhil Sonawane (“Nikiru Digital”, “we”, “us”, or “our”), operates CA Sorted, a software-as-a-service platform designed primarily for Chartered Accountants and professionals working with or under Chartered Accountants.

This Privacy Policy explains how we collect, use, store, disclose, and protect personal information when you use CA Sorted, our website, application, client portal, communications, and related services (collectively, the “Services”).

By using the Services, you acknowledge that you have read and understood this Privacy Policy.

1. Who We Are

CA Sorted is a software platform operated by:

Nikiru Digital

Proprietor: Nikhil Sonawane

Registered Business Address:

Plot No. 229, Room 18, Visawa CHS,
RSC Road No. 40, Gorai-2, Borivali West,
Mumbai, Maharashtra – 400091, India

Email: support@casorted.com

Phone: +91 81697 55428

CA Sorted provides tools that enable Chartered Accountants and their teams to manage clients, service requests, document requirements, document collection, recurring work, reminders, notifications, and related professional workflows.

2. The Different People Whose Information We Process

CA Sorted may process information relating to several categories of people.

2.1 CA Users

These are Chartered Accountants or professionals working with or under Chartered Accountants who use CA Sorted.

2.2 Clients

A CA User may create and manage client records within CA Sorted. These clients may be individuals, businesses, organisations, proprietors, or other entities.

2.3 Client Portal Visitors

A client may receive a temporary portal link from their CA to view a specific service request and upload or replace requested documents.

A client does not need to create a CA Sorted user account to use this portal.

2.4 Website Visitors

We may process limited information relating to people who visit the CA Sorted website, such as information voluntarily submitted through a contact or support interaction and basic technical information required to operate and secure the website.

3. Information We Collect

The information we collect depends on how you use CA Sorted.

3.1 Account Information

When a CA User is provisioned or uses the Services, we may process:

• Full name
• Email address
• Mobile phone number
• Login credentials and authentication-related information
• Account status
• Organisation or firm information associated with the account
• Legal acceptance records, including the version and time of acceptance of applicable Terms and Privacy Policy documents

Passwords are stored using password hashing mechanisms and are not stored by us as readable passwords.

4. Client Information Entered by CA Users

CA Users may enter information about their clients into CA Sorted, including:

• Client name
• Business or organisation name
• Email address
• Mobile phone number
• PAN
• GST information
• Notes entered by the CA User
• Client active/inactive status
• Information associated with professional service requests
• Other information that the CA User chooses to enter into the platform

The CA User is responsible for ensuring that they have an appropriate legal basis and authority to provide client information to CA Sorted for processing through the Services.

5. Documents and Professional Information

CA Users and their clients may upload documents through CA Sorted.

These documents may contain personal, financial, tax, business, accounting, identification, or other information depending on the nature of the professional service being performed.

Examples may include documents relating to:

• Income-tax filings
• GST
• Audits
• Bank accounts and statements
• Financial records
• Business records
• Tax records
• Identification information
• Other documents requested by a Chartered Accountant

We process these documents to provide the Services and according to the instructions and configuration of the CA User.

CA Sorted is a document-management and workflow platform. We do not independently determine the professional purpose for which a CA User collects a particular client document.

6. Service Request Information

When a CA User creates a service request, we may process information including:

• Client associated with the request
• Service selected
• Relevant period, financial year, month, quarter, or other period information
• Required documents
• Document submission status
• Request status
• Completion information
• Recurring service configuration
• Reminder information
• Activity and audit information
• Communications associated with the service request

This information allows CA Users to manage professional work and track document collection.

7. Portal and Magic-Link Information

CA Sorted provides a client portal that can be accessed through temporary capability-based links.

When a CA User generates a client portal link, CA Sorted may process:

• Service Request identifier
• Portal access token information
• Token expiry information
• Token status, including whether it has been revoked
• Portal session information
• Security-related information associated with portal access

The underlying portal token is generated as a high-entropy random value. The stored database representation is a cryptographic hash rather than the readable token itself.

Portal access is restricted to the relevant Service Request.

Portal visitors may be able to view requested service information and upload or replace requested documents according to the permissions associated with that portal session.

8. Communication Information

If communications are enabled by the CA User, CA Sorted may process contact information such as:

• Email addresses
• Mobile phone numbers
• WhatsApp numbers

We may use these details to send service-related communications such as:

• Service request notifications
• Document collection notifications
• Portal-link notifications
• Service completion notifications
• Reminders
• Other transactional communications initiated through the Services

The actual availability of a communication channel may depend on configuration and the relevant communication provider.

9. WhatsApp Communications

Where WhatsApp communication is enabled, CA Sorted may use WhatsApp infrastructure and service providers to transmit service-related messages.

These messages may contain information necessary to identify the relevant service request or provide the recipient with instructions or access information.

WhatsApp communications are subject to the terms, privacy practices, and technical systems of WhatsApp/Meta and any applicable service provider.

CA Sorted does not control how WhatsApp processes information once it is transmitted through WhatsApp’s infrastructure.

We do not use WhatsApp communications to send unrelated promotional messages unless separately permitted and appropriately configured.

10. Payment and Subscription Information

CA Sorted is designed to support paid subscriptions.

Where subscription or payment functionality is enabled, we may process information necessary to:

• Identify the subscription
• Maintain subscription status
• Record plan information
• Process billing-related information
• Maintain payment and transaction records
• Handle cancellations, refunds, disputes, or billing support

Where a third-party payment processor is used, payment card or banking credentials may be collected and processed directly by that payment provider rather than stored by CA Sorted.

We will not intentionally store complete payment-card numbers or card security codes when the payment provider is designed to process those details directly.

11. Technical and Security Information

When you use CA Sorted, certain technical information may be processed automatically for operation, security, troubleshooting, and abuse prevention.

This may include:

• IP address
• Browser type
• Device information
• Operating system
• User agent
• Session information
• Authentication events
• Login-related information
• Request and application logs
• Error information
• Security events
• Access timestamps
• Service request and portal access information
• Other operational metadata

Some audit records may contain information such as an IP address, user agent, actor identifier, Service Request identifier, and the nature of an action performed.

12. Cookies and Similar Technologies

CA Sorted may use cookies or similar technologies that are necessary to:

• Maintain authenticated sessions
• Maintain secure portal sessions
• Protect the application
• Remember necessary application state
• Support security features
• Operate the website and application

We currently do not use Google Analytics, Meta Pixel, Google Tag Manager, Hotjar, Microsoft Clarity, or similar analytics/tracking products for behavioural advertising or analytics.

If we introduce additional analytics, advertising, or non-essential tracking technologies in the future, this Privacy Policy and, where appropriate, our Cookie Policy will be updated.

13. How We Use Personal Information

We may use personal information to:

• Provide and operate CA Sorted.
• Create and manage CA User accounts.
• Provide client and service-request management functionality.
• Store, organise, retrieve, and manage documents.
• Provide the client portal.
• Generate and manage temporary portal access links.
• Send requested email and WhatsApp communications.
• Send reminders where enabled.
• Maintain service history, audit records, and activity information.
• Prevent fraud, abuse, unauthorised access, and security incidents.
• Diagnose technical problems and improve reliability.
• Manage subscriptions and billing.
• Respond to support requests.
• Communicate important service, security, legal, or administrative information.
• Comply with applicable law, legal process, or lawful governmental requests.
• Establish, exercise, or defend legal claims.
• Protect the rights, property, security, and integrity of CA Sorted, Nikiru Digital, our users, and other persons.
• Perform other purposes that are reasonably necessary to provide the Services.

We do not sell personal information to third parties.

14. How We Handle Client Data

A significant part of CA Sorted’s purpose is to allow a CA User to manage information belonging to or relating to their clients.

Where a CA User uploads, enters, or otherwise provides client information to CA Sorted for the purpose of performing professional services, the CA User generally determines why that client information is collected and how it should be used.

In such circumstances:

• The CA User is responsible for their relationship with the client.
• The CA User is responsible for obtaining any notices, permissions, consents, or other legal authority required for their processing activities.
• CA Sorted processes the information to provide the Services to the CA User.
• CA Sorted does not use client documents for unrelated advertising purposes.
• CA Users should not upload information that they are not authorised to provide to CA Sorted.

If you are a client of a CA User and have questions about why your information was collected or how your CA is using it, you should generally contact that CA directly.

You may also contact CA Sorted where your request concerns our own processing of your information.

15. Legal Bases and Lawful Processing

Depending on the applicable law and circumstances, we may process personal information because:

• It is necessary to provide a service requested by you or by the CA User using the Services.
• You have provided consent where consent is required.
• Processing is necessary to comply with a legal obligation.
• Processing is necessary for security, fraud prevention, dispute resolution, or protection of rights.
• Processing is necessary for legitimate operational purposes where legally permitted.
• Processing is necessary to perform or administer a contractual relationship.
• Another lawful basis applies under applicable data-protection law.

Where applicable law requires consent, we will seek consent in an appropriate manner.

Where applicable law gives you a right to withdraw consent, you may request withdrawal by contacting us. Withdrawal does not necessarily affect processing that was lawfully performed before withdrawal.

16. Data Sharing and Disclosure

We may share or provide access to personal information where reasonably necessary to operate the Services.

This may include:

16.1 Service Providers

We may use third-party providers for infrastructure and operational services such as:

• Hosting
• Database infrastructure
• Private file storage
• Email delivery
• WhatsApp or messaging delivery
• Payment processing
• Queue/background processing
• Security and infrastructure services
• Technical support or maintenance

These providers may process information on our behalf and are expected to use it only for the services they provide to us or as otherwise permitted by applicable law.

16.2 CA Users and Their Clients

Information entered by a CA User may be accessible to authorised users within the relevant CA organisation according to the application’s permissions and organisation boundaries.

Client portal users can access information associated with the specific Service Request for which they have been granted portal access.

16.3 Legal and Regulatory Authorities

We may disclose information where reasonably necessary to:

• Comply with applicable law
• Respond to lawful requests
• Comply with court orders or legal proceedings
• Investigate fraud or abuse
• Protect the safety, rights, or property of a person or organisation
• Protect the security and integrity of the Services

16.4 Business Transfers

If Nikiru Digital or CA Sorted is involved in a merger, acquisition, restructuring, sale of assets, financing, or similar transaction, information may be transferred as part of that transaction, subject to applicable law and appropriate safeguards.

17. International Processing

Depending on the infrastructure and third-party providers configured for CA Sorted, personal information may be processed or stored in India or in other countries.

For example, infrastructure, email, messaging, storage, payment, or other technology providers may operate data centres or systems outside India.

Where personal information is processed outside India, we will take reasonable steps required by applicable law and contractual arrangements to protect that information.

18. Document Storage and Security

CA Sorted is designed to treat uploaded documents as private application data.

Documents are not intended to be placed on a publicly accessible storage disk.

Where Amazon S3 storage is configured, uploaded objects are intended to remain private and may use server-side encryption as configured for the storage environment.

We also use security controls such as:

• Authentication
• Password hashing
• Authorisation checks
• Organisation-level data scoping
• Service Request-level portal authorisation
• Hashed portal access tokens
• Expiring and revocable portal access
• Rate limiting on relevant access paths
• Security headers
• Audit records
• Restricted application access
• Environment-based protection of infrastructure credentials

However, no internet-connected system can be guaranteed to be completely secure.

19. What We Do Not Promise

While we take reasonable security measures, CA Sorted does not represent or warrant that:

• The Services will be completely free from security vulnerabilities.
• Unauthorised third parties can never gain access to information.
• Every email or WhatsApp message will be delivered successfully.
• Every uploaded file will be free from malware or other harmful content.
• Data transmission or storage is protected by end-to-end encryption in every circumstance.

Users should maintain appropriate security practices, including protecting account credentials and portal links.

20. Portal Link Security

A client portal link functions as a temporary access credential.

Anyone who obtains an active portal link may potentially be able to access the associated portal within the permissions and validity of that link.

Accordingly:

• Portal links should not be forwarded to unauthorised persons.
• Users should treat portal links as confidential.
• CA Users should use the regeneration/revocation functionality when a link may have been compromised.
• Expired or revoked links cannot be relied upon for continued access.

CA Sorted may process portal access information for security, audit, and operational purposes.

21. Audit Records and Activity History

CA Sorted maintains certain audit and operational records to help provide accountability and security.

Depending on the action, these records may include:

• Actor information
• User identifier
• Administrator identifier where applicable
• Service Request information
• Document-related activity
• Portal activity
• Timestamps
• IP address
• User agent
• Action or event information

Audit records may be used to investigate security issues, maintain service history, support troubleshooting, resolve disputes, and protect the integrity of the platform.

22. Email and WhatsApp Delivery Information

When email or WhatsApp notifications are sent, operational records may contain information such as:

• Recipient email address
• Recipient phone number
• Service Request identifier
• Notification type
• Delivery attempt status
• Failure information
• Timestamp

A successful hand-off to a mail or messaging provider does not necessarily mean that the recipient actually received or read the message.

23. Data Retention

We retain personal information for as long as reasonably necessary for the purposes described in this Privacy Policy, including:

• Providing the Services
• Maintaining active accounts
• Maintaining service and transaction records
• Supporting customer service
• Maintaining security and audit records
• Resolving disputes
• Enforcing agreements
• Complying with legal, regulatory, accounting, or tax obligations
• Protecting our legitimate business interests

When information is no longer reasonably required, we may delete, anonymise, aggregate, or otherwise securely dispose of it, subject to applicable law and legitimate retention requirements.

Client information

For information relating to a CA User’s clients, retention may also depend on the CA User’s instructions, professional obligations, applicable legal requirements, and the status of the relevant service relationship.

Backups

Information may continue to exist for a limited period in backups or disaster-recovery systems after deletion from active systems. Such information will generally be removed or overwritten according to applicable backup and retention processes.

We do not currently promise a fixed number of days or years for all categories of data because retention requirements vary according to the type of information and the reason it is being retained.

24. Your Privacy Rights

Depending on applicable law and your relationship with CA Sorted, you may have rights concerning your personal information.

These may include rights to:

• Request information about processing of your personal information.
• Request access to personal information held about you.
• Request correction of inaccurate or incomplete information.
• Request deletion of information where applicable.
• Withdraw consent where processing is based on consent.
• Request information regarding how your data is processed or shared, where required by law.
• Raise a grievance or complaint.
• Exercise other rights provided by applicable data-protection law.

Some rights may be subject to legal limitations or exceptions.

If your information was provided to CA Sorted by a CA User as part of their professional relationship with you, certain requests may need to be addressed to that CA User because they determine the purpose for which that information is processed.

25. How to Make a Privacy Request

You may contact us regarding privacy or personal-data matters at:

Email: support@casorted.com

Phone: +91 81697 55428

Please provide enough information for us to understand and process your request.

For security reasons, we may need to verify your identity before fulfilling certain requests.

If your request relates to information that a CA User controls or has provided to CA Sorted, we may ask you to contact that CA User or may coordinate with the relevant CA User where appropriate.

We will handle valid requests within the period required by applicable law.

26. Grievances and Complaints

If you believe that your personal information has been handled improperly, you may contact us first so that we can investigate and attempt to resolve the matter.

Privacy and Grievance Contact

Nikhil Sonawane

Proprietor, Nikiru Digital

Plot No. 229, Room 18, Visawa CHS,
RSC Road No. 40, Gorai-2, Borivali West,
Mumbai, Maharashtra – 400091, India

Email: support@casorted.com

Phone: +91 81697 55428

Where applicable law provides a right to escalate a complaint to a competent data-protection authority or other regulatory body, you may exercise that right.

27. Children’s Privacy

CA Sorted is intended for professional use by Chartered Accountants and professionals working with or under Chartered Accountants.

The Services are not directed toward children.

We do not knowingly request or intentionally collect personal information from children for the purpose of providing the Services.

If you believe that a child has provided personal information to CA Sorted without appropriate authorisation, please contact us so that we can investigate and take appropriate action.

28. Third-Party Services and Links

CA Sorted may interact with or contain links to third-party services, websites, communication platforms, payment providers, or other external services.

Those third parties operate under their own terms and privacy policies.

This Privacy Policy applies to information processed by Nikiru Digital in connection with CA Sorted. It does not govern the privacy practices of third-party services that we do not control.

29. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect:

• Changes to CA Sorted
• Changes to our data-processing practices
• Changes to technology or infrastructure
• Changes to applicable law
• Changes to security practices
• New features or services

When we make material changes, we may provide notice through CA Sorted, email, or another appropriate method.

The Last Updated date at the beginning of this Privacy Policy indicates when it was most recently revised.

Where CA Sorted requires acceptance of a new Privacy Policy version, users may be required to accept the updated version before continuing to use relevant portions of the Services.

30. Data Security Incidents

If we become aware of a personal-data security incident affecting information processed by CA Sorted, we will assess the incident and take reasonable steps appropriate to the circumstances, including containment, investigation, remediation, and notifications where required by applicable law.

Where the information belongs to a CA User’s client and the CA User has relevant legal responsibilities, we may coordinate with the affected CA User as appropriate.

31. No Sale of Personal Information

Nikiru Digital does not sell personal information to third parties.

We do not provide client documents or client information to advertisers for the purpose of selling advertising profiles.

We may, however, disclose information to service providers and other parties where reasonably necessary to operate CA Sorted, provide requested Services, comply with law, protect rights and security, or otherwise as described in this Privacy Policy.

32. Data Minimisation

We aim to collect and process information that is reasonably necessary for the purposes for which CA Sorted is used.

CA Users should avoid uploading or entering personal information that is unrelated to the relevant professional service or that they are not authorised to process.

33. Professional Responsibility of CA Users

CA Sorted is a technology platform and does not replace the professional responsibilities of a Chartered Accountant or other professional using the Services.

CA Users remain responsible for:

• The accuracy of information they enter.
• The documents they request.
• Their legal authority to process client information.
• Their professional and statutory record-keeping obligations.
• Providing appropriate privacy notices to their clients where required.
• Obtaining appropriate consent or other lawful authority where required.
• Managing access to client information.
• Using portal links responsibly.
• Determining appropriate retention periods for their client records.

34. Contact Information

For questions about this Privacy Policy or CA Sorted’s handling of personal information:

Nikiru Digital

Proprietor: Nikhil Sonawane

Address:

Plot No. 229, Room 18, Visawa CHS,
RSC Road No. 40, Gorai-2, Borivali West,
Mumbai, Maharashtra – 400091, India

Email: support@casorted.com

Phone: +91 81697 55428

35. Governing Law

This Privacy Policy is intended to operate in accordance with applicable laws of India.

Subject to applicable law, matters relating to this Privacy Policy and the processing of personal information by Nikiru Digital shall be governed by the laws of India.