KevoBooks Privacy Policy

Effective date: 1 November 2026

1. Who we are

KevoBooks ("KevoBooks", "we", "us") is a sole proprietorship of Gauri Maheshwari, registered in India as an MSME under the name KEVO BOOKS, Udyam registration number UDYAM-RJ-01-0177210.

• Registered address: 600/3, Aashirwad Building, Shastri Nagar, Ajmer, Rajasthan 305001
• Email: admin@kevobooks.com

KevoBooks helps chartered accountant (CA) firms in India collect their clients' bills and other documents over WhatsApp, read and check them, and prepare draft accounting entries. The CA approves each entry before it goes into Tally.

This policy explains what personal data KevoBooks handles, why, where it is kept, who else is involved, and what you can ask us to do. It covers the website kevobooks.com, the KevoBooks web app (app.kevobooks.com), the KevoBooks WhatsApp number and the KevoBooks Tally connector.

2. Our role: who decides what happens to the data

• Data about a CA firm's clients. This means the client's documents, WhatsApp messages and contact numbers, and the Tally data the CA firm connects. The CA firm decides why and how this data is used. Under India's Digital Personal Data Protection Act, 2023 (the "DPDP Act"), the CA firm is the data fiduciary and KevoBooks is its data processor. We process this data only on the CA firm's behalf, on its instructions, to provide KevoBooks to that firm.
• Data about a CA firm's own users, and about people who contact us. This covers names, email addresses, sign-in details and messages to us. Here KevoBooks decides how the data is used and is the data fiduciary. The same applies to test and demo accounts (section 9).

If you are a client of a CA firm and have a question or request about your data, contact your CA firm. You can also write to us: we will pass it on to the firm and help it respond.

3. What data we handle

About CA firms and their staff (people who use the web app):

• name, email address and sign-in details (Google sign-in, or email and password)
• the firm's name and which users belong to it
• records of key actions, for example who approved an entry for Tally and when, and who corrected what KevoBooks read from a document

About a CA firm's clients and their contacts (entered by the CA firm or sent by the client):

• the client's business name and GSTIN, and the name and WhatsApp number of each contact the CA firm adds
• documents the client sends on WhatsApp, such as bills, invoices, receipts, bank statements and salary sheets, as photos, PDFs or spreadsheets. These can contain personal data of other people too, such as a supplier's or landlord's name, employees' names and salaries, or bank account details
• what KevoBooks reads from those documents (supplier, bill number, date, amounts, taxes, line items) and the results of its checks
• WhatsApp messages between the client and KevoBooks: text replies, answers to questions such as "What was it for?", and when each message arrived
• rules built from the client's answers (for example, "bills from this supplier are goods for resale"), used only for that client of that CA firm
• the monthly checklist of documents the CA firm expects, and which have arrived

From Tally, through the KevoBooks connector (only if the CA firm connects it): company names, ledger names and accounting entries that the CA asks KevoBooks to read, and Tally's replies when an approved entry is posted.

From people who contact us: if you email us or fill in a form on kevobooks.com, we receive what you send.

Messages from numbers that aren't connected: if someone who isn't a contact of a CA firm (or of a test account) messages the KevoBooks number, we reply that the number isn't connected and don't store the message.

4. How we use it

We use the data only to provide KevoBooks:

• to receive documents and messages on WhatsApp and confirm we got them
• to read documents with AI and check them with code (for example the GSTIN check digit, whether totals add up, the type of GST, and duplicates)
• to ask the client about missing or unclear items, and to send the monthly checklist and reminders when the CA firm has switched them on
• to prepare draft entries, show them to the CA and, only after the CA approves, post them to the CA firm's Tally
• to sign users in, keep each firm's data separate, keep the service secure, and fix problems
• to reply when you write to us

We don't:

• sell or rent personal data, or share it for advertising
• use client documents or messages to train AI models, our own or anyone else's. The rules KevoBooks keeps from a client's answers are used only for that client of that CA firm
• send marketing messages to a CA firm's clients
• post anything to Tally without the CA's approval

5. How KevoBooks uses AI

KevoBooks reads documents with Google's Gemini model on Google Cloud Vertex AI, in Google Cloud's Mumbai region (asia-south1). We send the model only what it needs for the task. Under Google Cloud's terms, Google doesn't use this data to train its models.

The AI reads; code checks what it read; a CA reviews every entry before it goes to Tally. AI can misread a document, which is why nothing is posted without the CA's approval.

6. Where the data is kept

In India. Our database, the document files, background processing and the AI reading all run on Google Cloud in Mumbai (asia-south1).

Outside that Mumbai setup:

• WhatsApp: messages and files pass through Meta's WhatsApp Business Platform on their way to and from us. Meta handles them under its own terms, may keep them for a limited time, and may do so outside India.
• Sign-in: CA firm users sign in with Google Firebase Authentication, which stores their name, email address and sign-in details, possibly outside India.
• The web app's pages are served through Google's global network (Firebase Hosting). The data the app shows comes from our servers in Mumbai.
• Email to admin@kevobooks.com is handled by Google Workspace.

Tally stays on the CA firm's PC. The KevoBooks connector runs on the PC where Tally runs and talks to Tally on that PC. It connects out to KevoBooks over an encrypted connection, so the firm's network needs no changes. It only does what the CA starts in the app, and it writes to Tally only after the CA approves. The CA can cut it off at any time with Disconnect in the app.

7. Who else handles the data

We use these service providers to run KevoBooks, and only for that:

• Google Cloud (Cloud Run, Cloud SQL, Cloud Storage, Cloud Tasks, Vertex AI): hosting, database, file storage and AI reading. Mumbai, India.
• Google Firebase (Authentication, Hosting): sign-in for CA firm users and serving the web app. Google's global infrastructure.
• Meta Platforms (WhatsApp Business Platform): sending and receiving WhatsApp messages. Meta's infrastructure.
• Google Workspace: our email. Google's infrastructure.

Inside KevoBooks, a client's data is visible only to the users of the CA firm that client belongs to, never to another firm.

We may disclose data when Indian law requires it, for example under a lawful order. Unless the law forbids it, we will tell the affected CA firm first.

KevoBooks is a sole proprietorship today. If the business moves to a company, the data and the commitments in this policy move with it, and we will tell CA firms in advance.

8. How long we keep it

• The CA firm decides. Data stays while the firm uses KevoBooks, until the firm deletes it.
• Deleting a client: a CA firm can delete a client in the app at any time. This removes everything KevoBooks holds for that client: documents and their files, messages, questions, rules, the checklist, contacts and posting records. Entries already posted to Tally stay in Tally; KevoBooks doesn't change Tally.
• Closing an account: if a CA firm asks us in writing to close its account, we delete its data within 30 days.
• Backups: deleted data is removed from our backups automatically within 10 days.
• Meta and Google keep their own records as their terms describe, for example WhatsApp messages on Meta's side.

9. Test and demo accounts

You may try KevoBooks with a test account, or by scanning a QR code at an event, using sample bills. Your name or email (for a test account) or your WhatsApp number (if you message us), plus anything you send, are stored in that test or demo account. They are used only to show you how KevoBooks works. We delete test and demo accounts, and their data, within 30 days. Please don't send real documents to a test or demo account.

10. Security

• Data is encrypted in transit (HTTPS) and at rest.
• Document files are kept in a private storage bucket with no public access.
• Only signed-in users can see data in the app, and each firm's data is kept separate in the database: users see only their own firm's data.
• Every message that reaches us from WhatsApp is checked for Meta's signature.
• The Tally connector uses a secret token that the CA can cancel at once by clicking Disconnect.
• Our logs record what happened (for example, that a document was read), not what the documents say.
• We record who approved each entry and who corrected a reading. Google Cloud keeps audit logs of administrative changes to our systems.
• Our team's access: a few KevoBooks team members can technically access our systems in order to run them. They look at a CA firm's data only when the firm asks them to (for example, to help with a problem) or when the law requires it, and then only as much as needed.

No system is perfectly secure. If a breach affects personal data, we will tell the affected CA firms without delay and help them meet their duties under the DPDP Act.

11. Your rights and choices

• CA firm users: write to admin@kevobooks.com to see, correct or delete your account data.
• Clients of a CA firm and their contacts: your CA firm controls your data in KevoBooks. To see, correct or delete it, or to stop the checklist messages, ask your CA firm. You can also write to us and we will pass it on and help.
• Under the DPDP Act you may also have the right to nominate someone to act for you, and to complain to the Data Protection Board of India if your complaint isn't resolved.

We reply as soon as we can, and within 30 days.

12. Children

KevoBooks is a tool for businesses and their accountants. It isn't meant for anyone under 18.

13. Changes to this policy

When we change this policy, we will post the new version here with a new effective date. If a change matters, we will email CA firms before it takes effect.

14. Contact and grievances

• Questions, requests and complaints: admin@kevobooks.com
• Grievance officer: Gauri Maheshwari, admin@kevobooks.com
• Post: KevoBooks, 600/3, Aashirwad Building, Shastri Nagar, Ajmer, Rajasthan 305001