In short
- The app is for the staff and partners of CA firms that use RoSync. It shows your firm's own data, from your firm's own system.
- Your firm's client data stays in your firm's own database and file storage. SoftSync Lab does not keep a copy.
- No location, contacts, camera, photo library, advertising or tracking. We never sell data.
- The app locks with your fingerprint, face or phone PIN, blocks screenshots, and notifications never show client names or amounts.
- To stop using the app, sign out (or ask your firm's partner to sign your phone out) and uninstall it. See deleting your app data.
1. Who we are
The app is made by SoftSync Lab, 3rd, 22nd & 23rd Cross Road, Sri Nandi Garments, T. Dasarahalli, Bengaluru, Karnataka 560057, India (GSTIN 29BWYPR4301Q1ZF). Contact: contact@softsyncsolutions.in.
Each CA firm runs its own copy of RoSync, with its own database and file storage. When you use the app you connect to your firm's RoSync and sign in with the account your firm gave you.
- Your CA firm decides what client and staff data it keeps and why. Under India's Digital Personal Data Protection Act, 2023, the firm is the Data Fiduciary for that data, and SoftSync Lab works on its behalf as a Data Processor.
- SoftSync Lab decides how the small amount of data needed to deliver notifications is handled (section 4), and is responsible for that.
2. What the app collects and why
| What | Details | Why, and where it is kept |
|---|---|---|
| Your sign-in | Email and password | Sent once to your firm's RoSync to sign you in. The password is never stored on the phone or by SoftSync Lab. |
| Session | Sign-in tokens | Kept on the phone in Android's encrypted storage so you stay signed in. Removed when you sign out. |
| Your firm | Your firm's web address and name | Kept on the phone so the app knows which firm to connect to. |
| This phone | A random phone ID made at sign-in, phone model (e.g. "Pixel 8"), app version, when the phone was last used | Stored in your firm's RoSync so you and your firm's partners can see which phones are signed in and sign a lost phone out. |
| Notifications | The phone's notification address (from Google Firebase Cloud Messaging) and which kinds of notification you switched on | Stored in your firm's RoSync to send you notifications. Deleted when the phone is signed out. |
| Your work | Actions you take - approving an invoice, accepting or sending back a document, marking a return filed, opening a sensitive file (with your reason), showing a full PAN | Recorded in your firm's RoSync activity record, as on the RoSync website, so the firm has a trail of who did what. |
| Documents you add | Pages you scan, photos or files you choose to upload | Sent straight to your firm's own file storage. RoSync sees only the pages, photos or files you choose. |
The app also shows your firm's data - clients, returns and due dates, documents, invoices - read from your firm's RoSync with the same access rules as the RoSync website. Full PAN numbers are hidden unless you tap "Show", which is recorded. Files open from a link that works for five minutes; the app does not save client files on the phone.
3. What the app does not collect
- No location, contacts, call logs, SMS, microphone or advertising ID.
- No camera or photo-library permission. Scanning uses Google's document scanner, which runs on your phone through Google Play services, and photos and files come through Android's own pickers - the app only receives the pages, photos or files you choose.
- No analytics, advertising or tracking tools, and no data is sold or shared for advertising.
- Your fingerprint, face or PIN never reach the app. Android checks them and only tells the app whether it was you.
4. Notifications
When something needs you - a client sent a document, an invoice needs your approval, a privacy request or a data breach - your firm's RoSync sends a notification through SoftSync Lab's notification service and Google Firebase Cloud Messaging, which delivers it to your phone. Notifications say only what to open (for example "New document from a client"); they never include client names, numbers or amounts.
SoftSync Lab's notification service passes the message on and keeps only a daily count of notifications per firm, to stop misuse. Google processes the phone's notification address and the message to deliver it, under Google's own terms. You can switch each kind of notification off in the app (More → Notifications), or turn notifications off for RoSync in the phone's settings.
5. Permissions the app asks for
- Notifications - to show the notifications in section 4. Optional; the app works without them.
- Fingerprint or face - to unlock the app. The app also requires a screen lock (fingerprint, face, PIN or pattern) on the phone, because it shows client data.
- Internet - to reach your firm's RoSync.
6. Where data is stored
Your firm's data, including the phone records and activity record in section 2, is stored in your firm's own RoSync database and file storage, which your firm chooses and pays for. On the phone, only the items marked "kept on the phone" in section 2 are stored, in Android's encrypted storage. The app is set not to be included in phone backups.
7. How long it is kept
- On the phone: until you sign out, switch to another firm or uninstall the app.
- Phone record and notification address: the notification address is deleted when the phone is signed out. The phone record (model, when it was last used, who signed it out) stays in your firm's security records, for the firm to see which phones had access.
- Activity record and documents: kept by your firm under its own retention rules. Tax and accounting records often must be kept for several years by law.
- Notification counts at SoftSync Lab: daily totals per firm only.
8. Security
- All connections use HTTPS.
- Sign-in goes through your firm's RoSync with your firm's rules, including limits on wrong-password attempts.
- The app locks when opened and after five minutes away, and won't run without a screen lock on the phone.
- Screenshots and screen recording are blocked, and the app's content is hidden in the recent-apps view.
- A partner can sign any phone out at once (lost phone, someone leaving the firm); removing a person from the firm signs out all their phones.
9. Your choices and rights
For data your firm keeps about you or its clients - including your account - contact your firm; it decides and acts on those requests. For the notification data SoftSync Lab handles, or any question about this app, write to us at contact@softsyncsolutions.in. You can ask to see, correct or delete your data, or withdraw consent, where the law allows. How to stop using the app and remove its data: deleting your app data.
10. Grievance officer
Rohith P M, SoftSync Lab - contact@softsyncsolutions.in, at the address in section 1. We acknowledge complaints within 7 days and aim to resolve them within 30 days.
11. Children
The app is for working professionals at CA firms and is not meant for anyone under 18.
12. Changes to this policy
If we change this policy, we will update this page and its effective date, and tell you in the app if the change matters.