Privacy Policy

Sapaa is used by Sengu and Paapu Associates and has two categories of users:

• Admins — register and manage the firm's account, create and manage employee accounts, create and manage client and case records, assign and review tasks, and oversee case updates.
• Employees — do not self-register. Accounts are created and managed by an Admin. Employees log in with credentials issued to them to view assigned tasks, submit reports, update task/case status, and use chat.

This policy also describes how information about Clients of the firm is handled, even though clients are not direct users of the app.

2.1  Employee information

• Profile image/photo
• Name
• Email address
• Phone number
• Department
• Role/designation

2.2  Client information

• Client name and company name
• Company/entity type
• Phone number and email address
• Address
• GST number and PAN

2.3  Case, task, and document information

• Case details, case groups, assigned employees, and case status
• Task creation, approval/rejection status, and updates
• Reports and status updates submitted by employees
• Documents attached during case creation, and files shared in chat

2.4  Chat and communication data

• Messages between Admins and Employees, one-on-one and in groups
• Automatically generated case-group chats and their membership
• Manually created groups and shared files/media

2.5  Account, login, and technical data

• Login credentials (stored encrypted/hashed), timestamps, and role-based access data
• Device information, app usage logs, crash and diagnostic data
• IP address and approximate location, for security purposes

• Create and manage Admin and Employee accounts
• Let Admins create, assign, approve, or reject tasks
• Let Admins create and update employee and client records
• Let Employees view tasks, submit reports, and update status
• Support case management, including auto-created case groups and attachments
• Facilitate chat between Admins and Employees, including file sharing
• Let Admins review employee updates and reports on cases
• Maintain client records, including GST/PAN, for billing and statutory compliance
• Secure accounts and prevent unauthorized access
• Maintain and improve the app

We do not use employee or client data for advertising, and we do not sell personal data to third parties.

• Admins can view employee profiles, task and case updates, employee reports, and all client records
• Employees can view their own profile and the tasks/cases/chats relevant to them
• Chat and case-group members can see messages and files shared within their specific chat or group
• Sapaa is used solely within Sengu and Paapu Associates — data is never shared with, or accessible by, any other organization

• Data is stored on secure servers with role-based access control
• Passwords are stored using industry-standard hashing/encryption
• Documents and chat files are stored in encrypted storage with restricted access
• No method of transmission or storage is completely secure, and we cannot guarantee absolute security

Employee and client data is retained for as long as needed for the firm's ongoing operations, or as required by law — including GST/PAN records for tax purposes. Case files, tasks, and chat records are retained to preserve case history, unless deletion is requested by an Admin and permitted under applicable law.

• Admins must obtain any necessary consent before entering an employee's personal data into Sapaa
• Employees must be informed their data is processed via Sapaa in line with this policy
• Admins must promptly update or remove employee data when an employee exits the firm

• Admins and Employees who input client data must have a lawful basis or consent to store it
• Client data must be kept accurate and up to date
• Client data must be used only for legitimate case and business purposes

We do not sell or rent personal data. We may share data only with:

• Service providers (e.g. cloud hosting) processing data on our behalf under confidentiality obligations
• Legal authorities, where required by law, court order, or regulation
• Successors, in the event of a merger, acquisition, or sale of business assets, subject to continued protection under this policy

Depending on applicable law, Employees and Clients (through their Admin) may have rights to:

• Access the personal data held about them
• Request correction of inaccurate data
• Request deletion, subject to legal record-keeping obligations
• Withdraw consent where processing is based on consent

Requests should be routed through an Admin, or directed to us using the contact details below.

Sapaa is intended for use by working professionals — advocates, employees, and admins — and is not directed at children under 18. We do not knowingly collect data from children.

We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. Material changes will be notified within the app, and the "Last updated" date above will be revised.

If you have questions or concerns about this Privacy Policy or how your data is handled, please contact: