1. What we collect
If you sign in: your email address, your name when Google provides it, and how you signed in. Firebase Authentication, a Google service, holds these. If you use a workspace: workspace and billing records and sign-in sessions. If you use the invoicing tools without an account: nothing about you. The Free plan includes 3 members.
2. What stays in your browser
Your invoices, drafts, business profile, invoice numbering and theme live in your browser's storage on your device. We do not receive them. Clearing your browser data deletes them. Saving documents to your own Google Drive is planned and will ask for access to files this product creates, and no others.
3. Analytics
With your permission we use Google Analytics 4 to count visits and see which screens and shortcuts people use. Nothing is sent to Google until you accept analytics in the cookie banner, and withdrawing stops it. Events name an action such as creating or previewing an invoice, a document type, a theme or a shortcut. They never carry names, amounts, GSTINs or invoice contents. Google Consent Mode v2 starts every analytics and advertising signal as denied.
4. Proof of your cookie choice
When you answer the cookie banner we store your choice, the banner version and the time against a random identifier kept in your browser. We do not store your IP address or browser details, and the record is not linked to your account. We keep it as proof that you chose.
5. Services that handle data
Google provides Firebase Authentication for sign-in and, if you accept it, Google Analytics. Cloudflare hosts the service and its database. No other third party receives your data today.
6. Your choices
Change your cookie choice any time from Preferences. Write to support@virtualcfo.app to ask for your data or to delete your account.
3. CA directory
The CA directory republishes the ICAI List of Firms as on 01-Apr-2026. It holds names, membership numbers, firm registration numbers and office addresses as ICAI prints them, and nothing more about the people listed.
If you choose Use my location in the search box, your browser works out where you are and asks your permission first. The coordinates, rounded to two decimal places (about one kilometre), travel with that search so the firms can be sorted by distance. We do not store them or link them to you.
When you send a claim, hide or remove request, we store the name, email address and note you enter, a salted hash of your IP address, and the time. We use them to answer the request and to spot abuse.
Search keeps a count of the profiles each search token has seen, by token and hour, without your IP address. Rate limits count requests per IP address for up to an hour.
Directory pages with a map send your IP address to Google when the map loads. The search box and the request form load Cloudflare Turnstile, which sees browser signals to tell people from software.
To correct, hide or remove a profile, use the "Is this you?" links on it, or write to support@virtualcfo.app.