Privacy Policy

1Categories of Information We Collect

To provide cloud-based GST invoicing, purchase orders, client ledgers, and financial accounting services, we collect the following categories of information:

3Purposes of Processing & Internal Operations

We process data strictly under lawful bases specified by the Digital Personal Data Protection Act, 2023 (for contractual fulfillment, explicit consent, and legitimate internal uses), including:

• ERP Core Functionality: Generating GST tax invoices, proforma documents, purchase orders, calculating CGST/SGST/IGST breakdown, and maintaining customer balance ledgers.
• Subscription & Billing: Processing recurring subscriptions, issuing automated tax receipts, and managing workspace subscription tiers.
• Platform Security & Perimeter Defense: Authenticating users, enforcing role-based permissions, monitoring unusual login attempts, preventing DDoS attacks, and ensuring strict tenant data isolation.
• Internal Diagnostics & Telemetry: Analyzing system latency, query execution times, error rates, and server memory utilization to maintain 99.9% cloud uptime.
• Internal Feature Improvement & Tooling: Utilizing aggregated, anonymized, and de-identified telemetry patterns to optimize invoice generation algorithms, improve export speeds, and develop AI/ML productivity tools for business users.
• Customer Support: Providing technical assistance, troubleshooting workspace configurations, and delivering transactional email/SMS notifications.

5Data Security, Architecture & Storage Standards

We implement enterprise-grade technical and organizational measures to safeguard your information against unauthorized access, loss, or alteration:

• Encryption in Transit: All web traffic and API calls are secured using 256-bit TLS 1.3 / SSL encryption with strict HTTPS enforcement.
• Encryption at Rest: Database volumes and automated daily snapshots are encrypted using AES-256 bit encryption standards.
• Zero-Trust Multi-Tenant Isolation: Every database query is strictly filtered by the authenticated `companyId` workspace identifier, preventing cross-tenant data leaks.
• Credential Security: All user passwords are salt-hashed using bcrypt; plain-text passwords are never logged or stored.
• Automated Backups: Secure, geo-redundant database backups with point-in-time recovery capabilities.

6Third-Party Sub-processors & Service Providers

We engage carefully audited third-party service providers solely to perform essential infrastructure operations:

• Payment Processing: Razorpay Software Private Limited (PCI-DSS Level 1 compliant payment gateway).
• Email Delivery: Google Cloud Gmail SMTP / Transactional Mail relays for password resets, team invites, and subscription receipts.
• Cloud Hosting & Compute: Secure data center facilities with 24/7 physical security and power redundancy.

7Your Data Rights under the DPDP Act 2023

As a data principal under Indian data protection legislation, you possess the right to:

• Right to Access & Review: Inspect the personal data and corporate profile stored within your account at any time.
• Right to Correction & Updating: Edit or rectify inaccurate company profile data, GSTIN, addresses, or user profiles via Account Settings.
• Right to Data Portability: Export all invoices, customer master files, item inventories, and payment registers in structured Excel (.xlsx) or JSON formats.
• Right to Erasure / Deletion: Request the deletion of your account and personal records upon subscription cancellation, subject to statutory tax record retention obligations under Indian law.

8Data Retention Policy

We retain active workspace data for the duration of your active subscription. Under Indian Goods and Services Tax (GST) laws and the Companies Act 2013, businesses are required to maintain accounting books and invoice records for a statutory minimum period of 72 months (6 years). Consequently, financial tax invoices and audit trails may be archived in compliance with these statutory mandates before permanent purging.