Privacy notice

For account, billing and website data, we decide why and how the data is used (a data fiduciary under the DPDP Act, a controller under the PDPL).

For business records you enter into the Service — such as customer, supplier and employee details on invoices — your business decides how that data is used, and we process it on your behalf to provide the Service (a data processor).

• Account details: name, work email, password (stored only as an Argon2 hash), role and company.
• Company and tax profile: legal name, address, GSTIN or TRN, financial year and currency.
• Business records you add: invoices, bills, items, contacts and accounting entries.
• Billing details: plan, invoices and payment status.
• Technical and security data: IP address, browser, sign-in events and audit log entries.
• Messages you send us, including through the contact form.

• To provide, secure and support the Service.
• To verify your email, authenticate you and prevent abuse (for example, rate limiting).
• To bill for subscriptions and keep financial records required by law.
• To respond to your enquiries and send service-related notices.
• To improve the Service using aggregated, non-identifying information.

We process personal data to perform our contract with you, to comply with legal obligations, for legitimate uses permitted by law, and — where required — with your consent. Where we rely on consent, you can withdraw it at any time by contacting us; this does not affect processing already carried out.

We do not sell personal data. We share it only with:

• Service providers that host, email or process payments for us, under contractual safeguards.
• Authorities, where required by law.
• A successor, if our business is reorganised or transferred, subject to this notice.

Our support team accesses a customer workspace only through time-limited, read-only, audited access that the customer can see and revoke.

Data may be processed outside your country by us or our providers. Where we transfer data across borders we take steps intended to meet the requirements of the DPDP Act and the PDPL, including contractual protections.

We keep data for as long as your account is active and as needed to meet legal, tax and accounting obligations. If a subscription is suspended, workspace data is retained rather than deleted, so it is available if you return. You may ask us to delete data once retention obligations no longer apply.

We use safeguards including tenant isolation with database row-level security, role-based permissions, encrypted transport (HTTPS), hashed passwords and audit logs. See our security page. No system is perfectly secure; we will notify affected users and authorities of personal data breaches as required by law.

Subject to applicable law, you may ask to:

• access a summary of your personal data and how it is processed;
• correct, complete or update it;
• erase it, where we are not required to keep it;
• withdraw consent or object to certain processing;
• nominate another person to exercise your rights (DPDP Act);
• raise a grievance with us, and then with the relevant authority.

If your data was entered by a business that uses the Service, please contact that business first; we will assist them.

We use strictly necessary cookies, such as a secure, HTTP-only session cookie, to keep you signed in and to protect the Service. We do not use advertising cookies.

The Service is intended for businesses and is not directed at children.

We may update this notice. We will change the “Last updated” date and, for material changes, notify account holders.

For privacy questions, requests or grievances, email [email protected].