Draft — this page has not yet been reviewed by a lawyer and may change.

Privacy policy

Ivoric Billing is run by [company name], [registered address] ("we"). This policy explains what personal data we handle when you use our website and app, and your rights under Indian law, including the Digital Personal Data Protection Act, 2023 and the Information Technology Act, 2000.

Two kinds of data

Your account: your name, mobile number, email (if you give one), the businesses you belong to and your role. We decide how this is used, as described here.
Your business records: the customers, suppliers, items, bills and payments you enter. You decide what goes in and why; we store and process these records only to provide the service to you.

What we collect

Account details you give us when you sign up and sign in (a one-time code is sent to your mobile number, or you sign in with a password or with Google).
Business records you or your staff enter, import or photograph.
Technical data: IP address, device and browser type, sign-in times and an activity log of changes made in your books (kept so you can see who changed what).
If you sign in with Google: the name, e-mail address and account identifier Google shares with your permission. We never see your Google password.
A record of each version of our terms you accepted: the date and time, how you signed in, and one-way hashes of your IP address and browser.
Payments to us: the plan, amount, UPI reference or payment-gateway reference. We do not see or store card or bank passwords.
On our website: one first-party cookie noting how you first found us (for example a search engine or a campaign name) for 90 days. We do not use third-party advertising or analytics trackers.
If you ask us to call you back: your name, number and message.

How we use it

To run the app for you: sign-in, your books, documents, reports and backups.
To bill you for your plan and send you GST invoices.
To support you when you ask, and to keep the service secure (fraud and abuse prevention, rate limits, audit logs).
To improve the product using counts of activity, never by reading your customers' details.
To send service messages (for example a plan reminder). Marketing messages only with your consent, and you can stop them at any time.

Who we share it with

People you invite into your business (staff, your CA or a partner) — with the access you choose.
Service providers that help us run the service: hosting, email, SMS/WhatsApp messages, payment processing and — only if you switch AI features on — AI model providers, who receive only what a feature needs (for example a bill photo you ask the app to read). Each processes data only on our instructions.
Our support team looks inside your business only when the owner allows it, view-only and for a limited time, and every page they open is recorded in your activity log.
Authorities when the law requires it.
We do not sell personal data.

Where and how long

Data is stored on our hosting provider's servers and in encrypted backups. We keep your account and business records while your account is active. Tax law requires businesses to keep accounts for several years, so you can export everything at any time — even after a plan ends. When you ask us to close your account, we stop using your data and delete or anonymise it, keeping only what the law requires us to keep (such as our own invoices to you) for as long as it requires; backups expire on their normal cycle.

Your rights

See, correct or update your account details from the app, or by writing to us.
Withdraw consent you have given (for example for marketing messages or AI features).
Ask us to erase your personal data, subject to what the law requires us to keep.
Nominate someone to exercise your rights if you cannot.
Raise a grievance with our Grievance Officer (below); if you are not satisfied, you may approach the Data Protection Board of India.

Security

Sign-in by one-time code or password with limits on attempts, signed-in devices you can sign out, separation of each business's data, encrypted connections, secrets kept outside the web folder, and a statutory audit log that cannot be edited.

Children

The service is for businesses and is not meant for anyone under 18.

Changes

If we change this policy in a way that matters, we will tell you in the app before it takes effect.

Grievance Officer

[grievance officer] — [support email]. Write to us at [support email]. We acknowledge grievances within 48 hours and aim to resolve them within 15 days.