BillDesk Shop ("we", "us") respects your privacy. This Privacy Policy explains what personal data we collect, why we collect it, how we protect it and the choices you have. It is written in line with the Digital Personal Data Protection Act, 2023 and the Information Technology Act, 2000 and rules made under them.
1. Who this policy covers
- Account holders — business owners and staff users who sign up for or use BillDesk Shop.
- Visitors — people who browse our website or contact us.
- Your customers' data — when you (a shop or business) store information about your own customers, suppliers or staff in BillDesk Shop, you decide what is collected and why, and we process that data only on your instructions to provide the Service. You are responsible for informing those individuals and having a lawful basis to collect their data.
2. Information we collect
Information you give us
- Account details: name, business name, email address, mobile number, password (stored only in encrypted, hashed form), state and GSTIN.
- Billing details: the plan you choose, invoices and payment references. Card, UPI and bank credentials are entered directly with our payment partner; we do not store your full card number, CVV or UPI PIN.
- Support communication: messages you send through our contact form, email, phone or WhatsApp.
Business data you enter into the Service
- Products, prices, stock, invoices, payments, customer and supplier records, expenses and reports.
Information collected automatically
- Technical and security logs: IP address, browser type, date and time of sign-in, failed sign-in attempts and actions performed in the account (audit log).
- Cookies needed to run the Service: a session cookie to keep you signed in, a security token to protect forms, and — only if you choose "Remember me" — a cookie that keeps you signed in on that device. We do not use advertising or third-party tracking cookies in the application.
3. How we use your information
- To create and run your account, provide the features of your plan and keep your data in sync across your branches and devices.
- To process subscription payments, issue tax invoices and meet our legal and accounting obligations.
- To secure the Service: detect fraud, prevent unauthorised access, throttle repeated failed sign-ins and keep audit trails.
- To send service messages — account invitations, password resets, renewal reminders, payment confirmations and important changes. We do not send marketing messages without your consent, and you can opt out at any time.
- To provide support and improve the Service using aggregated, non-identifying usage information.
We do not sell or rent your personal data or your business data to anyone.
4. Sharing of information
We share data only where needed to run the Service, with:
- Payment gateway partners (for example Razorpay) to process subscription payments;
- Email, SMS and WhatsApp service providers to deliver messages you or we send;
- Hosting and infrastructure providers that store our servers and backups;
- Authorities, when required by law, court order or to protect rights and safety.
These partners may use the data only to provide their service to us and must protect it appropriately.
5. How we protect your data
- Each business account is isolated from every other account; access is checked on our servers for every request.
- Passwords are stored as one-way hashes; secret keys and credentials are encrypted at rest.
- Connections to the Service are encrypted using HTTPS.
- Staff access within your account is controlled by roles and branch permissions that you manage, and important actions are recorded in an audit log.
- We take regular backups and restrict access to production systems to authorised personnel.
No online service can be completely secure. If we become aware of a personal data breach affecting you, we will notify you and the relevant authorities as required by law.
6. How long we keep data
- Account and business data is kept while your account is active.
- After your subscription ends, your data remains available in read-only mode and can be exported for at least 90 days. After that, or when you request account closure, we delete or anonymise it, except where we must keep certain records (for example, tax invoices for our subscription charges) to comply with law.
- Security logs are kept for a limited period needed to protect the Service.
7. Your rights
Subject to applicable law, you can:
- access and receive a copy of your personal data (you can also export your business data at any time from Export my data);
- correct or update inaccurate information from your profile and settings;
- request deletion of your personal data and closure of your account;
- withdraw consent you have given (this does not affect processing already carried out);
- nominate another person to exercise your rights in case of death or incapacity;
- raise a grievance with us, and, if not resolved, with the Data Protection Board of India.
To exercise these rights, contact us at info@billdesk.shop. We will verify your identity before acting on the request.
8. Grievance officer
For any privacy concern or complaint, contact our Grievance Officer:
- Email: info@billdesk.shop
- Phone: +91 8360574612
- Address: JALANDHAR
We will acknowledge your complaint promptly and aim to resolve it within the time required by law.
9. Children
The Service is meant for businesses and is not directed at children under 18. We do not knowingly collect personal data of children.
10. Changes to this policy
We may update this Privacy Policy from time to time. For significant changes we will notify account owners by email or in the application.