This Privacy Policy explains how Accuhisabkitab Consultancy Private Limited (CIN U74999GJ2022PTC131723), registered office 401, Aastha Corporate Capital, Near VIP Plaza, Vesu, Surat, Gujarat, India ("hisabkitab", "we", "us") collects, uses, shares and protects personal data when you use the website hisabkitab.co, the web application app.hisabkitab.co and the hisabkitab mobile apps (together, the "Service").

We follow the Digital Personal Data Protection Act, 2023 ("DPDP Act"), the Digital Personal Data Protection Rules, 2025 and the Information Technology Act, 2000.

Last updated: 18 October 2026

SECTION 1 - OUR ROLE

1.1 Data Fiduciary. For personal data about you as our customer, visitor or user (your name, contact details, login and billing information), we decide how it is processed, and we are the Data Fiduciary.

1.2 Data Processor. Your business records may contain personal data of your own customers, suppliers or employees (for example names, phone numbers and GSTINs on invoices). We process that data only on your behalf and on your instructions, to provide the Service. For that data, your business is the Data Fiduciary and is responsible for having a lawful basis to collect it.

SECTION 2 - PERSONAL DATA WE COLLECT

Account and contact data: name, email address, mobile number, business name, designation, login credentials. Source: you, at sign-up and in your profile.

Business identity data: GSTIN, PAN, business address, drug licence number (pharma users). Source: you.

Billing data: billing name and address, plan, invoices, payment status. Source: you and our payment gateway.

Business records you enter or upload: invoices, ledgers, bank statements, purchase bills, stock records, and the personal data of your customers and suppliers they contain. Source: you and your Invited Users, or integrations you connect.

Usage and device data: IP address, browser, device type, operating system, pages and features used, log-in times, error logs. Source: collected automatically.

Cookies and similar technologies: see section 9. Source: collected automatically on the website.

Communications: support emails, chats, calls, WhatsApp messages and feedback. Source: you.

Mobile app permissions: device features such as the camera and photos, used only when you choose to scan or upload a document. Source: your device, with your permission.

We do not store full card numbers, CVV or net-banking credentials. Payments are processed by our payment gateway partner.

SECTION 3 - HOW WE USE PERSONAL DATA

Create and manage your account, and let you and your Invited Users log in (account and contact data).

Provide the Service: invoicing, GST and e-invoice workflows, e-way bills, OCR bill capture, reports and integrations (business identity data, business records).

Bill you, collect payments, and issue tax invoices and refunds (billing data).

Send service messages: renewal reminders, invoices, security alerts and changes to terms (account and contact data).

Provide support and answer your queries (account data, communications, usage data).

Keep the Service secure, prevent fraud and misuse, and fix errors (usage and device data).

Improve the Service using aggregated or de-identified usage data (usage data).

Send product news and offers, which you can opt out of at any time, see section 10 (account and contact data).

Comply with law, including tax and accounting record-keeping (billing data, account data).

We do not use the business records you enter (your invoices, ledgers or your customers' data) for advertising, and we do not sell personal data.

SECTION 4 - CONSENT AND HOW TO WITHDRAW IT

4.1 We process your personal data on the basis of your consent, given when you sign up and accept this Policy, or for legitimate uses allowed by the DPDP Act, such as complying with law.

4.2 You can withdraw consent at any time by writing to the Grievance Officer (section 13). Withdrawing consent does not affect processing already carried out. If you withdraw consent needed to run your account, we may not be able to keep providing the Service.

SECTION 5 - WHO WE SHARE PERSONAL DATA WITH

5.1 Service providers who help us run the Service, under contracts that require them to protect the data and use it only on our instructions. These include: cloud hosting (Amazon Web Services (AWS), India region); payment gateway partners that process subscription payments; email, SMS and WhatsApp messaging providers; OCR and AI processing providers that power bill capture and AI features; analytics and customer support tools.

5.2 Integrations you choose. When you connect a third-party service, such as Tally, Shopify, WooCommerce, Amazon, Flipkart, Meesho, a payment gateway or a WhatsApp service, we share the data needed for that integration. That service's own privacy policy applies to it.

5.3 Your Invited Users, such as your staff or chartered accountant, according to the access you give them.

5.4 Legal requirements. Government authorities, courts or regulators where the law requires it, or to protect our rights, our users or the public.

5.5 Business transfers. A buyer or successor if all or part of our business is sold or merged, on terms that keep this Policy's protections.

SECTION 6 - WHERE YOUR DATA IS STORED

Your data is stored on Amazon Web Services (AWS) servers located in India. If any service provider processes data outside India, we transfer it only as the DPDP Act and any government notification under it allow.

SECTION 7 - HOW WE PROTECT YOUR DATA

7.1 We use reasonable security safeguards, including encrypted connections (HTTPS), role-based access controls, access logging and regular backups.

7.2 Our staff and service providers can access personal data only where they need it to do their work, and are bound by confidentiality obligations.

7.3 Data breaches. If a personal data breach occurs, we will inform affected users without delay and report it to the Data Protection Board of India as the DPDP Act and Rules require.

7.4 No system is completely secure. Please keep your password confidential and tell us at once if you suspect unauthorised access.

SECTION 8 - HOW LONG WE KEEP DATA

Account and business records: while your account is active. After your plan expires, the data stays stored but is not accessible until you renew. It is deleted when you ask us to delete it, unless the law requires us to keep it.

Backups: deleted data may remain in backups for a limited period before it is overwritten.

Billing and tax invoices we issue to you: as long as Indian tax and company law requires.

Usage and security logs: at least 1 year, as the DPDP Rules require.

Marketing contact data: until you opt out or withdraw consent.

You remain responsible for keeping your own books of account for the period the law requires. Please export your records before your plan expires or before you ask us to delete your account.

SECTION 9 - COOKIES

9.1 Our website uses cookies and similar technologies to keep you signed in, remember preferences, measure traffic and improve our marketing.

9.2 We use analytics and advertising tools that may collect device and browsing information under their own privacy policies.

9.3 You can block or delete cookies in your browser settings. Some features may not work properly without essential cookies.

SECTION 10 - MARKETING MESSAGES

You can stop marketing emails by using the unsubscribe link in any email or writing to optout@hisabkitab.co, and stop marketing WhatsApp or SMS messages by replying STOP or contacting us. Service messages, such as invoices, renewal reminders and security alerts, will continue while you have an account.

SECTION 11 - YOUR RIGHTS

Under the DPDP Act you have the right to: get a summary of the personal data we hold about you and how we process it; correct, complete or update inaccurate or incomplete personal data; have your personal data erased when it is no longer needed, unless the law requires us to keep it; withdraw consent (section 4); nominate a person to exercise your rights if you die or become incapable; and have your grievances addressed (section 13).

To use these rights, write to the Grievance Officer. We will reply within 90 days at most, and aim to reply much sooner. For personal data inside your customers' business records, please contact that business directly, and we will help them respond.

SECTION 12 - CHILDREN

The Service is for businesses and is not meant for anyone under 18. We do not knowingly collect personal data of children. If you believe a child has given us personal data, contact us and we will delete it.

SECTION 13 - GRIEVANCE OFFICER AND CONTACT

If you have a question, request or complaint about your personal data, contact our Grievance Officer: Mr. Shrigopal Malani, Grievance Officer, Accuhisabkitab Consultancy Private Limited, 401, Aastha Corporate Capital, Near VIP Plaza, Vesu, Surat, Gujarat, India. Email: contact@hisabkitab.co. Phone: +91 72858 71111.

If you are not satisfied with our response, you can complain to the Data Protection Board of India.

SECTION 14 - THIRD-PARTY WEBSITES

The Service may link to websites and apps we do not control. Their privacy practices are their own, and we encourage you to read their policies.

SECTION 15 - CHANGES TO THIS POLICY

We may update this Policy. We will show the new "Last updated" date at the top and, for material changes, notify you by email or in the app before they take effect.