Privacy Policy

1. Information we collect

We collect the following types of information:

• Account information — your name, email address, mobile number and password when you register.
• Sign in with Google — if you choose to sign in with Google, Google sends us your name, your email address and an ID for your Google account. We never receive your Google password. You can still set a KhataZone password later.
• Business & financial data — the information you enter into the platform, such as company details, GSTIN, customers, suppliers, items, invoices, payments and inventory records.
• Payment information — when you subscribe to a paid plan, payments are processed by our third-party payment gateways. We do not store your card details or the bank details you pay with on our servers.
• Partner KYC — if you apply to be a KhataZone partner, we collect your PAN, Aadhaar number, address and, once approved, your bank account details, a cancelled cheque, a photograph and copies of your PAN and Aadhaar cards (and your GST certificate if you give a GSTIN). We use them to verify who you are, to pay you (a referral partner's commission, or a reseller's refund) and to deduct and report tax at source (TDS). Your Aadhaar number and your bank account number are stored encrypted, and the documents on private storage that only you and our verification team can open. See Partners below.
• How you found us — when you register you can tell us how you heard about KhataZone (for example a search engine, a friend or the Play Store). This is optional. We also note whether you signed up in our Android app or on the website.
• Usage & device data — log data such as IP address, browser type, pages visited and timestamps, and whether a request came from our Android app or the website, used to operate and secure the service. Inside the signed-in application we also record which screens are opened — as screen patterns with document numbers and links removed, never the contents — and errors your browser hits, so we can see what is used and fix what breaks. This stays with us; it is not sent to any analytics company.

2. The KhataZone Android app

Our Android app on Google Play opens the same KhataZone service you use at khatazone.com, full-screen, through Google Chrome on your phone. It is the same account, the same data and this same policy. The app is published on Google Play by Sars Infotech Private Limited for Khata Zone.

• The app does not read your contacts, photos, location, microphone or SMS. Apart from the notification details below, it only sends us what you type in or choose to upload — for example your logo or signature.
• The app uses your phone's camera only while you have the barcode scanner open, to read a barcode on the phone itself. The camera picture is never sent to us and never stored.
• Notifications — when you open the app, Google Firebase Cloud Messaging issues a notification token for your phone. While you are signed in to the app, we store that token with your phone's model name (for example “Google Pixel 7”) and the app version, whether or not notifications are currently allowed for the app on your phone, so that they start working as soon as you allow them. We use them to send you the notifications you chose — customer payments due, plan and billing, GST filing reminders and low stock — which you can switch off one by one in Settings → Notifications, and to keep your account safe: to list your phones in Settings and to email you when a new one is connected. We send those notifications to every connected phone even when notifications are switched off for the app on that phone (the phone then does not show them); to stop them reaching a phone, switch them off or remove the phone in Settings → Notifications. That page also lists every phone that gets your notifications, with a button to remove any of them, and we email you whenever a new phone is connected. A notification can show a customer's name, an amount or an item name, so it can appear on your phone's lock screen. Notifications are delivered by Google Firebase Cloud Messaging, which processes the token and the notification on our behalf as our service provider. We delete the token, model name and app version when you sign out of the app on that phone, change or reset your password, remove the phone in Settings or ask us to delete your account. A phone whose sign-in has expired stops getting notifications at once, and its token is deleted within a day. Anything still left is erased with the rest of your data when a deleted account is purged.
• The app does not sell plans and takes no payments, so no payment details are entered in it.
• When you install the app from a link, Google Play tells the app that link's campaign tags (for example, which partner or campaign shared it) the first time you open it. We store them with your sign-up, the same way we store the campaign tags on a link you followed to our website.
• Because the app runs in Chrome, Chrome's own handling of data is covered by Google's privacy policy.
• You can delete your account from inside the app — see Deleting your account below.

3. How we use your information

• To provide, operate and maintain the platform and its features.
• To process subscriptions and payments.
• To communicate with you about your account, updates and support requests.
• To secure the platform, prevent fraud and comply with legal obligations.
• To improve our products and services.

4. Your data belongs to you

The business and financial data you enter remains your property. We access it only to operate the service, provide support at your request, or where required by law. We do not sell your personal or business data to third parties.

5. Sharing & disclosure

We may share information only with:

• Service providers (e.g. hosting, payment gateways, email delivery) who process data on our behalf under confidentiality obligations.
• GSTIN lookup — when you use “Fetch details” on a customer's, supplier's or your own GSTIN, we send that GSTIN and nothing else to our GSTIN lookup provider (gstinapi.in), which returns the business's public GST registration details — legal name, trade name, address and state. No information about you, your business or your customers goes with it.
• Analytics — our public website pages use Google Analytics to count visits and understand which pages are useful. It records things like the pages you viewed, your approximate location, and your browser and device type. It runs on our marketing pages and sign-in and sign-up screens only (including the sign-in screen you see when you open the Android app) — never inside the application itself once you are signed in, and never on the invoice and quotation links your suppliers send you.
• Phone notifications — the Android app's notifications are delivered by Google Firebase Cloud Messaging, acting as our service provider: we send it your phone's notification token and the notification itself (its title and text, which can name a customer, an amount or an item), and it processes them on our behalf only to deliver the notification to your phone. This happens for every phone connected to your account, even one where notifications are switched off for the app. See Notifications above.
• Legal authorities where required by applicable law, regulation or valid legal process.

6. Partners and partner listings

If you are an approved KhataZone reseller partner, you may choose to have a public page in our partner directory at khatazone.com/experts. This is entirely optional and off by default.

• What is published — your business name, the name you registered with, your city and state, and the description and services you write yourself. Your phone number and email address are published only if you switch each one on individually.
• What is never published — your street address, PAN, Aadhaar, GSTIN, bank details, wallet balance, margin rate, earnings and commission, your clients, and the KYC documents you upload to us.
• What a partner sees about the businesses they referred — if you signed up with a partner's link or code, that partner sees your business name, when you signed up, whether you have finished setting up and when you issued your first bill. A referral partner also sees whether you have paid for a plan and, for each payment you make to us, its date, the price of the plan before GST and before any discount, and the commission they earn on it. A reseller partner also sees your current plan, whether it is a trial, and when it ends or renews. They never see your invoices, customers, items or any other figures in your books.
• Self-referral checks — a partner may not earn commission on their own business. To check, we compare a referred business's PAN and GSTIN, bank account, mobile numbers and email addresses with the referring partner's PAN, payout bank account, phone and email, and check whether the partner's own login works in the business's books. A match puts the commission on hold for our team to review; we keep a note of what matched (with at most the last 4 digits of any number) for that review. The partner is told only that the commission is under review, never what matched.
• Payout and tax records — for each commission and each payout to a partner we keep the amounts, dates, bank reference and the tax deducted, because tax law requires us to. These are kept for that legal purpose even after a partnership ends or a referred business deletes its account (the business is then no longer named in them).
• Consent and withdrawal — your page goes live only after you consent and we approve it. You can withdraw that consent at any time from your partner portal, and your page comes down immediately. Withdrawing is a single switch and needs no request to us.
• Search engines — these pages are public and indexable by design; that is their purpose. Once a page has been live, search engines and other services may retain a cached copy for some time after you take it down. We cannot control or remove third-party caches.

7. Data security

We use industry-standard measures — including encrypted connections (HTTPS), access controls and secure hosting — to protect your data. No method of transmission or storage is 100% secure, but we work to safeguard your information against unauthorised access, alteration or disclosure.

8. Data retention

We keep your data for as long as your account is active and as needed to provide the service. When you delete your account, your business data is erased 30 days after your request, as described below.

What we keep after that is our own records of our business with you: the tax invoices we issued to you for any KhataZone subscription (which carry the billing name, address and GSTIN) and the record of each payment you made to us (amount, date and payment reference). If a referral partner brought your business to us, their commission records for your payments (amounts and dates) are kept too, without your business name. For partners, we keep commission, payout and TDS records for as long as tax law requires. Indian GST and income-tax law require us to keep our own accounts for a number of years, so we keep these for that legal purpose only. Our encrypted database backups are overwritten on a rolling cycle, so deleted data can remain in them for a short time (about 30 days) until it rolls off; backups are used only to recover the service after a failure.

9. Deleting your account

The company owner can delete the account at any time — in the Android app or on the website, under Settings → Security & account → Delete my account — or by emailing support@khatazone.com from the registered email address. Full steps are on our account deletion page.

• Straight away — sign-in is turned off, every device is signed out, every phone stops getting notifications (their notification tokens are deleted), any automatic renewal payment is cancelled, recurring invoice schedules are paused, and we email you a confirmation.
• For 30 days — nothing is erased. Email support@khatazone.com from your registered email address within 30 days of your request and we restore your account with all its data.
• After 30 days — your account, company profile and all business records (customers, suppliers, items, invoices and other documents, payments, ledgers and uploaded files) are permanently deleted, apart from the records described in Data retention above.

Please export your invoices first (Sales → Export, Purchases → Export): the law expects your business to keep its own GST records, and deleting your KhataZone account removes our copy.

10. Cookies

We use cookies and similar technologies to keep you signed in, remember preferences and understand usage. You can control cookies through your browser settings, though some features may not function without them.

11. Your rights

You may access, update or export your data from within the application, and delete your account yourself as described in Deleting your account. You can also request correction or deletion of your personal information by contacting us. We will respond to reasonable requests in accordance with applicable law.

12. Children

The service is intended for businesses and is not directed to individuals under the age of 18.

13. Changes to this policy

We may update this Privacy Policy from time to time. Material changes will be posted on this page with an updated “Last updated” date. Continued use of the service after changes constitutes acceptance of the revised policy.

14. Contact us

For any privacy questions or requests, contact us at support@khatazone.com.