Privacy Policy

Personal Information

• Name and business name (Dukaan ka naam)
• Phone number (for WhatsApp communication)
• Business address (optional)
• Email address (optional)

Business Data

• Customer names and contact numbers
• Product/inventory information
• Transaction and billing records
• Payment and udaari (credit) information

Usage Data

• WhatsApp message interactions
• Feature usage patterns
• Device information

• To provide billing and inventory management services
• To send automated payment reminders to your customers
• To generate invoices and reports
• To improve our AI and service quality
• To provide customer support
• To send important service updates

• Connections to KhataBhai use HTTPS
• Sensitive details such as WhatsApp access keys, payment gateway keys, bank account details, PAN numbers and ad account sign-in tokens are stored encrypted with AES-256
• Your data is stored with established cloud providers: MongoDB Atlas (database), DigitalOcean (servers and file storage) and Vercel (website). Some of these servers may be outside India
• Login uses a one-time code sent on WhatsApp. The code expires in 10 minutes and stops working after 3 wrong tries
• Staff see only what their role allows, and important account changes are recorded in an activity log
• Backups we make of your data are encrypted with AES-256

We DO NOT share your data with:

• Advertisers or marketing companies
• Third-party data brokers
• Any unauthorized parties

We may share data with:

• Service providers who help us operate (with strict confidentiality agreements)
• Legal authorities when required by law
• Payment processors for transaction completion
• The providers we use today: Meta (WhatsApp Cloud API), Google (Gemini AI and email), Groq and Sarvam AI (reading voice notes, photos and chat messages), the payment gateway you connect (PhonePe, Cashfree, Razorpay or PayU), Ola Maps (addresses and maps), and MongoDB Atlas, DigitalOcean and Vercel (hosting)

• Access: Request a copy of your data anytime
• Correction: Update or correct your information
• Deletion: Request deletion of your account and data
• Export: Download your data in a portable format
• Opt-out: Unsubscribe from promotional communications

• We access WhatsApp messages only to provide our services
• Voice messages are processed for billing but not stored permanently
• To read a voice note, photo or chat message, its content is sent to an AI provider (Google Gemini, Groq or Sarvam AI) only to process that request
• Photos shared for inventory are stored securely
• We follow the WhatsApp Business Platform policies

What we access

• When you connect Google Ads or Facebook in Marketing → Ads, you sign in with Google or Facebook and choose what KhataBhai may access
• From Google we request one permission: access to manage your Google Ads account (Google Ads API)
• We read your ad accounts, campaigns and their results (spend, clicks, impressions, conversions), and create or change only the campaigns you ask for in KhataBhai

How we use and store it

• We use this access only to run the ads you create in KhataBhai and to show you their results and our marketing fee
• Your Google and Facebook sign-in tokens are encrypted, kept only on our servers, and never shown in the browser
• For sales tracking we send Google only the ad click ID, order value, currency, time and order number. We never send your customers' names, phone numbers or email addresses
• You can disconnect at any time in Marketing → Ads. We then revoke access and delete the token; your past ad results stay in your account
• We keep the token only while the account is connected. Ad results stay in your KhataBhai account until you delete it, and are then removed within 30 days, as in Data Retention below

Google API Services User Data Policy

• KhataBhai's use and transfer of information received from Google APIs follows the Google API Services User Data Policy, including the Limited Use requirements
• We do not sell Google user data, use it for advertising to anyone else, or use it to train AI models
• Only you and the staff you allow (Owner and Manager roles) can manage your ads
• We do not share or transfer Google user data to anyone. It is stored and processed only on our hosting providers (DigitalOcean servers and the MongoDB Atlas database) to run KhataBhai for you

• Our website uses essential cookies for functionality
• We measure website visits with Vercel Analytics
• You can disable cookies in your browser settings
• KhataBhai's marketing pages use the Meta Pixel to measure our own ads. It does not load in the admin panel or on online stores
• A business's online store may load that business's own Google tag, if the business turns on Google ad sales tracking

• Our service is intended for business use by adults
• We do not knowingly collect data from children under 18
• If you believe a child has provided us data, please contact us

• Active account data is retained while you use our service
• After account deletion, data is removed within 30 days
• Some data may be retained for legal compliance
• Backup data is automatically purged after 90 days

• We may update this policy from time to time
• Significant changes will be notified via WhatsApp or email
• Continued use of service implies acceptance of updated policy
• Previous versions are available upon request