Privacy Policy

1. Introduction

KhataFlow ("we", "our", or "us") operates the KhataFlow mobile application and website at khataflow.in. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our service. By using KhataFlow, you agree to the collection and use of information as described in this policy.

2. Information We Collect

Account information: Your mobile phone number for OTP-based authentication. We do not collect passwords.

Profile information: Your name and display name, which you provide during account setup or profile editing.

Business information: Shop name, address, and precise location (only if you grant permission during shop setup).

Transaction data: Ledger entries, customer records, sale amounts, payment records, and product catalog data that you create in the app.

Customer data (shopkeepers): If you are a shopkeeper, you may enter your customers' names and phone numbers to manage their accounts. You are responsible for ensuring you have the appropriate consent from your customers to store and use their information in KhataFlow.

Device information: Device type, operating system version, and app version for debugging and support purposes.

Push notification token: A device token used to deliver in-app push notifications (e.g. payment alerts). This is not used for marketing without your consent.

Usage data: Anonymised feature usage patterns to help us improve the product. This data cannot be linked back to you or your customers.

3. How We Use Your Information

• To provide, operate, and maintain the KhataFlow service
• To authenticate your identity via OTP and manage your account
• To sync your local data to our secure cloud servers
• To send SMS payment reminders to your customers on your behalf (Starter and Growth plans)
• To deliver push notifications for payment alerts and activity updates
• To respond to your support queries
• To detect and prevent fraud or misuse of the platform
• To improve and develop new features based on aggregated, anonymised usage data

4. Data Sharing and Disclosure

We do not sell, rent, or trade your personal or business data. We may share information only in the following limited circumstances:

Service providers: We use trusted third-party cloud services to store and sync your data securely. These providers process data only on our behalf and under strict data protection agreements.

SMS providers: For Starter and Growth plan users, customer phone numbers are shared with our SMS gateway solely to deliver payment reminders you initiate. By using this feature, you confirm you have obtained the necessary consent from your customers.

Error monitoring: We use Sentry to collect crash reports and error logs to improve app stability. This may include device type, OS version, and anonymised stack traces. Sentry does not receive your business or customer data.

Authentication and notifications: We use Firebase (Google) for OTP-based phone authentication and push notifications. Firebase may collect device identifiers as described in Google's Privacy Policy.

Legal requirements: We may disclose data if required by applicable Indian law or in response to valid requests from government authorities, courts, or law enforcement agencies in India.

5. Data Security

We implement strong security measures including AES-256 encryption for data at rest, TLS encryption for data in transit, strict access controls so only your account can see your data, and automatic encrypted backups. On your device, data is protected by your operating system's built-in security model (app sandboxing and device encryption when enabled). While we strive to protect your data, no system is 100% secure, and we cannot guarantee absolute security.

6. Data Retention

We retain your account and business data for as long as your account remains active. If you delete your account, we will delete your personal data within 30 days of the deletion request. Aggregated, anonymised usage statistics may be retained indefinitely as they cannot be linked to you.

7. Your Rights

You have the right to:

• Access the personal data we hold about you
• Request correction of inaccurate data
• Request deletion of your account and associated personal data
• Request a portable copy of the data we hold about you
• Withdraw consent for optional data processing (e.g. location access)
• Object to the use of your data for any purpose

To exercise any of these rights, contact us at khataflow.support@gmail.com or reach our Grievance Officer (see Section 11).

8. Children's Privacy

KhataFlow is not intended for use by persons under the age of 18. We do not knowingly collect personal information from minors. If you believe a minor has provided us with personal data, please contact us immediately and we will take steps to remove the information.

9. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of significant changes via in-app notification or email. The "Last updated" date at the top of this page reflects the most recent revision. Continued use of the app after changes are posted constitutes your acceptance of the revised policy.

10. Governing Law

This Privacy Policy is governed by the laws of India, including the Information Technology Act, 2000 and the rules made thereunder.

11. Grievance Officer

In accordance with the Information Technology Act, 2000 and the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021, we have appointed a Grievance Officer to address your concerns. You may contact the Grievance Officer for any privacy-related complaints or requests within 24 hours; we aim to resolve all complaints within 30 days.

12. Contact Us

For any other privacy-related questions: