Privacy Policy

Last Updated: September 6, 2026  |  Effective Date: September 6, 2026

This Privacy Policy explains how Grahbook India ("Grahbook", "we", "our", or "us"), operated by Neha Agrawal as a Udyam-registered Micro Enterprise [CONFIRM BEFORE PUBLISHING: Udyam Registration Certificate verification pending (Application/Registration Reference: UDYAM-UP-16-0051356)], collects, uses, processes, stores, and protects information through our website at https://grahbook.com, our cloud dashboard, mobile applications, and associated services (collectively, the "Service").

This policy is formulated in compliance with the Information Technology Act, 2000, the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, and the Digital Personal Data Protection Act, 2023 (DPDPA).

1. Roles of Parties: Data Fiduciary vs. Data Processor

To maintain legal transparency under Indian data protection legislation, data processing across Grahbook is categorized into two roles:

• Grahbook as Data Fiduciary: When you register an account with us, purchase a subscription, contact customer support, or browse our website, Grahbook acts as the Data Fiduciary (Controller) for your business profile, login credentials, and account records.
• Grahbook as Data Processor: When you record customer ledgers (khata), issue invoices, log inventory, scan supplier bills, and dispatch transactional notifications via WhatsApp, you (the Merchant) are the Data Fiduciary regarding your customers' and suppliers' personal information. Grahbook acts solely as a technological Data Processor acting on your instructions.

2. Information We Collect

We collect only the information required to provide, secure, and operate the billing platform:

a) Merchant Account & Identity Information

• Full name of business owner or representative
• Store or trade name, business category, and operational city/state
• Mobile telephone number and email address
• Optional business GSTIN and business address (for printing compliant tax invoices)
• Login credentials: Passwords are cryptographically salted and hashed using standard bcrypt algorithms before database storage. We never store passwords in plaintext.

b) Business, Khata & Transaction Data (Processed on Your Behalf)

• Customer and supplier names, phone numbers, and optional delivery addresses input by the Merchant
• Invoice numbers, itemized line items, quantities, HSN codes, rates, discounts, and GST breakdowns
• Payment receipt records, transaction modes (Cash, UPI, Cheque, Bank Transfer), and outstanding dues
• Supplier invoice images or PDF documents uploaded for stock inwarding and inventory reconciliation

c) Information We Do NOT Collect

d) Automatically Collected Technical & Usage Data

• Device information (operating system version, browser family, screen resolution)
• Internet Protocol (IP) address and approximate regional location
• Error logs, performance telemetry, and system diagnostic records
• Session authentication tokens stored via HTTP-only secure cookies (see Section 8)

3. Payments & Financial Transactions Disclaimer

To prevent ambiguity regarding monetary handling:

• Platform Subscriptions: Payments for Grahbook software plans (e.g., Vyapaar Pro) are handled by third-party payment gateways (PayU Payments Private Limited). Grahbook receives confirmation tokens, transaction IDs, and payment statuses. Grahbook does not store credit/debit card numbers, expiry dates, or CVV codes.
• Merchant-to-Customer Billing: Grahbook is NOT a payment aggregator, bank, or payment system operator under the Payment and Settlement Systems Act, 2007. Grahbook does not hold customer funds in escrow.
• Dynamic UPI QR Codes: UPI QR codes generated on invoices encode the Merchant's own Virtual Payment Address (VPA). Payments transfer directly between the customer's bank/UPI app and the Merchant's bank account.
• Sensitive Credentials: Grahbook will never ask for or store bank account passwords, netbanking credentials, ATM PINs, or UPI MPINs.

4. WhatsApp & Messaging Services

Grahbook integrates automated features allowing Merchants to deliver digital bills, payment receipts, and balance reminders to their customers via WhatsApp:

• Message Processing: When an invoice or reminder is dispatched, notification text and PDF bill links are transmitted through automated multi-device messaging infrastructure. Recipient phone numbers and delivery statuses are processed solely to facilitate and confirm dispatch.
• Platform Independence: WhatsApp is a registered trademark of Meta Platforms, Inc. Grahbook is an independent software provider. Grahbook is not affiliated with, sponsored by, or endorsed by Meta Platforms, Inc., nor does it claim to be an official WhatsApp Business API solution.
• Immediate Disconnection on Deletion: Upon initiating account or store deletion, all active WhatsApp socket sessions are disconnected immediately, and stored multi-device authentication credentials are deleted from the database without delay.
• Anti-Spam & Lawful Basis: Merchants are strictly prohibited from utilizing Grahbook to send unsolicited marketing spam or unauthorized communications. Merchants warrant that each recipient maintains an active commercial relationship with their store and has consented to receive transactional billing messages.

5. Artificial Intelligence (AI) Features & Smart OCR

Grahbook utilizes multimodal machine learning and vision AI (such as Google Gemini and OpenRouter API endpoints) to assist Merchants with automated invoice parsing and operational queries:

• Prompt Data Minimization: Grahbook enforces strict data minimization. Bulk customer personal records, debtor rosters, complete inventory listings, and raw customer phone numbers are never bundled into AI system prompts. External AI models receive only minimal store context (store name, owner name, language) and function definitions. Sensitive queries (e.g., debtor lookups or balances) are executed on-demand via server-side database tool calls only when specifically requested by the user.
• Smart OCR Bill Digitization: Uploaded supplier invoice photos or documents are transmitted to AI vision endpoints strictly in real-time for text extraction, HSN detection, and itemization.
• Model Training Notice: While Grahbook transmits data strictly for transient inference, external model training policies depend on upstream API terms. [CONFIRM BEFORE PUBLISHING: Confirm provider API enterprise agreements ensure prompt data and uploaded invoice media are excluded from model training]
• Assisted Technology Notice: OCR and automated parsing are assistive algorithms. Print flaws, handwriting, or image angles may cause extraction variances. Merchants are solely responsible for reviewing and verifying all extracted figures, HSN codes, and tax amounts before committing them to statutory accounting books.

6. How We Use Your Information

We process information exclusively for legitimate business and operational purposes:

• To provide, operate, and maintain billing, inventory, POS, and accounting features
• To authenticate accounts and deliver login verification codes (Email / WhatsApp OTP)
• To generate invoices, compute GST schedules, and create financial daybook reports
• To provide technical customer support and troubleshoot platform errors
• To protect against security intrusions, fraud, and abusive automated activity
• To comply with statutory legal mandates under applicable Indian laws

7. Third-Party Service Providers

We do not sell personal information to data brokers or third-party advertisers. Data is shared only with verified infrastructure vendors necessary to operate our service:

8. Cookies & Local Storage

Grahbook uses standard browser cookies and local storage mechanisms strictly for operational functionality:

• Authentication Cookie (gh_token): An HTTP-only, secure session cookie used to authenticate logged-in merchants and prevent unauthorized session tampering.
• Local Storage: Used to persist theme preferences (dark/light mode), interface language, and temporary offline invoice drafts.
• Analytics Telemetry: Aggregated interaction events collected via PostHog with session recording explicitly turned off. We do not use third-party advertising tracking networks.

9. Data Security & Storage Practices

In compliance with Rule 5(8) of the IT SPDI Rules, we implement reasonable technical and organizational safeguards designed to protect personal information:

• Encryption in Transit: All communication between client browsers, mobile devices, and server endpoints is encrypted via Transport Layer Security (TLS 1.2+).
• Field-Level Data Encryption: Sensitive customer fields stored in our database can be protected using per-store derived encryption keys via AES-256-GCM.
• Credential Protection: Passwords are encrypted with individual cryptographic salts and one-way hashes via bcrypt.
• Encrypted Store Backups: Merchants have access to generate AES-256 encrypted, checksum-verified digital backup archives of their entire store ledger.

Notice: While we implement reasonable technical measures, no system connected to the internet can be guaranteed 100% impenetrable. We disclaim absolute or infallible security guarantees.

10. Data Retention, Account Deletion & Statutory Export Mandate

We retain information only as long as necessary to provide the service and fulfill Indian statutory obligations:

• Active Subscriptions: Merchant profile and operational data are retained while your account remains active.
• 30-Day Deletion Grace Period: When a verified store owner requests account deletion with password re-authentication:
  • The account enters a 30-day grace period (pending_deletion).
  • Operational store access is immediately suspended (HTTP 423) and all active user sessions are revoked.
  • All active WhatsApp messaging socket connections are immediately disconnected, and stored session credentials are deleted.
  • During this 30-day window, the store owner may cancel the deletion request by providing verified owner credentials and password.
• Automated Cascade Purge: Upon expiration of the 30-day grace period, an automated background worker permanently and irreversibly purges all tenant-owned data across all 40+ operational database collections (including bills, transactions, ledger records, customer catalogs, inventory, staff accounts, OCR records, and analytics).
• Merchant Statutory Tax Export Mandate: Under Section 36 of the Central Goods and Services Tax (CGST) Act, 2017 and applicable Indian tax regulations, every registered business is legally obligated to maintain true and correct accounts and tax invoices for a minimum of 72 months (6 years). Grahbook provides full self-service data export tools (JSON, Excel, CSV, and PDF). The statutory obligation to retain books of accounts belongs solely to the Merchant. Merchants must complete their data export prior to initiating account deletion.
• Platform Audit Telemetry & Backups: Minimal audit records of the deletion event (store ID, hashed owner identifier, deletion timestamps, reason) and subscription transaction histories (for payment reconciliation and statutory tax compliance) are retained in compliance with applicable law. Residual data in offsite encrypted disaster recovery backups is overwritten as backups cycle and roll over per storage lifecycle policies.

11. Your Rights Under DPDPA 2023

Subject to applicable provisions of the Digital Personal Data Protection Act, 2023 and the IT Act, 2000, account holders have the following rights regarding personal data for which Grahbook is the Data Fiduciary:

• Right to Access: Request a summary of the personal data we hold about your account.
• Right to Correction: Request correction of inaccurate or incomplete profile details.
• Right to Erasure: Request deletion of your personal account information, subject to statutory retention mandates.
• Right to Grievance Redressal: Lodge a complaint with our Grievance Officer regarding data handling practices.

12. Children's Privacy

Grahbook is a commercial billing and business management platform intended exclusively for adult proprietors, business operators, and authorized staff (aged 18 years and above). We do not knowingly solicit or collect data from individuals under 18. If a minor has provided us with personal information, please inform our Grievance Officer immediately.

13. Grievance Officer & Contact Information

In accordance with Rule 5(9) of the IT SPDI Rules and the Digital Personal Data Protection Act, 2023, our designated Grievance Officer is:

14. Changes to This Policy

We may amend this Privacy Policy periodically to reflect technological changes, product updates, or statutory requirements. When revisions occur, the updated date at the top of this document will be modified. Continued use of Grahbook after changes become effective constitutes acceptance of the revised Policy.