Privacy Policy

(a) Data you provide directly:

• Mobile number utilized for secure WhatsApp-based login and session verification.
• Store name, registered brand name, owner identity, GSTIN, and business address entered during configuration.
• Customer and supplier names, phone numbers, and debit/credit ledger records entered in Bahi Khata.
• Product catalog items, custom SKU barcodes, wholesale/retail prices, and HSN/SAC tax codes.
• Tax invoices, counter receipts, inventory purchase orders, and transaction audit trails.
• Staff employee names, assigned system roles, and clock-in attendance records.

(b) Data collected automatically:

• Hardware device identifiers (device model, operating system version) solely for compatibility and crash diagnostics.
• Aggregated system events (sync queue timestamps, performance telemetry) in anonymized format.
• GPS Geolocation: Strictly opt-in. Location coordinates are captured only when you explicitly enable the employee attendance or field sales tracking features. Geolocation is never polled during standard billing or ledger accounting.

(c) Data we strictly do NOT collect:

• UPI PINs, internet banking passwords, credit/debit card numbers, CVVs, or OTP credentials.
• Personal phone call records, device SMS text contents, personal photos, or device address books.
• Biometric fingerprints or facial geometry (authentication is handled natively by your phone OS).

We process the commercial information you provide strictly for legitimate operational purposes:

• Powering local POS billing calculations, barcode scanning, and invoice printing.
• Synchronizing store transactions across your connected devices with end-to-end transport encryption.
• Generating formatted PDF receipts, ledger balance cards, and Excel tax reports.
• Dispatching password-less verification OTPs to verify your registered mobile number.
• Delivering technical customer support when you reach out to our Bengaluru helpdesk.
• Protecting systems against malicious intrusion, unauthorized scraping, and infrastructure abuse.

Geolocation recording is an optional, opt-in capability utilized exclusively for:

• Verifying that employee attendance clock-in occurred at your designated shop, counter, or warehouse GPS coordinates.
• Logging customer visit verification timestamps for field sales and order delivery personnel.

Data Handling & Merchant Duty: Geolocation coordinates are committed locally to your device first, then synchronized to your encrypted cloud database. The Company never accesses, analyzes, or shares individual staff coordinates with third parties. Merchants are legally required to notify employees and obtain valid consent prior to enabling GPS tracking under Indian labor and privacy regulations.

• WhatsApp (Meta Platforms, Inc.): Enables opening your device's WhatsApp application with pre-filled billing summaries and UPI deeplinks. We do not inspect your chats, contacts, or messaging history.
• NPCI UPI Protocols: Encodes standard UPI URI strings launching your customer's banking app. We do not participate in or inspect the banking payment channel.
• Cloudflare (Infrastructure Provider): Delivers enterprise edge security, DDoS mitigation, and encrypted cloud synchronization vaults. Data is encrypted in transit and at rest.

Third-party vendors, including Google, utilize cookies to serve contextual advertisements based on previous visits to msmevyapari.in and other internet sites:

• Advertising Cookies: Google's use of advertising cookies enables it and its partners to display non-intrusive ads to visitors based on browsing history across public web domains.
• Opting Out: Visitors may opt out of personalized advertising at any time by configuring Google Ad Settings or via aboutads.info.
• Functional Cookies: We utilize first-party session tokens solely to preserve language selections and measure core web performance vitals.

• All transmissions between client devices and cloud backup infrastructure are protected with TLS 1.3 encryption.
• Cloud database vaults are encrypted at rest using AES-256 standard encryption keys.
• Local device databases run in sandboxed application storage inaccessible to other apps installed on the merchant's phone.
• Strict tenant data isolation: every database query is partitioned by verified business identifier (`business_id`).

Under the DPDP Act 2023, you have the statutory right to access, correct, export, and erase your personal and business data:

• In-App Purge: You may permanently purge local application data from settings with immediate, irreversible effect.
• Cloud Erasure Request: Upon transmitting an erasure request to support@msmevyapari.in, our operations desk will purge all cloud backup vaults within thirty (30) business days.
• Export Portability: You may generate comprehensive offline JSON, Excel, or PDF archives of your ledger and inventory at any time prior to account closure.

MSME Vyapari is strictly an enterprise business bookkeeping and POS tool designed for commercial merchants. It is not intended for use by individuals under 18 years of age. We do not knowingly collect, retain, or process information belonging to minors.

We may periodically update this Privacy Policy to reflect regulatory revisions or software enhancements. Any material amendments will be communicated via in-app banner or registered email notification at least fifteen (15) days prior to taking effect.