Privacy Policy

1. Introduction

Effy Tech Venture Private Limited ("Effy Tech Venture", "Company", "we", "us", or "our") is a company incorporated under the Companies Act, 2013, having its registered office in Chennai, Tamil Nadu, India. We provide a Software-as-a-Service (SaaS) platform that enables business owners and their authorized personnel to manage bookkeeping, billing, invoicing, GST compliance reporting, inventory, and financial analytics (collectively, the "Service"). The Service may be delivered via our cloud infrastructure, deployed on a local server at our premises, or installed on servers at the User's own premises, depending on the deployment model agreed upon.

Regardless of the deployment model — cloud-hosted, on-premises at the User's site, or on servers at our own premises — this Privacy Policy applies in full to all Personal Data and Business Data processed through the Service.

We are committed to protecting the privacy and security of your personal and business data. This Privacy Policy describes what information we collect, the purposes for which it is used, how it is protected, and the rights available to you under applicable Indian law. By accessing or using the Service, you confirm that you have read, understood, and agreed to this Privacy Policy.

2. Definitions

"Personal Data"

Any information that identifies or can identify a natural person, as defined under the Digital Personal Data Protection Act, 2023 (DPDPA).

"Sensitive Personal Data or Information (SPDI)"

Financial information, passwords, and other categories specified under the IT (SPDI) Rules, 2011.

"Business Data"

Financial records, invoices, ledger entries, inventory details, GST-related data, and other commercial information that your business generates or uploads to the Service.

"Data Fiduciary"

Refers to Effy Tech Venture Private Limited, which determines the purpose and means of processing Personal Data.

"Data Principal"

Refers to the individual (User or their authorized representative) whose Personal Data is processed.

"User"

Any individual or entity that registers for and uses the Service, including business owners, accountants, and authorized employees.

3. Information We Collect

3.1 Account & Identity Information

• Full name, business name, and designation
• Email address and mobile number
• Username and encrypted password
• GST Identification Number (GSTIN), PAN, CIN, or other tax/regulatory identifiers
• Business address and registered office details

3.2 Financial & Business Data

• Invoices, bills, purchase orders, credit notes, and receipts
• Customer and vendor master data including names, addresses, and GSTIN
• Transaction records, journal entries, and ledger data
• Bank account details provided for reconciliation purposes only
• Inventory records, product/SKU data, stock levels, and valuations
• Profit & Loss statements, Balance Sheets, and other financial reports
• GST return data (GSTR-1, GSTR-3B, GSTR-9, and others as applicable)
• E-invoice and e-way bill data submitted via the platform

3.3 Technical & Usage Data

• IP address, device type, operating system, and browser type
• Log data including pages visited, features used, and timestamps
• Session cookies and authentication tokens
• Crash reports and diagnostic error logs

3.4 Communication Data

• Support tickets, emails, and live-chat messages sent to us
• Feedback, survey responses, and product reviews

3.5 Data We Do Not Collect

Effy Tech Venture does not intentionally collect biometric data, precise geo-location, or sensitive health information. We do not knowingly collect Personal Data from individuals under 18 years of age.

4. How We Collect Information

• Directly from you during registration, onboarding, and day-to-day use of the Service
• Through automated means such as cookies, server log files, and analytics tools
• Via integrations with third-party services you authorize (e.g., GSTN portal, NIC e-invoice system, banking APIs)
• From your team members or employees who access the Service under your account

5. Legal Basis for Processing

We process your data on the following legal grounds under the DPDPA and applicable Indian law:

• Consent: You have given explicit, informed consent during registration and through continued use of the Service.
• Contractual necessity: Processing is required to perform the services under our Terms of Service agreement with you.
• Legitimate interests: To maintain platform security, prevent fraud, improve features, and send relevant service communications.
• Legal obligation: To comply with applicable Indian statutes including the Central Goods and Services Tax Act, 2017; Income Tax Act, 1961; Companies Act, 2013; and the Digital Personal Data Protection Act, 2023.

6. How We Use Your Information

6.1 Service Delivery

• Operating and maintaining the accounting, billing, invoicing, and GST compliance platform
• Processing transactions and generating financial documents and reports
• Enabling GST e-filing, e-invoicing (IRN generation), e-way bill creation, and reconciliation features
• Powering inventory management and P&L / balance sheet analytics

6.2 Account Management & Security

• Creating and managing your user account
• User authentication, session management, and access control
• Detecting and preventing unauthorized access, fraud, or misuse
• Sending security alerts, OTPs, and password-reset communications

6.3 Service Improvement

• Analysing usage patterns to improve features and user experience
• Debugging technical issues and fixing platform defects
• Conducting internal research, analytics, and product development

6.4 Communication

• Sending product updates, feature announcements, and release notes
• Responding to support requests, queries, and grievances
• Sending statutory notices or legally required communications

6.5 Legal & Regulatory Compliance

• Complying with GST, income tax, and other applicable statutory requirements
• Responding to court orders, government directives, or legal proceedings
• Enforcing our Terms of Service and other agreements with Users

7. Sharing of Information

Effy Tech Venture does not sell, rent, or trade your Personal Data or Business Data to any third party. We may share data only in the following limited circumstances:

7.1 Service Providers & Sub-processors

We engage trusted third-party vendors who process data on our behalf under strict contractual obligations. These include cloud hosting providers, payment processors, email and SMS delivery services, and customer support tools. All sub-processors are bound by data processing agreements consistent with this Privacy Policy.

Our platform uses the following third-party integrations that may process your data as part of service delivery:

• Meta (Facebook/WhatsApp Business API): We use Meta's WhatsApp Business API (via the Facebook Graph API) to send order notifications and invoices to your customers' WhatsApp numbers, where you have enabled this feature. Data transmitted includes customer phone numbers, order summaries, and invoice details. This data is processed in accordance with Meta's Privacy Policy. We do not share your personal account data with Meta beyond what is necessary for message delivery. You may disable WhatsApp notifications at any time from your account settings.
• Brevo (email delivery): Used to send transactional emails such as order confirmations, OTPs, and invoices. Data transmitted includes recipient email addresses and message content.
• Cloudinary: Used to store and serve inventory item images. Image files uploaded by you are stored on Cloudinary's servers.

7.2 GST & Government Portals

Where you authorize us, we transmit relevant GST and invoice data to the GSTN portal, the National Informatics Centre (NIC) for e-invoicing, or state tax authorities solely for the purpose of statutory compliance on your behalf.

7.3 Legal Requirements

We may disclose data if required by law, court order, or a competent government or regulatory authority under applicable Indian law, including orders from the Income Tax Department, GST authorities, or CERT-In.

7.4 Business Transfers

In the event of a merger, acquisition, restructuring, or sale of business assets, your data may be transferred to the successor entity, with prior notice to you and subject to equivalent privacy protections.

7.5 With Your Consent

We may share data with third parties in any other circumstance where you have given prior explicit consent.

8. Data Storage, Retention & Localisation

Effy Tech Venture operates the Service under three deployment models, and data storage obligations apply to each as follows:

• Cloud Deployment: Data is stored on servers located within India managed by Effy Tech Venture or its authorised cloud infrastructure partners. We do not transfer Personal Data outside the territory of India without your explicit consent and appropriate contractual safeguards as required under the DPDPA.
• On-Premises at User's Site: The software and all associated data reside on servers owned and operated by the User at their own premises. In this model, the User is primarily responsible for the physical security and operational maintenance of the servers. Effy Tech Venture may access data remotely only for support, maintenance, or troubleshooting purposes with your prior authorisation.
• On-Premises at Effy Tech Venture's Premises: The software and data are hosted on servers located at Effy Tech Venture's own facility in Chennai. Access is strictly controlled, and data remains within India at all times.

Regardless of the deployment model, all data processed through the Service remains subject to this Privacy Policy, and Effy Tech Venture applies equivalent security standards across all environments.

We retain your data for as long as your account is active or as necessary to provide the Service, comply with legal obligations, resolve disputes, and enforce our agreements. Upon account termination, we will delete or anonymise your data within 90 days, except where a longer retention period is mandated by law. For example, GST-related records are retained for a minimum of 6 years as required under the Central Goods and Services Tax Act, 2017.

9. Data Security

Effy Tech Venture implements industry-standard technical and organisational security measures to protect your data:

• AES-256 encryption for data at rest
• TLS 1.2 or higher encryption for all data in transit
• Multi-factor authentication (MFA) options for User accounts
• Role-based access controls (RBAC) within the platform
• Regular security audits, vulnerability assessments, and penetration testing
• Strict access controls limiting employee access to data on a need-to-know basis
• Incident response procedures aligned with CERT-In Cyber Security Incident Reporting guidelines

While we take all commercially reasonable precautions, no information system is entirely immune to security risks. In the event of a personal data breach, we will notify affected Users and, once operational, the Data Protection Board of India within the timelines prescribed under the DPDPA.

10. Your Rights Under Indian Law

Under the Digital Personal Data Protection Act, 2023 and applicable IT Rules, you have the following rights as a Data Principal:

10.1 Right to Access Information

You may request a summary of the Personal Data we hold about you and how it is being processed.

10.2 Right to Correction & Completeness

You may request correction, completion, or updating of inaccurate or incomplete Personal Data.

10.3 Right to Erasure

You may request deletion of your Personal Data where it is no longer necessary for the purposes for which it was collected, subject to our statutory retention obligations under the CGST Act, Income Tax Act, and other applicable laws.

10.4 Right to Grievance Redressal

You may contact our Grievance Officer (see Section 15) to lodge a complaint. We will acknowledge your complaint promptly and endeavour to resolve it within 30 days.

10.5 Right to Nominate

Under the DPDPA, you may nominate an individual to exercise your rights on your behalf in the event of your death or incapacity.

10.6 Right to Withdraw Consent

You may withdraw consent to processing at any time by contacting us. Withdrawal of consent will not affect the lawfulness of processing carried out prior to withdrawal. Please note that withdrawal may affect your ability to use certain features of the Service.

To exercise any of the above rights, please write to us using the contact details in Section 15. We will respond within 30 days of receiving a verifiable request.

11. Cookies & Tracking Technologies

We use the following types of cookies and similar technologies on our platform:

• Essential cookies: Required for the platform to operate correctly, including session authentication and security tokens.
• Analytics cookies: Help us understand how Users interact with the platform so we can improve it. We use internal analytics tools and do not share this data with advertising networks.
• Preference cookies: Remember your settings, language preferences, and dashboard configurations.

You may manage or disable cookies through your browser settings. Disabling essential cookies will impair platform functionality. We do not use cookies for advertising, re-targeting, or cross-site behavioural profiling.

12. Third-Party Links & Integrations

The Service may contain links to third-party websites or integrate with external services such as the GSTN portal, NIC e-invoice system, banking APIs, payment gateways, and the Meta WhatsApp Business API. This Privacy Policy applies solely to data processed by Effy Tech Venture and does not extend to those third-party services. We encourage you to review the privacy policies of any third-party service before sharing your data with them.

Our use of the Meta WhatsApp Business API is subject to Meta's Privacy Policy and WhatsApp Terms of Service. Messages sent via WhatsApp are for transactional notifications only (order updates, invoices, OTPs). We do not use this channel for unsolicited marketing.

13. Children's Privacy

The Service is intended exclusively for business use by adults aged 18 years and above. We do not knowingly collect Personal Data from minors. If we become aware that we have inadvertently collected data from a person under 18, we will delete it promptly.

14. Changes to This Privacy Policy

We may update this Privacy Policy periodically to reflect changes in our practices, technology, or applicable law. We will notify you of material changes via email or a prominent in-platform notice at least 15 days before the revised Policy takes effect. Your continued use of the Service after the effective date of any revision constitutes acceptance of the updated Policy.

A version history of this Privacy Policy is maintained and is available to Users on request.

15. Grievance Officer & Contact Details

In accordance with the Information Technology Act, 2000, the IT (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021, and the Digital Personal Data Protection Act, 2023, the details of our designated Grievance Officer are as follows:

We are committed to resolving all complaints within 30 days of receipt. If you are dissatisfied with our response, you may escalate your grievance to the Data Protection Board of India (once constituted under the DPDPA) or seek relief from a court of competent jurisdiction.

16. Governing Law & Jurisdiction

This Privacy Policy shall be governed by and construed in accordance with the laws of the Republic of India. Any dispute, claim, or controversy arising out of or relating to this Privacy Policy shall be subject to the exclusive jurisdiction of the courts and tribunals located in Chennai, Tamil Nadu, India.