Privacy policy

Last updated: 2026-10-01

This policy explains what personal data KanakkuPaar handles, why, and your rights under India's Digital Personal Data Protection Act, 2023 (DPDP Act).

1. Who is responsible

• For shop owners' account data, inaivu IT decides how it is used.
• For data a shop enters about its own customers (names and phone numbers in the credit book or on bills), the shop decides why it is collected; we process it only to provide the service to that shop.

2. What we collect

• Shop owner: name, email, password (stored only as a secure hash), language preference, sign-in times and two-step sign-in settings for administrators.
• Shop: name, phone, address, UPI ID, products, prices, stock, bills, cash drawer entries, service balance and recharges.
• Shop's customers (optional): name, phone number, amounts bought on credit and payments.
• Technical: IP address and time of sign-in attempts (to block password guessing), and error logs without personal data.

We do not collect card or bank account details. UPI payments go directly between the customer and the shop.

3. Why we use it

• To provide billing, stock, credit book and reports to the shop; to charge and verify service fees; to secure accounts; to meet legal obligations.
• We do not sell personal data or use it for advertising.

4. Where it is stored

• Database: Neon (PostgreSQL). Application: Google Cloud Run. Archives and backups: Google Cloud Storage. We choose Indian or nearby Asian regions where available.
• Data is encrypted in transit (HTTPS) and at rest by these providers. Access is limited to the shop's own login and a small number of authorised administrators using two-step sign-in.

5. How long we keep it

• Business records (bills, ledgers) are kept while the shop uses the service and for up to 8 years after, as business record-keeping laws may require; older bill details are moved to secure archive storage.
• Sign-in attempt records: 2 days. Security and audit logs: as long as the related records.
• When a shop closes its account, we delete or anonymise personal data that is not needed for legal record-keeping.

6. Your rights

• Shop owners can download all their shop's data (Shop settings → Download my data) and ask us to correct or delete their data.
• A shop's customer can ask the shop to delete their name and phone number. The shop can do this in the credit book (Delete personal data) once nothing is due; the amounts stay as the shop's business records without identifying the person.
• You can withdraw consent or raise a grievance with our Grievance Officer: [Name of Grievance Officer — to be filled in], grievance@inaivuit.com. You may also approach the Data Protection Board of India.

7. Cookies

We use only essential cookies: one to keep you signed in and one to remember your language. No advertising or tracking cookies.

8. Changes

If this policy changes materially we will ask you to review and accept it again in the app.