Privacy Policy

1. Who we are

ERPisy is billing, inventory, accounts and GST software for shops and retail chains in India, owned and operated by Kifayti Retail Private Limited ("Kifayti", "we", "us"), Krishna Nagar, Bagodar, Jharkhand 825322 (CIN U01100JH2021PTC017551). This Policy covers erpisy.com, the ERPisy web app, the ERPisy apps for Android and iPhone, and ERPisy's APIs, and forms part of our Terms of Service.

2. Whose data, and who decides

• Your account (the owner and the people a business adds): Kifayti decides why and how it is used, and is the Data Fiduciary under the Digital Personal Data Protection Act, 2023 ("DPDP Act").
• Your business's records, including the personal details of its customers, suppliers and employees: the business decides, and is the Data Fiduciary; Kifayti processes them on the business's behalf as its Data Processor. If you are a customer of a shop that uses ERPisy, please contact that shop first about your data; we will help it respond.

3. What we collect

From you, about your account

• Name, email, mobile number, and your password (stored only as a one-way hash), and two-factor settings if you turn them on.
• When you agreed to these terms, and which version.
• Your role and permissions in each business you belong to.

About your business

• Business profile: legal and trade name, GSTIN, PAN, addresses, outlets, logo, bank and UPI details you add for invoices and payments.
• Your plan, licence invoices and payments to us (through our payment partner; we never see or store full card or bank credentials).

The records you keep in ERPisy

• Products, prices, stock, bills, invoices, credit notes, purchases, expenses, payments, ledgers and GST data.
• Your customers', suppliers' and employees' details as you enter them: names, mobile numbers, emails, addresses, GSTINs, amounts owed and paid.
• Files you upload to the company drive.

WhatsApp

• For each WhatsApp message sent for your business: the recipient's number and name, the message text, the bill or customer it is about, and its delivery status (sent, delivered, read, failed).
• If you connect your own WhatsApp Business account: its ids, phone number, display name and quality rating, and the access token Meta grants us for it, stored encrypted.

Automatically

• Sign-in sessions, IP address, device and browser type, app version, and logs of requests and errors, kept for security, troubleshooting and audit.
• An audit trail of changes made in your business (who changed what, and when).

When you contact us

• What you send us, to answer you.

4. How we use it

• To provide ERPisy: sign you in, run the till, post bills, keep stock and books, prepare GST data, and send the messages and emails you ask for.
• To send service emails: verification, password reset, security alerts, licence and billing notices.
• To keep ERPisy and your data secure, prevent fraud and abuse, and keep the audit trail.
• To support you, fix problems and improve ERPisy, using aggregated or de-identified information where we can.
• To bill for paid plans and meet our legal, tax and accounting obligations.

We do not use your data for advertising, and we do not sell or rent it.

5. Legal basis

We process personal data on the consent you give at sign-up (section 6 of the DPDP Act), to perform our contract with your business, for the legitimate uses the DPDP Act allows (such as meeting legal obligations and responding to emergencies), and on your business's instructions for the records it keeps in ERPisy. You may withdraw consent at any time (section 12); doing so does not affect processing before it, and some of ERPisy may then stop working for you.

6. WhatsApp messages

• A business using ERPisy can send its customers a receipt for a bill and reminders of what they owe, on WhatsApp. These are transactional messages from approved templates, sent only to a customer whose mobile number the business recorded.
• By default they go from ERPisy's own WhatsApp Business number and name the shop; a business may connect its own WhatsApp Business number instead.
• Messages are delivered by WhatsApp, a service of Meta Platforms, which processes them under WhatsApp's business terms and privacy policy, possibly outside India.
• We do not store replies sent to ERPisy's number, and we do not use message content for anything but showing the business what it sent and whether it arrived.
• If you receive these messages and want them to stop, ask the shop, which can switch them off for you, or write to us (section 17) and we will stop them.

7. Service providers and sharing

We share data only with providers who help us run ERPisy, under contracts that require them to protect it and use it only for us:

We also disclose data when the law, a court or a government authority requires it, after checking the request is lawful and sharing only what it requires; when you or your business ask us to (for example, to your accountant); or to a successor if Kifayti's business is reorganised or sold, under this Policy's protections.

8. Where data is stored

ERPisy's servers, database and files are in India, in Google Cloud's Mumbai region; the database's automatic backups are kept by Google Cloud within Asia. WhatsApp messages are carried by Meta, and service emails by Google, which may process them outside India. We do not otherwise transfer your data out of India.

9. How long we keep it

• While a business uses ERPisy, its data is kept so the business can use it.
• Indian law requires businesses to keep their books of account and the documents behind them for years (eight years under the Companies Act, 2013, with comparable periods under the CGST Act, 2017 and the Income-tax Act). When a business closes its account, its data is kept, unused, for eight years from closing, and then deleted. A business may ask for earlier deletion in writing (see Data deletion).
• When a person's account is deleted and they belong to no other business, their name, email and phone are removed; the business's records that mention them are kept as above.
• Security and request logs are kept for a limited time, then deleted. Backups age out on their own schedule.

10. How we protect it

• Encryption in transit (HTTPS) and at rest; WhatsApp access tokens and other secrets are additionally encrypted.
• Each business's data is kept apart by the database itself (row-level security), not only by the app.
• Passwords are stored only as strong one-way hashes; two-factor sign-in is available; repeated wrong passwords lock the account for a while.
• Every User has only the permissions their business gives them, and changes are recorded in an audit trail.
• Our staff access customer data only when needed to support or secure the Service, and such access is recorded.
• Daily automatic backups.

No system is perfectly secure, but we work to keep ERPisy's protections appropriate to the data it holds.

11. If something goes wrong

If personal data is breached, we will act to contain it, inform the affected businesses and people without undue delay, and inform the Data Protection Board of India and CERT-In as the law requires, with what happened, what it may mean for them and what we are doing about it.

12. Your rights

Under the DPDP Act you may ask us to:

• tell you what personal data of yours we process and with whom it is shared;
• correct, complete or update it, or erase it where we no longer need it or the law no longer requires us to keep it;
• withdraw a consent you gave;
• address a grievance, and nominate someone to exercise your rights if you die or become unable to.

Much of this you can do yourself in ERPisy (your profile, your business's records). Otherwise write to the Grievance Officer (section 17). We will confirm who you are and reply within 30 days. If you are not satisfied with our answer, you may complain to the Data Protection Board of India.

If your data is in a business's records (for example, you are a shop's customer), we will pass your request to that business and help it respond.

13. Children

ERPisy is for businesses and is not meant for anyone under 18. We do not knowingly create accounts for children. A business must not enter a child's personal data except as the law allows it to.

14. Cookies and storage on your device

• One essential cookie keeps you signed in. ERPisy does not use advertising or tracking cookies.
• The app keeps some things in your browser's or phone's local storage so it works smoothly: a bill you are still making, your recent choices, and cached product lists.
• Pages on erpisy.com load fonts from Google Fonts.

15. What we do not do

We do not sell personal data, show advertising, build profiles for marketing, read your phone's messages, contacts or photos, or track your location. The app uses the camera only when you scan a barcode, and Bluetooth only to reach your receipt printer.

16. Changes to this Policy

We may update this Policy. The date and version at the top say which applies. For a material change we will tell business owners by email or in the app before it takes effect, and ask for consent again where the law requires it.

17. Grievance Officer and contact