Privacy Policy

1 Information We Collect

We collect information you provide directly when you register, pay for a plan, or contact us:

• Account information: Your name, business name, email address and mobile number.
• Authentication data: Your password is stored as a secure cryptographic hash (bcrypt) — we cannot read it.
• Business data: Orders, invoices, inventory, party (customer/supplier) records, payments and other data you enter into the ERP. This data belongs to you.
• Payment information: Plan type and transaction references. Card or UPI details are handled entirely by Razorpay — we never see or store them.
• Communication data: Messages or enquiries you send us via the contact form or email.

We also collect limited technical data automatically:

• IP address and browser type (for security and rate-limiting purposes).
• Session tokens stored in your browser's local storage to keep you logged in.

2 How We Use Your Information

• Providing the service: To create and manage your account, activate your subscription and give you access to the ERP.
• Email communications: To send OTP verification codes, welcome emails on account activation, and subscription-related notifications.
• Customer support: To respond to your queries, troubleshoot issues and improve the platform.
• Billing: To process your payment via Razorpay and maintain records of your subscription.
• Security: To detect abuse, prevent fraudulent registrations and protect your account.

3 Data Storage & Security

All data is stored on secure cloud servers. We take the following measures to protect your data:

• All data is transmitted over HTTPS (TLS encryption).
• Passwords are hashed using bcrypt — they are never stored in plain text.
• Session tokens are randomly generated and expire on logout or inactivity.
• Access to production systems is restricted and secured with SSH key authentication.
• HTTP security headers (HSTS, CSP, X-Frame-Options) are enforced on all responses.

While we take reasonable precautions, no system is completely immune to risk. We encourage you to use a strong, unique password for your account.

4 Third-Party Services

We use a small number of trusted third-party services to operate the platform:

• Razorpay — Payment processing. When you pay for a subscription, you interact with Razorpay's secure checkout. We receive only a payment confirmation reference. Razorpay's privacy policy applies to data they collect: razorpay.com/privacy
• Email service — We use an SMTP provider to send OTP and account notification emails.
• Google Fonts — Fonts are loaded from Google's servers. Google may collect basic usage data per their privacy policy.

We do not integrate with advertising networks, social media trackers or any analytics services that profile your behaviour.

5 Cookies & Local Storage

Our website and ERP do not use tracking cookies. We use browser local storage solely to store your login session token so you remain logged in across page loads. This token is cleared when you log out.

No third-party cookies are placed by us. Google Fonts may set its own cookies per Google's policy.

6 Data Retention

• Active accounts: Your account and business data are retained for as long as your account exists.
• Expired subscriptions: Your data remains accessible for a reasonable period after subscription expiry to allow renewal.
• Account deletion: If you request deletion of your account, we will permanently remove your personal data and business data within 30 days.
• Payment records: Transaction references may be retained for up to 7 years as required by Indian financial regulations.

7 Your Rights

You have the following rights regarding your data:

• Access: Request a copy of the personal data we hold about you.
• Correction: Update incorrect information via your account settings or by contacting us.
• Deletion: Request permanent deletion of your account and all associated data.
• Data portability: Request an export of your business data in a standard format.
• Objection: Object to any use of your data that you did not consent to.

To exercise any of these rights, contact us at aapnavyapar@gmail.com. We will respond within 14 business days.

8 Children's Privacy

Aapna Vyapar is a business software platform intended for adults operating commercial enterprises. We do not knowingly collect information from anyone under the age of 18. If you believe a minor has registered, please contact us and we will delete the account immediately.

9 Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will update the "Last updated" date at the top of this page. For significant changes, we will notify you by email. Continued use of the service after changes constitutes acceptance of the updated policy.

10 Contact Us

If you have any questions, concerns or requests regarding this Privacy Policy or your data, please reach out:

• Email: aapnavyapar@gmail.com
• Phone / WhatsApp: +91 85118 50044
• Support hours: Monday – Saturday, 9 AM to 7 PM IST