Privacy Policy

1. Information We Collect

Account Information

When you register, we collect your company name, username, and email address. This information is required to create and manage your account.

Business Data

You may enter business data into the Service, including invoices, inventory records, expense transactions, employee information, salary records, and financial reports. This data is stored to provide you with the Service's functionality.

Usage Data

We automatically collect limited technical data such as login timestamps, feature usage patterns, and error logs. This data helps us maintain and improve the Service.

2. How We Use Your Information

We use your information to:

• Provide, maintain, and improve the Service
• Authenticate your identity and secure your account
• Send transactional emails (password resets, account notifications)
• Monitor for security threats and abuse
• Comply with legal obligations

We do not sell, rent, or share your personal information with third parties for marketing purposes.

3. Data Storage & Security

Your data is protected by multiple layers of security:

• AES-256 encryption for sensitive data at rest
• TLS 1.2/1.3 encryption for all data in transit
• Row-level security (RLS) ensuring strict tenant data isolation
• Passwords hashed with bcrypt (never stored in plain text)
• Two-factor authentication (TOTP and SMS) available for all accounts
• Regular encrypted backups with GPG AES-256

Data is stored on self-hosted infrastructure. We do not use third-party cloud providers for primary data storage, giving us full control over your data's physical security.

4. Data Retention

Your data is retained for as long as your account is active. If you deactivate your account, your data is preserved for 30 days to allow recovery. After 30 days, your data may be permanently deleted from our systems and backups.

Certain records may be retained longer if required by law (e.g., financial records subject to tax regulations).

5. Your Rights

You have the right to:

• Access: Request a copy of the personal data we hold about you
• Rectification: Correct inaccurate personal data through your account settings
• Erasure: Request deletion of your account and associated data
• Data Portability: Export your data in standard formats (PDF, Excel)
• Restriction: Request that we limit processing of your personal data
• Objection: Object to processing of your personal data

To exercise these rights, contact us at support@bahi-khata.com. We will respond within 30 days.

6. Data Sharing

We may share your data only in the following circumstances:

• With your explicit consent
• To comply with legal obligations, court orders, or law enforcement requests
• To protect the rights, safety, or property of Bahi Khata or its users

We never sell your data. We do not use your business data for advertising, analytics products, or any purpose other than providing the Service to you.

7. Cookies & Local Storage

We use minimal browser storage for essential functionality only:

• Authentication tokens: HttpOnly cookies for secure session management
• User preferences: Theme (dark/light mode), font size, and display settings stored in localStorage
• Session state: Idle protection and lock screen state

We do not use third-party tracking cookies, analytics scripts, or advertising pixels.

8. Children's Privacy

The Service is not intended for use by individuals under 18 years of age. We do not knowingly collect personal information from children. If we become aware that a child has provided us with personal data, we will take steps to delete such information.

9. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated via email or an in-app notification at least 30 days before they take effect. The "Last updated" date at the top of this page indicates when the policy was last revised.

10. Contact Us

If you have questions about this Privacy Policy or how we handle your data, contact us at: support@bahi-khata.com