Privacy Policy

For your account and business records, you are the data controller and we are your processor. For the limited account information we need to run the Service (e.g. your login identity and billing status), we act as controller.

• Account identity from Google sign-in (name, email) and your role/approval status.
• Business profile: company name, GST number, address and contact details.
• Operational data you enter: items, stock, sales, purchases, returns, customers, suppliers and staff names.
• Bill and document images you upload for AI extraction.
• Usage and audit logs (including AI usage) for security, support and billing.

We process data to provide and secure the Service, perform our contract with you, comply with legal and tax obligations, and improve reliability. We do not use your business records for advertising.

When you use AI bill entry or the AI assistant, the relevant image or query is sent to Google's Gemini API to produce a result that is returned to you. We use a paid API tier under which your content is not used to train or improve the provider's models. AI output is provided for your review and may contain errors.

We never sell, rent, or trade your personal or business data.

• Supabase — database, authentication and file storage.
• Google — sign-in (OAuth) and the Gemini API (AI features).
• Hosting infrastructure — the servers on which the Service runs.

Sub-processors are bound to protect data and process it only on our instructions.

We keep your data for as long as your account is active and thereafter only as required to meet legal, accounting and tax obligations (for example, statutory retention of GST/invoice records). You may request deletion, subject to those obligations.

We apply access controls, per-tenant data isolation, encryption in transit, and server-side handling of secrets. No system is perfectly secure, but we work to protect your data and to fix issues promptly.

Subject to applicable law (including India's DPDP Act), you may request access to, correction of, or deletion of your personal data, and may withdraw consent where processing is based on it. Contact us to exercise these rights.

We use strictly necessary cookies and browser storage to keep you signed in and to run the app. We do not use advertising cookies.

The Service is for businesses and is not directed to children under 18.

We may update this Policy; the "Last updated" date will change. Material changes will be surfaced in-app where appropriate.

For privacy questions or grievances, contact info@nexoratechnologies.cloud. We are based in Kolkata, West Bengal, India.