Receipt Book
Log in Sign up free

Draft for review. Highlighted details still need filling in, and the text should be checked by a lawyer before launch.

Privacy policy

Last updated: [Effective date]

Receipt Book is run by [Legal business name], [Registered address] ("we", "us"). This policy explains what we collect when you use Receipt Book, why, and the choices you have. It is written to meet India's Digital Personal Data Protection Act, 2023 and the Information Technology Act, 2000.

The short version

  • You can make an invoice and download the PDF without an account. What you type is used to make that PDF and isn't stored.
  • With an account, we store what you save — your business profile, customers and documents — so you can use them again.
  • We don't sell your data or show ads. We use a few trusted services only to run Receipt Book.
  • You can delete your account and everything in it from Settings at any time.

What we collect

Your account

Your email address and password. We store the password only as a one-way hash (we can't read it).

What you save

  • Business profile: business name, address, email, phone, GSTIN, website, logo, UPI ID, document defaults and numbering.
  • Customers: the names, contact people, emails, phone numbers, addresses and GSTINs you add.
  • Documents: invoices, quotes and other documents, their items, amounts, status (sent, paid) and dates, and when your customer opened a shared link or document email (date and time only; no IP address or device is kept).

Your customers' details are personal data you are responsible for. Only add what you need to bill them, and make sure you are allowed to share it with us.

How you use Receipt Book

  • A count of WhatsApp shares and payment reminders each month, to apply your plan's send limit.
  • Your subscription: plan, status, renewal date and the Razorpay subscription ID. We never see or store your card, UPI or bank details.
  • Refer a friend: who signed up with your link and what you earned. If you add payout details, your UPI ID or bank account, name, and optionally PAN and GSTIN, kept encrypted and used only to pay your referral earnings and for tax records (TDS, GST). Friends you refer see none of this.
  • Technical data: IP address, browser and the pages requested, kept in server logs and used to keep the service secure (for example, to limit repeated login attempts).
  • Help questions: the words you type into Help search or Ask, whether you opened an answer, and the 👍 or 👎 you give an Ask answer. Email addresses, phone numbers and GSTINs are replaced with placeholders (for example [email]) before anything is saved. We read these, without your business name, to improve our help articles.
  • Security records: when something looks like an attack or abuse — a failed login, too many attempts, a scan for weaknesses, a bot — we record the IP address, browser, page and time. Email addresses in these records are partly hidden (for example pr***@example.com).

Cookies and local storage

  • Session cookie (ci_session) — keeps you logged in while you use the app.
  • Security cookie (csrf_cookie_name) — protects forms against cross-site request forgery.
  • "Remember me" cookie (ci_remember) — only if you tick "Remember me", to keep you logged in on that device.
  • Theme — your light/dark choice is kept in your browser's local storage, not sent to us.

We don't use advertising or third-party tracking cookies. Razorpay sets its own cookies inside its checkout window when you pay.

Why we use it

  • To provide Receipt Book: save your documents, make PDFs and share links, and remember your customers.
  • To bill paid plans and apply plan limits.
  • To send emails you need, such as password resets.
  • To keep the service secure, prevent abuse and fix problems.
  • To meet legal obligations, such as tax and accounting records for our own invoices.

We use your data with your consent (when you create an account and save things) and to perform the service you asked for.

Who we share it with

  • Razorpay — processes subscription payments. See Razorpay's privacy policy.
  • Brevo — sends our transactional emails (password resets and, later, documents you choose to email).
  • Contabo — hosts our server and database in [Server location, e.g. Mumbai, India].
  • Sentry — receives error reports so we can fix problems. We strip request contents, cookies and IP addresses before they're sent, so your documents and passwords never reach it.
  • Have I Been Pwned — when you choose a password, we check it against passwords leaked in data breaches. Only the first five characters of its one-way hash are sent; your password itself never leaves our server.
  • Cloudflare Turnstile — on signup, password reset and after repeated failed logins, Cloudflare checks that you're a person and not a bot. It doesn't use cookies to track you.
  • WhatsApp — when you tap "Send on WhatsApp", the message is opened in WhatsApp on your device. We don't send anything to WhatsApp ourselves.
  • Authorities — only when the law requires it.

Share links: a document you share gets a long, random link. Anyone who has that link can view the document and download its PDF, without logging in. You can reset a link at any time, and the old one stops working.

How long we keep it

  • Your account data stays until you delete it or your account.
  • When you delete your account, it closes straight away (nobody can log in and your share links stop working) and everything in it is kept for 30 days so you can restore it if you change your mind. After 30 days its documents, customers, receivables, settings and send history are permanently deleted. You can also choose to delete everything straight away. Records of what you paid us are kept as long as tax law requires. Copies in backups are overwritten within [Backup retention, e.g. 30 days].
  • Server logs are kept for [Log retention, e.g. 90 days].
  • Security records are deleted after 90 days.
  • Help searches and Ask questions and answers are deleted after 12 months.
  • Payment and subscription records are kept as long as tax law requires.

Your rights

You can see and correct your data in the app, download a copy of all of it (Settings → Account → Download all my data), and delete your account from Settings → Account. You can also ask us to access, correct or erase your personal data, withdraw consent, or name someone to act for you, by writing to [Privacy email]. We reply within [Response time, e.g. 30 days].

Security

All traffic is encrypted with HTTPS. Passwords are hashed, forms are protected against forgery, login attempts are rate-limited, and each account can only ever reach its own data. No system is perfectly secure; if a breach affects your data, we'll tell you and the Data Protection Board of India as the law requires.

Children

Receipt Book is for businesses and is not meant for anyone under 18.

Changes

If we change this policy in a way that matters, we'll tell you by email or in the app before the change applies.

Grievance officer

[Grievance officer name]
[Legal business name], [Registered address]
Email: [Grievance email]