Privacy Policy

Welcome to KhataGO. We respect your privacy and are committed to protecting your personal and business data. This Privacy Policy explains what information we collect, how we use it, and what rights you have regarding your data.

We collect: • Phone number: to create your account, send login codes and link WhatsApp • Business profile: business name, GSTIN, address and state, if you fill them in (they print on your invoices) • Transaction data: the sales, purchases, expenses, receivables and payments you record • Contact information: the names, phone numbers, GST numbers and addresses of your customers and vendors, as you enter them • WhatsApp messages: every message you send to the KhataGO number (the text, or for a photo the media reference) and the assistant's reply • Audit records: for privileged actions — deleting a transaction, changing an API key, admin actions — the time, the action, your IP address and browser user-agent • Your own AI API key, if you add one (encrypted — see Data Security) We run no analytics or tracking scripts and collect no device identifiers.

We use your data to: • Keep your books: record, edit, summarise and export what you enter • Run the AI assistant: the messages and bill photos you send are passed to Google's Gemini API to be turned into ledger entries. If you add your own Gemini key they are sent under that key, and your Google account's terms apply • Send messages on your behalf: payment reminders for overdue receivables go to your customers' WhatsApp numbers • Bill you: plan status and Razorpay's order, payment and subscription references • Investigate problems and abuse, using server logs and the audit records • Meet legal obligations We do not train AI models on your data and we do not use it for advertising.

We do not sell your data. It is processed by these providers, each only for the purpose named: • Vercel — hosts the web app and API • Supabase — hosts the Postgres database, in its Sydney (Australia) region; your data is therefore stored outside India • Meta (WhatsApp Cloud API) — carries messages between you, your customers and the KhataGO number • Google (Gemini API) — processes the messages and images you send to the assistant • Razorpay — takes payments; we never see or store your card or UPI details, only Razorpay's order, payment and subscription IDs Beyond these, we disclose data only when the law requires it.

We use minimal cookies and local storage for: • Keeping you logged in • Remembering your language preference • Improving app performance We do not use cookies for advertising or tracking purposes.

You can: • Access and export: download your transactions as CSV, your ledger as Tally XML and your monthly reports from the app at any time • Correct: edit any transaction, contact or business detail yourself • Delete: delete individual transactions yourself (each deletion is recorded in the audit log). To delete your whole account and everything linked to it, email privacy@khatago.in — there is no self-service account-deletion button. The Closing Your Account section says exactly what is deleted and what remains • Withdraw: stop using the service at any time; a login session expires on its own after 24 hours Privacy requests: privacy@khatago.in

There is no self-service delete button. To close your account, email privacy@khatago.in (or message us from your registered WhatsApp number) and say you want the account closed. We confirm the request against your registered phone number before doing anything, then an operator deletes your data by hand, following a written procedure (docs/ACCOUNT_CLOSURE.md in our repository), and replies when it is done. We have not committed to a fixed turnaround time. Before you ask, take a copy of anything you want to keep. From the app you can download all your transactions as CSV (with contact and category names) or as Tally XML, a date-range CSV or Tally export, and your monthly summaries as CSV. Contacts, receivables, payments and your WhatsApp message history are not in any self-service export today; if you want them, say so in the same email and we send them as CSV before deleting. Once deleted, nothing can be recovered — we keep no separate backups of our own. What deletion covers — everything stored under your account: • Your account record: phone number, name, business profile (business name, GSTIN, address, state, email) and your billing plan • Your AI API key, if you added one — the encrypted key, its last-four hint and the date it was set • Transactions, contacts (customers and vendors), categories, receivables and the payments recorded against them • Your WhatsApp messages and the assistant's replies, including messages from your number received before it was linked to the account • The assistant's working records — the step-by-step record of each message (the actions it ran, with names and amounts) and the operational trace — whether or not their automatic deadline has passed • Any pending login code • The Razorpay webhook records linked to your billing plan • Audit-log entries for actions you took yourself What remains afterwards: • One audit-log entry recording the closure: your account id, the time, the operator who did it and a count of rows deleted per table — no name, phone number or books. Like every audit record it is deleted automatically after 180 days • Audit-log entries our staff wrote about your account before closure (for example, replaying a stuck message) hold only ids, and age out on the same 180-day schedule • Copies held by the providers named in Data Sharing — Meta (WhatsApp), Google (Gemini) and Razorpay — are governed by their own policies; we cannot delete those for you. Razorpay keeps its own record of any payment you made to us • Waitlist sign-ups and contact or feedback forms are not linked to accounts; tell us the email you used and we delete those too

• Account, transactions, contacts and receivables: for as long as your account exists. Deletion is manual, on your request — see Closing Your Account • WhatsApp messages and the assistant's replies: for as long as your account exists, so you can check what was recorded; deleted with the account. Photos are fetched from WhatsApp for processing and are not stored by us — only WhatsApp's media reference is • Audit records: deleted automatically after 180 days by a daily job • Login codes: 10 minutes, or sooner if used or guessed wrong 5 times • Login sessions: 24 hours The assistant also keeps two kinds of working record about each message it answers, separate from the message itself: • Its step-by-step record of that message — which actions it planned and ran, with the names and amounts they involved, and the reply it sent — is deleted automatically 90 days after the message is answered. A message whose processing did not finish keeps its record until it does • An operational trace — timings, event types, token counts and sizes, with no message text, reply text, names or amounts — is deleted automatically after 30 days The windows above (30, 90 and 180 days) are the built-in defaults; the operator of the service can shorten or lengthen each of them by configuration. The messages themselves are not covered by any automatic deletion: they stay for as long as your account exists, as stated above. We do not keep separate backups of our own. If you need a copy of your books under your control, export them (CSV or Tally XML) regularly.

What protects your data, specifically: • In transit: every connection to the web app, and every call to WhatsApp, Google and Razorpay, uses TLS. The site is served over HTTPS only. • Hosting: the web app and API run on Vercel; the database is Postgres managed by Supabase in its Sydney (ap-southeast-2) region. We run no servers of our own. • Encryption we do ourselves: an AI API key you give us is encrypted with AES-256-GCM before it is stored and is only ever shown back to you masked. Nothing else is encrypted by the application. Your transactions, contacts and messages are stored in readable form in the database and protected by Supabase's access controls and any disk-level protection Supabase applies, not by us. • Login: a one-time code, valid for 10 minutes and destroyed after 5 wrong guesses. We store no passwords. • Webhooks: every message from WhatsApp is checked against Meta's HMAC signature before it is processed, and a duplicate delivery is rejected by a database constraint. • Access: every query is scoped to your account. Admin actions need a separate role and are written to an audit log. We are a small team. We have not had an independent security review or certification, and we do not claim one. No system is fully secure — report concerns to privacy@khatago.in.