Privacy policy

Three kinds of thing, and it is worth separating them because they are treated differently.

• Account details — the email address you sign in with, a one-way encrypted form of your password (we cannot read the original), your shop's name and address, and the logins you issue to staff.
• Your shop's records — items, bills, customers, suppliers, purchases, team members and attendance. Everything you type into the product.
• Technical records — IP address, browser, and timestamps of requests, kept so we can find faults and spot abuse.

If you write to us through the contact form we also keep what you sent and the address you sent it from, so we can reply.

Payments are taken by Razorpay, a payment gateway regulated in India. Your card number, CVV, UPI PIN and netbanking credentials are entered on Razorpay's own systems and are never sent to us, seen by us or stored by us.

What we receive back and keep is the amount, the date, whether it succeeded, and Razorpay's reference for it. That is what a receipt and a refund need, and nothing more.

To run the service you asked for, to bill you for it, to answer you when you write in, to keep the service secure, and to meet obligations the law places on us.

We do not profile you, sell your data, share it with data brokers, or use your shop's records to advertise anything to you or anyone else. There is no advertising business here to feed.

In a managed PostgreSQL database hosted in Singapore (ap-southeast-1), with encrypted backups. Your data therefore leaves India, and we are telling you so plainly rather than in a footnote.

The application servers and the database are reached over encrypted connections only.

A small number of suppliers, each doing one job, and none of them permitted to use your data for their own purposes:

• the database and hosting providers that run the service
• Razorpay, for taking payments
• an email provider, for account and support email

Beyond that, only where a law or a court in India requires it — and we will tell you if that happens, unless we are forbidden from doing so.

If the business is ever sold or merged, your data may move with it. You would be told before that happened.

One cookie, named `token`. It is what keeps you signed in, it is set only after you sign in, it cannot be read by JavaScript, and it expires twenty-four hours after it is issued.

There are no advertising cookies, no analytics cookies and no third-party trackers of any kind on this site or in the product. That is not a policy we intend to change quietly — if it ever does change, this page changes first.

Your shop's records stay for as long as the shop exists, because they are the thing you came for. A shop on the Free plan is not deleted for being inactive.

When you ask us to delete a shop, its records are removed. Technical logs age out within a few months. Payment records are kept for as long as Indian tax and accounting law requires, which is currently eight years — those we cannot delete on request.

Write to us and we will:

• tell you what we hold about you
• give you a copy of your shop's records
• correct anything that is wrong
• delete your shop and its records, subject to the payment records above
• answer a complaint about how we have handled any of this

Send any of these to hello@easinvy.com. We reply to privacy requests within thirty days and usually much sooner.

The service is for businesses and is not intended for anyone under 18. We do not knowingly hold data about children.

Revisions are posted here with a new date at the top. A change that materially affects how your data is handled will also be emailed to the address on your account.