Privacy Policy

1. Introduction

MazDukan ("we", "our", or "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, store, and protect your information when you use the MazDukan mobile application and web platform (collectively, the "Service"). By accessing or using the Service, you agree to the terms of this Privacy Policy.

This policy is designed to be transparent and compliant with Google Play User Data Policies, the Information Technology Act, 2000 of India, and other applicable data protection regulations.

2. Information We Collect

We collect information that you provide directly, information generated through your use of the Service, and technical information from your device. The categories of information we collect are described in the sections below.

3. Account Information

When you create an account, we collect:

• Email Address: Used for authentication, password recovery, and account notifications.
• Password: Stored using one-way hashing (bcrypt). We cannot read your password.
• Phone Number: Optional, used for support verification.

4. Business Information

When you register for MazDukan, we collect business identification details including:

• Business Name: The registered or trading name of your shop or business.
• GSTIN: Your Goods and Services Tax Identification Number, if applicable.
• Business Address: Shop or office address used on invoices and receipts.
• Business Type: Category such as retail, wholesale, or manufacturing.
• Contact Details: Phone number and email address for account recovery and support.

5. Customer Information

You may choose to store customer records to manage credit (udhari) and send receipts. This may include:

• Customer Name: Name of the individual or business purchasing goods.
• Phone Number: Used for WhatsApp payment reminders and receipt sharing.
• Purchase History: Records of past sales linked to the customer for credit tracking.

MazDukan acts as a processor for this data; you are the controller. You are responsible for obtaining any necessary consent from your customers.

6. Product Information

Inventory data entered into MazDukan includes product names, descriptions, stock quantities, unit prices, categories, barcode numbers, and images. This data is stored locally on your device and synchronized with our secure servers when you are online.

7. Inventory Information

We process real-time inventory records including stock levels, reorder points, low-stock alerts, expiry tracking, and warehouse locations. All inventory data belongs to your business.

8. Sales Information

We process transaction records generated through the Service, including:

• Invoices & Bills: Sales receipts, invoice numbers, GST calculations, and totals.
• Payment Records: Cash, UPI, and credit payment entries linked to each sale.
• Return Entries: Product return and refund records for audit purposes.

9. Billing Information

Subscription billing records include plan name, billing cycle, amount, payment method reference, invoice IDs, and GST details. We do not store complete card numbers or UPI PINs.

10. Supplier Information

Supplier records may include business name, contact person, phone number, email address, GSTIN, and purchase order history. This helps you manage purchases and track supplier payments efficiently.

11. Staff Information

If you use the staff management features, we store:

• Staff Profiles: Name, role, contact number, and salary details.
• Attendance Records: Check-in and check-out times for payroll calculation.
• Leave Data: Leave applications and approved absences.

12. Subscription Information

We collect subscription and billing details to manage your account status:

• Plan Details: Selected plan name, billing cycle (monthly/yearly), and start date.
• Payment History: Records of subscription payments and renewals.
• Trial Status: Trial start and end dates for new accounts.

13. UPI Payment Information

MazDukan enables you to generate UPI payment links and QR codes. We do not store your personal UPI PIN or full bank account numbers. We may store:

• UPI ID: Your business UPI ID (e.g., business@upi) used to generate QR codes.
• QR Code Images: Generated QR images for display on invoices and payment screens.
• Payment Status: Transaction success or failure logs for reconciliation.

14. Device Information

We collect limited device information to ensure security and license compliance:

• Device Model & OS: Used to diagnose compatibility issues and optimise performance.
• Unique Device ID: A hashed, non-reversible fingerprint used to bind your offline license.
• IP Address: Collected during authentication for fraud prevention and security.

15. Analytics Information

We use Firebase Crashlytics and Google Analytics to collect anonymised usage data, including:

• Crash Reports: Stack traces and error logs to identify and fix bugs.
• Performance Metrics: App launch times, screen load durations, and sync latency.
• Feature Usage: Anonymised counts of how often specific features are used.

This data does not identify you personally and is used solely to improve the Service.

16. Permissions Used

The MazDukan app requests the following permissions, each for a specific purpose:

• Camera: Used for barcode scanning during inventory entry and for uploading UPI QR codes. Images are stored only if you explicitly save them.
• Photos / Storage: Used to upload business logo images, product photos, and UPI QR code images. We access only the files you select.
• Internet: Required for user authentication, cloud data synchronisation, and subscription validation.
• Notifications: Used to send payment reminders, low-stock alerts, subscription renewal notices, and business summary alerts.
• Contacts: Optional permission to auto-fill customer names and phone numbers when creating customer records.
• Biometric: Optional fingerprint or face unlock for quick app access on supported devices.

17. How Information Is Used

We use the information we collect for the following purposes:

• Service Provision: To operate, maintain, and provide the features of MazDukan.
• Authentication & Security: To verify your identity, protect against unauthorised access, and enforce license terms.
• Billing & Payments: To process subscription payments, send invoices, and manage renewals.
• Customer Support: To respond to your support requests via WhatsApp and email.
• Product Improvement: To analyse usage patterns, fix bugs, and develop new features.
• Legal Compliance: To comply with applicable laws, regulations, and legal processes.

18. Data Sharing

• Service Providers: We engage trusted third-party providers (e.g., cloud hosting, payment gateways) under strict confidentiality agreements to perform functions on our behalf.
• Legal Requirements: We may disclose information if required by Indian law, court order, or government request.
• Business Transfers: In the event of a merger, acquisition, or sale of assets, we will notify you and ensure the receiving party agrees to protect your data.
• With Your Consent: We may share data with third parties when you explicitly authorise us to do so.

19. Third-Party Services

MazDukan integrates with the following third-party services. Their use of your data is governed by their respective privacy policies:

• Firebase (Google): Used for authentication, crash analytics, and cloud messaging.
• Google Play Services: Used for in-app billing and subscription management on Android.
• Razorpay / Payment Gateways: Used to process subscription payments. We do not store your card details.
• WhatsApp: Used for customer support and sharing payment reminders.

20. Data Security

We implement comprehensive security measures to protect your data:

• Encryption in Transit: All data transmitted between the app and our servers is protected using TLS 1.3 (HTTPS).
• Encryption at Rest: Sensitive data stored on our servers is encrypted using AES-256.
• Authentication: Multi-factor authentication (Firebase Auth) with secure token rotation.
• Access Controls: Role-based access controls restrict employee and contractor access to only what is necessary.
• Secure Storage: Credentials and tokens are stored in the device secure enclave (iOS Keychain / Android Keystore).
• Backup Procedures: Automated daily backups with encrypted snapshots retained for disaster recovery.

While we take all reasonable precautions, no security system is impenetrable. You are responsible for maintaining the confidentiality of your login credentials.

21. Data Retention

We retain your data for as long as your account is active or as needed to provide the Service. Specific retention periods are:

• Active Accounts: Data is retained indefinitely while your subscription is active.
• Expired Subscriptions: Data is retained for 90 days after subscription expiry to allow reactivation.
• Deleted Accounts: Data is permanently deleted within 30 days of a verified deletion request, except where longer retention is required by law.
• Backups: Encrypted backups are retained for 90 days and then purged.

22. User Rights

Depending on your jurisdiction, you may have the following rights regarding your data:

• Access: You can view and export your business data from within the App.
• Correction: You can update your business profile, inventory, and customer records at any time.
• Portability: You can export your data in standard formats (CSV, PDF, Excel) from the App.
• Objection: You can opt out of non-essential analytics by contacting support.

23. Data Deletion Requests

You may request deletion of your account and all associated data at any time. The process is as follows:

1. User Request: Contact us via WhatsApp or email with your registered email address.
2. Verification: We will verify your identity by confirming your registered email and business name.
3. Deletion Timeline: Upon verification, we will initiate deletion within 7 business days. All data will be permanently removed within 30 days.
4. Legal Retention Exceptions: We may retain certain records if required by tax, accounting, or other applicable laws.

24. Children's Privacy

MazDukan is intended for business use and is not directed at children under 13. We do not knowingly collect personal information from children. If you believe a child under 13 has provided us with personal information, please contact us immediately and we will delete such information.

25. International Data Transfers

Your data is primarily stored on servers located in India. Some of our service providers (e.g., Firebase by Google) may process data in other countries. When we transfer data internationally, we ensure appropriate safeguards are in place, including standard contractual clauses and adherence to applicable data protection laws.

26. Policy Updates

We may update this Privacy Policy from time to time to reflect changes in our practices, technologies, or legal requirements. We will notify you of material changes through an in-app notice and an email to your registered address. The "Last Updated" date at the top of this policy indicates when the most recent changes were made. Continued use of the Service after changes constitutes acceptance.

27. Contact Information

For privacy-related questions, data deletion requests, or concerns about this policy, please contact us: