1. The short version
- We collect what we need to run your account and your books, and nothing more.
- We do not sell data, show ads or use advertising trackers.
- Your business records are yours. You can export them at any time while your plan is active, and delete them yourself.
- A small number of named providers help us run the service. Section 6 lists each one and exactly what it receives.
2. Who we are, and our role
Bill Minutz is provided by MSM COMPUTERS AND DESIGNS, Tirupur, Tamil Nadu ("we", "us"). This policy is written with the Digital Personal Data Protection Act, 2023 ("DPDP Act") and the Information Technology Act, 2000 in mind. There are two roles:
- Your account data: the owner's and staff members' names, mobile numbers, emails and sign-in records. For this data, we decide why and how it is processed, so we are the Data Fiduciary.
- Data you enter about others: your customers, suppliers and employees. Your business decides what to record and why, so you are the Data Fiduciary and we process it only on your instructions, as your Data Processor. See section 11.
3. What we collect
| Data | Why we hold it |
|---|---|
| Owner's name, business name, email, mobile, city and state | To create the account, sign you in, contact you about it, and set the GST state that decides whether invoices charge CGST and SGST or IGST. |
| Passwords | Stored only as a one-way bcrypt hash. Nobody can read a password, and it cannot be recovered, only reset. |
| Business profile: GSTIN, PAN, address, bank and UPI details, logo, signature | Printed on your documents and used in GST return data. |
| Customers and suppliers: name, phone, email, GSTIN, address | To address documents to them, track what is owed and, when you choose, send them documents and reminders. |
| Staff: name, mobile, email, pay, attendance, leave, advances, signature | To run staff logins, attendance and payroll. Staff see their own pay details only, never a colleague's. |
| Business records: invoices, purchases, expenses, stock, service jobs (including photos and customer signatures captured on a job), payments, journals, attachments | This is the product: the records you came to keep. |
| Messages to the AI assistant and bill images you scan | To answer the question or read the bill you asked about. |
| Security and operational records: sign-in times, the IP address an OTP was requested from, an audit trail of edits and of platform-administrator actions | To protect accounts, investigate misuse, and let you see who changed what. |
We do not collect card numbers, biometric data or your location.
4. Why we use it
- To provide the service you signed up for: accounts, documents, calculations, reports, backups and support.
- To keep it secure: verifying mobile numbers, rate-limiting, detecting misuse and keeping audit trails.
- To talk to you about your account: trial and renewal notices, password resets, important changes and replies to support requests. We will not send you marketing without your consent, and you can opt out at any time.
- To meet legal obligations: tax records for our own subscription invoices, and lawful requests from authorities.
We process personal data on the basis of the consent you give when you sign up, and for the legitimate uses the DPDP Act allows, such as meeting a legal obligation. You can withdraw consent at any time (section 10). That stops future processing, although we cannot provide an account without the data it needs.
5. What we never do
- Sell or rent personal data or business records.
- Show advertising, or use advertising or cross-site tracking tools.
- Use your business records to train AI models.
- Message your customers on our own account. Messages go out only when you or your settings send them.
6. Service providers
These are the only outside services the software calls, with what each one receives. Each receives only what it needs to do its job for us.
| Provider | What it does | What it receives |
|---|---|---|
| Supabase | Database | All stored data. This is where your records live. |
| Render | Runs our application server | Requests as they pass through |
| Vercel | Serves the website and web app | Page requests |
| Anthropic | AI assistant and bill scanning | Your question and the figures needed to answer it, or the bill image you upload. Sent only when you use these features. |
| Firebase Authentication (Google) | Sends the sign-up verification code by SMS and checks the code you type | Your mobile number. Google sends the code and tells us only that the number was verified; we never see the code. Google also runs an invisible check on the page to block automated requests, and in rare cases shows you a “not a robot” box. |
| Razorpay | Collects our subscription payments, including monthly auto-pay | Your name, email, mobile and the amount due. Card, UPI and bank-mandate details are entered on Razorpay's own secure page and never reach us. |
| Zoho Mail, which hosts our own mailbox — or your mailbox's provider, if you connect your own | Carries the password-reset link, and the documents and reminders you email to your customers | The recipient's address, the subject and the message, with any document attached. We use no third-party bulk-email service; mail leaves from a mailbox, the way your own email does. |
| Meta (WhatsApp Cloud API) | Sends documents and reminders over WhatsApp, when you or your settings ask | Recipient number, the message and any attached document |
| PeriOne (GST service provider) | GSTIN lookup and e-way bill generation with the GST system | The GSTIN looked up, or the details of the e-way bill being generated |
If you connect your own payment gateway (Razorpay, Cashfree or PhonePe) to collect money from your customers, or your own WhatsApp Business account or mailbox, those are your accounts under your own agreement with that provider. We pass them only what is needed to take the payment or send the message you asked for.
Some of these providers may store or process data outside India. Where they do, it is under their contractual security commitments, and only to countries to which the DPDP Act permits transfer. We disclose data to anyone else only where the law requires it, for example under a valid order from a court or a government authority.
7. Cookies and browser storage
We set no advertising or third-party cookies. The app keeps your sign-in token and small display preferences, such as dark mode, in your browser's local storage. Signing out clears the token. While you verify your mobile number at sign-up, Google's Firebase Authentication sets its own short-lived storage on that page for the verification and its anti-robot check; we sign you out of Firebase as soon as the number is verified, and keep no Firebase session.
8. How long we keep it
- While your account is open: we keep your records, because keeping them is the service. Indian tax law also expects books to be retained for several years, so keep your own backups too.
- When you delete the account: Settings → Account & Security removes the business and its records from the live database straight away. Copies in our providers' routine backups expire in line with those backup cycles. Deletion cannot be undone, so export first.
- Lapsed plans: nothing is deleted because a trial or paid plan lapsed. The account is locked, and backups cannot be downloaded, until it is renewed.
- Our own records: invoices we issue to you and records we must keep by law are retained for the period the law sets.
9. Security
- All traffic is encrypted in transit (HTTPS).
- Passwords are bcrypt-hashed, with an 8-character minimum for every login.
- Every query is limited to the signed-in business, so one subscriber cannot read another's data. This is enforced on the server, not only by hiding screens.
- Staff logins open only the pages the owner grants them.
- Changing a password, deactivating a login or deleting an account ends existing sessions.
- Backup files you download are encrypted (AES-GCM) and integrity-checked.
- Integration secrets, such as a WhatsApp Business token, are stored encrypted and are never included in backups.
No system is completely secure. If you suspect misuse, change your password, which signs out every session, and tell us.
10. Your rights
Under the DPDP Act you can:
- Access a summary of the personal data we process about you and the processing we carry out;
- Correct, complete or update it. Most of it you can edit yourself in Settings;
- Erase it. Delete the account yourself, or ask us to;
- Withdraw consent, as easily as you gave it;
- Nominate someone to exercise these rights if you die or become incapable;
- Raise a grievance with us (section 15), and, if you are not satisfied with our response, complain to the Data Protection Board of India.
To use any of these rights, email support@billminutz.com from the address on the account. We may need to confirm it is you before we act.
11. Data you enter about others
When you record customers, suppliers or employees, you are responsible for having a lawful reason to hold their data. You are also responsible for telling them how you use it, and for answering their requests. We help by keeping it secure, using it only to provide the service to you, and giving you the tools to correct, export or delete it. Send WhatsApp messages and reminders only to people who have agreed to receive them. If one of your customers contacts us directly, we will refer them to you.
12. Children
Bill Minutz is for businesses and is not meant for anyone under 18. We do not knowingly collect children's personal data for our own purposes. If you record a minor's details as your customer or employee, you must follow the law's rules for children's data.
13. If something goes wrong
If a personal data breach affects you, we will tell you and the Data Protection Board of India as the DPDP Act requires. We will say what happened, what it may mean for you, and what we are doing about it. Where the breach affects data you hold about others, we will give you what you need to inform them.
14. Changes to this policy
If we change this policy in a way that affects you, we will tell you in the app or by email before the change takes effect. We will not simply change the date at the top.
15. Contact and grievances
Privacy questions and requests under section 10: support@billminutz.com, or open a ticket in the app under Support.
For a grievance, under the DPDP Act, 2023 and the Information Technology Act, 2000:
Grievance Officer
MSM COMPUTERS AND DESIGNS
Email: support@billminutz.com
Phone: +91 96003 08880
Address: MSM COMPUTERS AND DESIGNS, Tirupur, Tamil Nadu, India
Mark a grievance clearly as one, so it reaches the Grievance Officer. We acknowledge grievances within 24 hours and aim to resolve them within 15 days. If you are not satisfied with our answer, you can complain to the Data Protection Board of India.