Last updated 28 August 2026
Privacy policy
This explains what billkraft collects, why, where it is kept, and what you can ask us to do with it. It describes how the software actually works rather than reserving rights we do not use.
Who we are
billkraft is operated by Finovyx Advisory LLP. For the account you hold with us, we are the data fiduciary under the Digital Personal Data Protection Act, 2023.
For the records you enter about your own customers, you are the data fiduciary and we act as a data processor on your instructions. We do not use your business records for any purpose of our own.
What we collect
Your account
Your name, email address, phone number and a hashed password. Your business name, address and, if you are registered, your GSTIN.
What you enter
The customers, suppliers, items, invoices, payments and stock records you create. Some of this is personal data about your customers, such as their names, addresses, phone numbers and GST numbers.
Sign-in activity
The date and time you last signed in, and how many times you have signed in. This is used to see whether accounts are active and to notice unusual access.
What we do not collect
- No IP addresses or device fingerprints are recorded against your sign-ins.
- No advertising networks, analytics scripts or third-party trackers run on this site.
- No cookies are used for tracking. Your sign-in is held in your own browser’s local storage and is cleared when you sign out.
- Web fonts are served from our own domain, not fetched from Google, so visiting the site does not disclose your address to a font provider.
- We do not sell, rent or share personal data with anyone for marketing.
Why we process it
- To give you the service you signed up for: billing, stock and reports.
- To keep your account secure and to investigate misuse.
- To meet legal obligations, including retaining tax records where the law requires it.
- To contact you about the service. We will not send marketing email without your consent.
Where it is stored
Your records are held in a managed PostgreSQL database in Mumbai, India.
Our application servers run in Singapore, so data is processed there in transit while you use the service. The public website is served from a global content network, which handles only the pages themselves and none of your records.
Everything travels over encrypted connections. We will tell you here if these locations change.
Who else can see it
We use three infrastructure providers, each bound to process data only for running the service:
- Supabase — the database, in Mumbai.
- Render — the application servers, in Singapore.
- Vercel — hosting for the public website.
Nobody else receives your data, except where we are required by law to disclose it.
Keeping accounts separate
Every request is authenticated, and each business can only ever read its own records. Our own staff access is limited to account information — which businesses exist, whether they are active, and when users last signed in. That view deliberately excludes your customers, your invoice amounts and your GST number.
How long we keep it
While your account is open, and afterwards only for as long as tax and company law require records to be retained. Ask us to delete your account and we will remove your data within 30 days, other than anything we are legally obliged to keep.
Your rights
Under the Digital Personal Data Protection Act, 2023 you can ask us to:
- Tell you what personal data we hold about you.
- Correct anything inaccurate or incomplete.
- Delete your data where we are not required to keep it.
- Nominate someone to exercise these rights if you cannot.
Write to us and we will respond within 30 days. If you are not satisfied, you may complain to the Data Protection Board of India.
If something goes wrong
If a breach affects your personal data, we will notify you and the Data Protection Board as the Act requires, and tell you plainly what happened and what to do about it.
Contact
For any privacy question, or to exercise the rights above, write to our grievance officer at support@billkraft.in.
Finovyx Advisory LLP, India.
Changes
If we change how we handle personal data, we will update this page and change the date at the top. Significant changes will be told to you by email.