1.Who we are
BillKr is GST billing and accounting software for businesses in India. This policy explains what personal data we collect, why we collect it, who we share it with, and the choices and rights you have. It applies to our website, our web application and our mobile app.
In this policy, “we”, “us” and “BillKr” mean Integrow Business Solutions Private Limited, a company incorporated in India under the Companies Act, 2013 with Corporate Identity Number U69200RJ2026PTC112023, having its registered office at B-1D, Road Number 1, VKIA, Vishwakarma Industrial Area, Jaipur 302013, Rajasthan, India. “You” means the person or business using BillKr.
2.The laws this policy follows
BillKr operates in India, and this policy is written to comply with Indian law. The following apply to us:
- The Digital Personal Data Protection Act, 2023 (the “DPDP Act”), and the rules made under it — the principal law governing personal data in India. It sets out our duties as a Data Fiduciary, and your rights as a Data Principal.
- The Information Technology Act, 2000, in particular Section 43A — which requires a body corporate holding sensitive personal data to maintain reasonable security practices, and to compensate for negligence causing wrongful loss.
- The Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 — commonly called the SPDI Rules, which govern how sensitive personal data or information is collected, stored, transferred and disclosed.
- The CERT-In Directions of 28 April 2022 — which set requirements for reporting cyber security incidents and for retaining system logs.
- The Central Goods and Services Tax Act, 2017 and rules made under it — under which you and your customers have record-keeping obligations that BillKr is designed to support.
Where this policy and any of these laws conflict, the law prevails.
3.The two kinds of data in BillKr
This distinction runs through the whole policy, so it is worth stating plainly up front. BillKr holds two different kinds of personal data, and our responsibilities differ for each.
Data about you
Information about you and your business — your name, email address, phone number, your organisation's details and your GSTIN. We decide how this is used, and under the Digital Personal Data Protection Act, 2023 we are the Data Fiduciary for it. Most of this policy is about this data.
Data you put into BillKr about other people
The records you create as you run your business — your customers, your suppliers, the people you invoice. You decide what to enter and why. We hold and process it on your instructions, as your service provider, and we do not use it for our own purposes. Section 9 sets out how we handle it and what that means for your own obligations.
4.Information we collect
4.1Information you give us when you sign up
To create and set up your account we collect:
- Your name and email address
- A password, which we store only in hashed form and never in plain text
- Your mobile number
- Your organisation or business name
- Your GSTIN, where you have one
- Your city, and other business address details you choose to add
- A chartered accountant referral code, if you were referred by one
- Your invoice numbering and billing preferences
4.2Business records you create in BillKr
As you use the product you create records that we store on your behalf. These include your customers and suppliers and their contact details, addresses and GSTINs; your items and price lists; invoices, estimates, credit notes, purchase bills, payments and e-way bills; and your ledgers, stock positions and the returns and reports generated from all of it.
4.3Files you upload
BillKr lets you attach files to your records — purchase bills, bank statements, registration certificates, signed agreements, your business logo and other documents. We store these so you can retrieve them. We do not open, read or analyse the contents of your files except where it is technically necessary to provide a feature you have used, or where we are legally required to.
4.4Information collected automatically
When you use BillKr we record technical information needed to run and secure the service:
- IP address, browser or app version, device type and operating system
- Log records of requests to our servers, including dates and times
- Authentication and session information, so you stay logged in
- An audit record of actions taken in your account — who created, changed or deleted a record, and when
We do not use analytics, crash-reporting, advertising or marketing tracking tools in our website, web application or mobile app. We do not build profiles of you and we do not track you across other websites or apps. If we introduce any such tool, we will name it in this section and in Section 7 before it goes live.
4.5Sensitive personal data or information
The SPDI Rules, 2011 treat certain categories as sensitive personal data or information — including passwords and financial information such as bank account, card or payment instrument details. Within BillKr:
- Your account password is sensitive personal data. We store it only as a salted hash and can never read it back.
- Bank statements and financial documents you choose to upload to the document vault are sensitive personal data, and are held under the safeguards in Section 12.
- We do not collect or store your card or payment instrument details ourselves — see Section 7.4.
We collect sensitive personal data only for a lawful purpose connected with our functions, only where it is necessary for that purpose, and with your consent. You may withdraw that consent in writing, and you may decline to provide it — in which case we may be unable to provide the related part of the service.
4.6Mobile app permissions
The BillKr mobile app asks for the following permissions. Each is optional, each is requested only when you first use the feature that needs it, and you can refuse or withdraw it in your device settings — the rest of the app continues to work.
- Camera — so you can photograph a purchase bill when recording it.
- Photos — so you can attach a bill image you have already saved.
- Files and documents — so you can attach a document from your device.
The app also stores your login securely on your device so you do not have to sign in each time.
5.Why we use your information
We use the information described above for the following purposes, and not for unrelated ones:
- To create your account and let you sign in
- To provide the product — invoicing, customers, inventory, purchases, GST returns, reports and documents
- To generate the GST summaries and reports you ask for from your own records
- To let you invite your chartered accountant and give them the access you choose
- To take payment for a paid plan and issue you a receipt or invoice
- To provide support, and to investigate problems you report to us
- To keep the service secure, prevent fraud and misuse, and maintain the audit record
- To send you service messages about your account, billing, security or important changes
- To send you product or marketing communications, only where you have agreed to receive them, and with an unsubscribe option in every message
- To meet our legal, tax and regulatory obligations
6.Consent, notice and our grounds for processing
6.1The notice we give you
Before or at the time we ask for your consent, the DPDP Act requires us to give you a notice, in clear and plain language, that tells you what personal data we intend to collect, the purpose we will use it for, how you may exercise your rights, and how you may complain to the Data Protection Board of India. This policy, together with the consent request shown when you create your account, is that notice.
You may ask to receive that notice in English or in any language listed in the Eighth Schedule to the Constitution of India, as the DPDP Act provides.
6.2Consent
Where we rely on consent, it is free, specific, informed, unconditional and unambiguous, given by a clear affirmative action, and limited to the personal data necessary for the stated purpose. We do not bundle unrelated purposes into a single request, and we do not treat continued use of the product as consent to something you were never told about.
6.3Legitimate uses
For some processing we rely not on consent but on the “legitimate uses” the DPDP Act permits — in particular where you have voluntarily provided your personal data for a purpose you asked us to fulfil and have not objected to its use for that purpose, and where processing is necessary for us to comply with a law or a court order in India.
6.4Withdrawing consent
You can withdraw your consent at any time, and it must be as easy to withdraw as it was to give. Write to us using the details in Section 16. When you withdraw consent we will stop processing your personal data for the affected purpose within a reasonable time, and will require our processors to do the same, unless a law requires us to keep processing it. Withdrawal does not make unlawful anything we did lawfully beforehand, and it may mean we can no longer provide part or all of the service.
9.Data you hold about your own customers
When you enter details of your customers, suppliers or contacts into BillKr, you decide what to collect and why. For that data we act on your instructions as your processor. Specifically:
- We use it only to provide the service to you — we do not use it for our own purposes, and we do not sell it or use it to market to your customers.
- We keep it while your account is active, and handle it on closure as set out in Section 11.
- We apply the security measures described in Section 12 to it.
- If we receive a request or complaint directly from one of your customers about their data, we will normally refer them to you, and tell you.
What this means for you
You are responsible for the personal data you put into BillKr about other people — for having a proper basis to collect it, for telling those people how you use it, and for responding when they ask to see, correct or delete it.
BillKr gives you the tools to find, edit and remove those records. Using them is your call, not ours.
10.Where your data is stored and transferred
Your data is stored on servers located in HOSTING LOCATION / REGION.
Under Section 16 of the DPDP Act, personal data may be transferred outside India except to a country the Central Government restricts by notification. Where any of our service providers process personal data outside India, we do so subject to those restrictions, and we remain responsible to you for that data.
Separately, the SPDI Rules, 2011 permit transfer of sensitive personal data outside India only where the recipient maintains the same level of data protection that those Rules require, and only where the transfer is necessary or you have consented to it. We contract with our providers on that basis.
The CERT-In Directions of 2022 require certain system logs to be maintained within Indian jurisdiction. We retain those logs accordingly — see Section 13.
11.How long we keep it
We keep your information for as long as your account is open and you are using BillKr.
Deleting a record inside BillKr moves it to a recycle bin first, so you can recover it if the deletion was a mistake. Anything left in the recycle bin is permanently deleted after 90 days, or sooner if you remove it from the bin yourself, and an entry recording the deletion stays in the audit log. Invoices can be deleted only while they are drafts; once an invoice has been sent or voided it is a tax record and is kept.
Deleting your whole account is not yet available as a self-service option. Our team carries it out manually when you ask, as described on our data deletion page. Once we have verified your request, we delete or anonymise your personal data within RETENTION PERIOD AFTER CLOSURE, e.g. 90 DAYS, except where we must keep it longer to comply with a legal obligation, resolve a dispute or enforce our agreements. Backups are overwritten on our normal backup cycle.
12.How we protect your data
We take appropriate technical and organisational measures to protect your information, including:
- Encryption of data in transit between your device and our servers
- Passwords stored only as salted hashes, never in readable form
- Role-based access, so each person in your account sees only what their role allows
- An audit log recording who changed which record and when
- Secure storage of login credentials on your device in the mobile app
- Restricted internal access to production systems, limited to staff who need it
These measures are maintained under our information security management system, which is described in Section 14. Under Rule 8 of the SPDI Rules, 2011, an organisation that implements a documented information security programme meeting the IS/ISO/IEC 27001 standard is regarded as maintaining reasonable security practices for the purposes of Section 43A of the Information Technology Act, 2000.
No system is perfectly secure. You also play a part: keep your password confidential, do not share logins, give each member of your team their own account with an appropriate role, and tell us promptly if you think your account has been accessed by someone else.
13.Security incidents and breach reporting
If a personal data breach occurs, we act on it under a defined incident response process.
13.1Telling you and the Board
Section 8 of the DPDP Act requires us, in the event of a personal data breach, to give intimation to the Data Protection Board of India and to each affected Data Principal, in the form and manner prescribed. We will tell you what happened, the personal data involved, the likely consequences, what we are doing about it, and what you can do to protect yourself.
13.2CERT-In reporting
The CERT-In Directions of 28 April 2022 require certain classes of cyber security incident — including unauthorised access to data, data breaches and data leaks — to be reported to the Indian Computer Emergency Response Team within six hours of noticing them or being told about them. We report qualifying incidents within that window.
13.3Logs and clock synchronisation
Those same Directions require us to enable and securely maintain logs of our ICT systems for a rolling period of 180 days, retained within Indian jurisdiction, and to synchronise our system clocks to the Network Time Protocol servers of the National Informatics Centre or the National Physical Laboratory. We maintain logs on that basis, which is one reason technical log data is kept even after other data is deleted.
14.Certifications and standards
BillKr operates an information security management system certified to ISO STANDARD, e.g. ISO/IEC 27001:2022, issued by CERTIFICATION BODY under certificate number CERTIFICATE NUMBER, valid until EXPIRY DATE. The certification covers CERTIFIED SCOPE — WHICH SYSTEMS, SERVICES AND LOCATIONS.
14.1What the certification means in practice
Certification is not a badge on a website. It means an accredited external auditor has examined our security management system against the standard and found it conforming, and that we are subject to continuing surveillance audits. Operating that system commits us to:
- Assessing security risks to personal data on a regular basis, and treating them to a defined plan
- Documented policies for access control, cryptography, secure development and change management
- Formal joiner, mover and leaver controls, so access is granted and removed deliberately
- Assessing the security of suppliers and service providers before they process data for us
- A defined incident management process, which is what Section 13 rests on
- Business continuity and backup arrangements, tested rather than assumed
- Internal audit and management review, and independent surveillance audits by the certification body
14.2Why this matters under Indian law
Rule 8 of the SPDI Rules, 2011 expressly names IS/ISO/IEC 27001 as a standard that constitutes reasonable security practices and procedures for the purposes of Section 43A of the Information Technology Act, 2000. Certification to that standard is therefore not only a security measure but part of how we meet our statutory obligation to protect sensitive personal data.
Certification does not by itself discharge our duties under the DPDP Act. Those are set out in the rest of this policy and apply regardless.
If BillKr holds any further certification — for example ISO/IEC 27701 for privacy information management, ISO 9001 for quality management, or SOC 2 — name it here with its scope. If a certification lapses or its scope narrows, this section must be updated the same day. LIST ANY ADDITIONAL CERTIFICATIONS, OR DELETE THIS PARAGRAPH
15.Your rights
Under the Digital Personal Data Protection Act, 2023 you have the following rights over your personal data:
- Access — to ask what personal data we hold about you and how we have used it.
- Correction — to have inaccurate or incomplete data corrected or updated.
- Erasure — to ask us to delete your personal data, where we are not required to keep it.
- Withdraw consent — to withdraw consent at any time, as easily as you gave it.
- Nominate — to nominate another person to exercise your rights if you die or become incapacitated.
- Grievance redressal — to complain to us, and to escalate to the Data Protection Board of India if you are not satisfied.
To exercise any of these, write to us at PRIVACY EMAIL. We will respond within RESPONSE TIME, e.g. 30 DAYS. We may need to verify your identity first. Much of your information can also be viewed and corrected directly in your account settings.
15.1Your duties as a Data Principal
The DPDP Act also places duties on you. You must not impersonate another person when providing your personal data, must not suppress material information when providing it where required by law, must not register a false or frivolous grievance or complaint, and must furnish only information that is verifiably authentic when exercising your right to correction or erasure. The Act provides for penalties where these duties are breached.
15.2If we are designated a Significant Data Fiduciary
The Central Government may designate a Data Fiduciary, or a class of them, as a Significant Data Fiduciary based on factors such as the volume and sensitivity of personal data processed and the risk to Data Principals. If BillKr is so designated, we will additionally appoint a Data Protection Officer based in India and answerable to our board, appoint an independent data auditor, and carry out periodic Data Protection Impact Assessments and audits. We will update this policy and publish the Data Protection Officer's contact details if that designation applies to us.
16.Grievance Officer and how to complain
As required by the Digital Personal Data Protection Act, 2023 and the Information Technology Act, 2000, we have appointed a Grievance Officer who you can contact about this policy or how your data is handled.
NAME
Keval Nagar
PHONE
+91 99827 31315ADDRESS
Integrow Business Solutions Private Limited, B-1D, Road Number 1, VKIA, Vishwakarma Industrial Area, Jaipur 302013, Rajasthan, India
We will acknowledge your grievance promptly and respond within the period prescribed under the DPDP Act and the SPDI Rules, 2011. Exhausting this route is the first step — the DPDP Act requires you to raise your grievance with us before approaching the Board.
If we do not resolve it to your satisfaction, you may complain to the Data Protection Board of India. An appeal against an order of the Board lies to the Telecom Disputes Settlement and Appellate Tribunal, within the period allowed under the Act.
Nothing in this policy limits any remedy available to you under the Information Technology Act, 2000, the Consumer Protection Act, 2019, or any other law.
17.Children
BillKr is a business product and is not intended for children. Under the DPDP Act a child is anyone who has not completed eighteen years of age. We do not knowingly collect the personal data of a child.
Where we did process a child's personal data, the Act requires verifiable consent of a parent or lawful guardian, and prohibits any processing likely to cause a detrimental effect on the child's well-being, as well as tracking, behavioural monitoring and targeted advertising directed at children. We do none of these things. If you believe a child has provided us with personal data, contact us and we will delete it.
18.Changes to this policy
We may update this policy as the product or the law changes. When we do, we will change the “last updated” date at the top and publish the new version on our website. If a change materially affects how we handle your personal data, we will give you notice — by email or in the app — before it takes effect.
19.Contact us
For any question about this policy or your personal data, contact us at PRIVACY EMAIL, or write to:
Integrow Business Solutions Private LimitedB-1D, Road Number 1, VKIA, Vishwakarma Industrial Area,
Jaipur 302013, Rajasthan, India
CIN U69200RJ2026PTC112023