Privacy Policy
At Bebsa Banao, your trust is our most valuable asset. We are committed to maintaining the highest standards of data protection, transparency, and security across our entire POS, CRM, inventory, and journal ecosystem.
We Never Sell Your Data
This is our unwavering promise to you. Your business data, customer information, transaction records, and journal entries are yours and yours alone. We will never share, sell, or trade your data with any third party. Period.
Information We Collect
We collect only the information necessary to operate and improve our services. This includes business registration details (business name, address, GSTIN), user account information (name, email, phone), transaction and sales data processed through our POS system, customer and contact information you store in our CRM, inventory and product data, journal entries and business notes you create, and technical usage data such as IP address, browser type, and device information for security and analytics.
How We Use Your Data
Your data is used exclusively to deliver, maintain, and enhance the Bebsa Banao ecosystem. This includes processing point-of-sale transactions and generating invoices, storing and organizing your customer relationships through our CRM, managing your product inventory and stock levels, providing business analytics, reports, and AI-powered insights, maintaining your journal and business records, communicating important service updates, security alerts, and support responses, and complying with legal and regulatory obligations.
Data Security & Encryption
We protect your data with industry-leading security measures. All data is encrypted at rest using AES-256 encryption and in transit using TLS 1.3 protocols. Our infrastructure is hosted on secure, SOC 2 compliant servers with 24/7 physical security monitoring, intrusion detection systems, and regular penetration testing. Access to your data is restricted through role-based access control, and all actions are logged and auditable.
We Never Sell Your Data
This is our most important commitment to you: We NEVER sell, rent, or trade your personal or business data to any third party for any reason. Your business information, customer data, transaction records, journal entries, and any other data you entrust to us remains yours. We do not share your data with advertisers, data brokers, marketing firms, or any external commercial entities. Your trust is the foundation of our business.
1. Information We Collect
Account Information
When you register for a Bebsa Banao account, we collect your name, email address, phone number, business name, business address, and password (stored as a secure hash using bcrypt). This information is necessary to create and maintain your account.
Business Data
As you use our POS system, CRM, inventory management, and journal features, we store the data you create: sales transactions, purchase records, customer and supplier contact details, product catalogs, pricing information, stock levels, invoices, receipts, journal entries, notes, business reports, and any other data you input into the system.
Payment Information
If you subscribe to a paid plan, payment processing is handled by our secure third-party payment partners. We do not store full credit card numbers or banking details on our servers. We may store limited information such as the last four digits of your card, the card type, and the billing address for reference.
Technical Data
We automatically collect certain technical information when you use our services, including your IP address, browser type and version, device type, operating system, time zone setting, and usage patterns (pages visited, features used, time spent). This data helps us optimize performance, diagnose technical issues, and enhance security.
Communication Data
When you contact our support team, we collect your name, email address, and the contents of your communication to respond to your inquiry and improve our services.
2. How We Use Your Information
Service Delivery
We use your data to operate, maintain, and provide you with the full functionality of the Bebsa Banao ecosystem, including processing POS transactions, managing customer relationships, tracking inventory, generating reports, and maintaining your journal records.
Service Improvement
We analyze aggregated, anonymized usage data to understand how our platform is used, identify areas for improvement, develop new features, and optimize performance. This analysis never involves accessing your individual business data.
Communication
We use your email address to send service-related communications, including account verification, password reset instructions, security alerts, billing information, and important updates about our services. You may also receive occasional product update announcements, which you can opt out of.
Legal Compliance
We may process your data to comply with applicable laws, regulations, legal processes, or governmental requests, including tax reporting obligations, anti-fraud measures, and data protection requirements under Indian IT law and GDPR where applicable.
3. Data Sharing & Disclosure
Third-Party Service Providers
We engage trusted third-party service providers who assist us in operating our infrastructure. These include cloud hosting providers (for server infrastructure), email delivery services (for transactional emails), and payment processors (for subscription billing). All providers are contractually bound to strict data processing agreements and are prohibited from using your data for any purpose other than providing the specific service.
Legal Requirements
We may disclose your information if required to do so by law or in the good faith belief that such action is necessary to comply with a legal obligation, protect and defend our rights or property, prevent fraud, or protect the personal safety of our users or the public.
Business Transfers
In the event of a merger, acquisition, or sale of all or substantially all of our assets, your data may be transferred as part of that transaction. We will notify you via email and a prominent notice on our platform of any such change in ownership or control.
We Do NOT Sell Your Data
We do not sell, rent, lease, or trade your personal or business data to any third party. We do not share your data with advertisers, data brokers, or marketing platforms. This commitment is absolute and forms the core of our privacy promise to you.
4. Data Security Measures
Encryption
All data stored on our servers is encrypted at rest using AES-256 encryption. All data transmitted between your devices and our servers is encrypted using TLS 1.3 protocol, ensuring that your information is protected during transit.
Infrastructure Security
Our infrastructure is hosted on enterprise-grade, SOC 2 compliant data centers with 24/7 physical security, biometric access controls, video surveillance, and environmental protection systems. Network security includes firewalls, intrusion detection and prevention systems, DDoS protection, and regular vulnerability assessments.
Access Controls
Access to your data is strictly controlled through role-based access control (RBAC) within your organization. Our employees and contractors never access your data unless explicitly authorized by you for support purposes, and all such access is logged, audited, and time-limited.
Regular Audits
We conduct regular security audits, penetration testing, and code reviews to identify and address potential vulnerabilities. Our security team continuously monitors for suspicious activity and responds to potential threats in real-time.
5. Data Backup & Disaster Recovery
Automated Backups
We perform automated encrypted backups of all customer data multiple times daily. These backups are stored in geographically redundant locations to ensure data durability and availability even in the event of a catastrophic failure.
Point-in-Time Recovery
Our backup systems support point-in-time recovery, allowing us to restore your data to any specific moment within our retention window. This protects against accidental data deletion, corruption, or malicious activity.
Disaster Recovery
We maintain a comprehensive disaster recovery plan that includes failover systems across multiple data centers. In the event of a service disruption, we can restore operations with minimal downtime and zero data loss.
Your Responsibility
While we maintain robust backup systems, we recommend that you also maintain your own backups of critical business data. You can export your data at any time through our platform's export features.
6. Data Retention
Account Data
We retain your account information and business data for as long as your account remains active. You may delete your account at any time, which will initiate the data deletion process.
Post-Deletion
After you delete your account, we will permanently delete or anonymize your data within 90 days, except where retention is required by law (such as tax records, which may need to be retained for up to 7 years under Indian tax regulations).
Backup Retention
Data stored in our backup systems may persist for up to 90 days after deletion before being fully purged. During this period, the data is inaccessible and unusable.
Anonymized Data
We may retain anonymized, aggregated data indefinitely for analytical and statistical purposes. This data cannot be linked back to you or your business.
7. Your Rights
Right to Access
You have the right to request a copy of all personal data we hold about you. We will provide this information in a structured, commonly used, machine-readable format within 30 days of your request.
Right to Rectification
You have the right to correct any inaccurate or incomplete personal data we hold about you. You can update most information directly through your account settings.
Right to Deletion
You have the right to request the deletion of your personal data and business records. We will comply with your request subject to legal retention requirements.
Right to Data Portability
You have the right to export your data in a portable format. Our platform provides built-in export tools that allow you to download your business data at any time.
Right to Withdraw Consent
Where we rely on your consent to process your data, you have the right to withdraw that consent at any time. This does not affect the lawfulness of processing based on consent before its withdrawal.
Right to Object
You have the right to object to the processing of your personal data for direct marketing purposes or on grounds relating to your particular situation.
9. Children's Privacy
Age Restriction
Our services are not intended for individuals under the age of 18. We do not knowingly collect personal information from children. If we become aware that a child under 18 has provided us with personal information, we will take steps to delete such information promptly.
Parental Consent
If you are a parent or guardian and believe that your child has provided us with personal information without your consent, please contact us immediately so that we can take appropriate action.
10. Changes to This Policy
Policy Updates
We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or operational needs. We will notify you of any material changes via email and through a prominent notice on our platform.
Review Date
The most recent version of this policy will always be available at /privacy with the effective date clearly displayed. We encourage you to review this policy periodically.
Continued Use
Your continued use of our services after any changes to this policy constitutes your acceptance of the updated policy. If you do not agree with the changes, you may delete your account.
11. Contact Us
Data Protection Officer
If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact our Data Protection Officer.
Contact Information
Email: support@Bebsabanao.com. We will respond to all legitimate requests within 30 days.
Complaints
If you are not satisfied with our response, you have the right to lodge a complaint with your local data protection authority or the relevant Indian data protection authority under applicable law.