Privacy Policy

Hisab Expert (“we”, “us”, “our”) is a business accounting and bookkeeping application designed for small businesses, shopkeepers, and traders across India. We are committed to protecting your privacy and handling your personal data responsibly, transparently, and in accordance with applicable laws - including India's Digital Personal Data Protection Act, 2023 (DPDP Act), the Information Technology Act, 2000, and applicable principles of the General Data Protection Regulation (GDPR) where relevant.

This Privacy Policy explains what information we collect, why we collect it, how we store and protect it, which third-party services we use, and what rights you have over your data. It applies to the Hisab Expert Android application, our website at hisabexpert.com, and any related services we provide.

For the purposes of applicable data protection laws, the data controller responsible for your personal data is:

We collect only the minimum data necessary to deliver the features of Hisab Expert. We never collect data silently - every category below is directly tied to a feature you actively use.

3.1 Personal Information You Provide Directly

3.2 Business Data You Create

All business records you create in the app belong entirely to you. This data is stored only on your device by default, encrypted with AES-256. It never leaves your device unless you explicitly enable cloud sync in Settings.

• Transaction records - income, expenses, amounts, categories, dates, notes, payment method
• Inventory data - product names, prices, stock quantities, units, minimum stock alert thresholds
• Customer records - customer names, phone numbers, credit balances, payment history
• Ledger - customer subscriptions, daily delivery records, payment receipts
• Invoice history - PDF invoices generated within the app

3.3 Data Collected Through Specific App Features

3.4 Automatically Collected Technical Data

• Device model and Android OS version (for compatibility diagnostics)
• App version (for update and bug tracking)
• Anonymised feature usage statistics - which screens are visited (does not include transaction amounts, customer names, or any business data)

We use the information we collect for the following purposes. Under data protection law, we must have a legal basis for each processing activity:

Hisab Expert integrates the following third-party services to deliver specific features. Each service operates under its own Terms of Service and Privacy Policy. We share only the minimum data necessary with each service. All integrations are optional - the core bookkeeping features work without them.

We do not use Google Analytics, Facebook Pixel, advertising SDKs, or any data broker integrations.

Because UPI notification reading is a sensitive capability, we are providing this dedicated section with full transparency about exactly how it works.

All permissions are optional - the core bookkeeping features work without granting any of the below. You can revoke any permission at any time from Android Settings → Apps → Hisab Expert → Permissions without losing your existing business data.

8.1 Local Storage (Default)

All your business data is stored on your device using Hive, an encrypted local database. Data is encrypted with AES-256 using a key stored in the Android Keystore - a hardware-backed secure storage system. The encryption key never leaves your device and cannot be accessed by us or anyone else.

8.2 Cloud Storage (Optional)

If you enable cloud sync, your data is transmitted over TLS 1.3 and stored in Supabase (backed by AWS infrastructure). Each record is associated with your unique account ID. Your data is logically isolated from other users' data and can only be accessed with valid authentication credentials.

8.3 Security Measures

• Encryption at rest: AES-256 (local device), database-level encryption (cloud)
• Encryption in transit: TLS 1.3 for all server communications
• Authentication: PIN hashed with bcrypt (cost factor 10) + optional biometric unlock
• App lock: Automatically locks after 30 seconds of background activity
• No shared passwords: OTP-only login - no passwords are ever created or stored
• Reinstall protection: We detect tampered or restored authentication state on reinstall and prompt re-verification

8.4 Data Breach Response

In the event of a data breach affecting your personal data, we will notify you within 72 hours of becoming aware of the breach, as required by applicable data protection laws. We will inform you of the nature of the breach, what data was affected, and what steps we are taking to address it.

We do not sell, rent, or commercially share your personal data with any third party. We may disclose information only in the following limited circumstances:

• With your explicit consent - for example, when you enable cloud sync, share an invoice, or initiate a WhatsApp message
• With third-party service providers (Section 5) - strictly to the extent necessary to deliver the stated feature, subject to contractual data processing agreements
• Legal requirements - if required by a valid court order, government authority, or applicable law, we will disclose the minimum information required and notify you where legally permitted
• Business transfer - if Hisab Expert is acquired or merged, your data may be transferred as part of that transaction. We will notify you before any such transfer, and you retain the right to delete your data

Under India's Digital Personal Data Protection Act, 2023 (DPDP Act) and applicable international data protection principles, you have the following rights:

We will respond to all rights requests within 30 days. For complex requests, we may extend this by an additional 30 days with prior notice.

To exercise any of these rights, visit our Data Deletion page or email us at privacy@hisabexpert.com.

Your data is primarily stored on your device in India. When cloud sync is enabled, or when you use features such as voice input, OCR scanning, or OTP login, some data is transmitted to servers operated by the third-party services listed in Section 5. These servers may be located outside India, including in the United States.

All such transmissions occur over TLS 1.3 encryption. The services we use - Firebase (Google), Supabase (AWS), Microsoft Azure, and Google Speech - maintain appropriate data protection standards and are bound by contractual data processing terms that require them to protect your data to an equivalent standard.

Hisab Expert is a business accounting tool intended exclusively for adults aged 18 years and above. We do not knowingly collect, solicit, or process personal data from persons under 18 years of age.

If you are a parent or guardian and believe your child has created an account or provided us with personal information, please contact us immediately at privacy@hisabexpert.com. We will verify the report and delete the data promptly, without charge.

We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or app features. When we make material changes, we will:

• Update the “Last Updated” date at the top of this page
• Notify you via in-app notification at your next app launch
• For significant changes, display the updated policy and ask you to review it before continuing

Your continued use of Hisab Expert after a policy update constitutes your acceptance of the revised policy. If you do not agree, you may delete your account (Settings → Account → Delete Account) and stop using the app.

For any questions, concerns, or requests regarding this Privacy Policy or your personal data, please contact us through any of the following channels:

This Privacy Policy was written in plain language to ensure you fully understand how Hisab Expert handles your data. If any section is unclear, please email us at privacy@hisabexpert.com and we will explain it to you directly.