Privacy Policy

1. Who we are, and what this covers

Invovibe, at Bank Colony, Khushalpur, Moradabad, Uttar Pradesh 244001, India, GSTIN 09AEQPT4298B1ZW, is the Data Fiduciary for the personal data described here, in the sense the Digital Personal Data Protection Act 2023 gives that term.

This policy covers the Invovibe web application and this website. It is written for two kinds of person: the people who hold and use an Invovibe account, and the people whose details our customers enter into it — their customers, employees and vendors.

For data our customers enter about other people, the customer decides what is collected and why; we process it on their instructions. If your details are in an Invovibe account and you want them changed or removed, ask the organisation that holds the account. We will help them do it.

2. What we collect

Account data. Name, email address, phone number where you give one, the organisation you belong to, your role in it, and the password hash held by our authentication provider. We never see your password.

Business and tax data you enter. Customers, vendors, employees, invoices, quotations, projects, expenses, bank statement rows and the documents you attach. This includes GSTINs, PANs where you enter them, addresses, bank account details of your employees where you record them, and the amounts on every document.

Payment data. The plan you bought, the amount, the date, the gateway's payment and order identifiers, and the status. Card numbers, UPI credentials and net-banking credentials are entered on the payment gateway's own page and are never received or stored by us.

Technical data. IP address, browser and device type, and timestamps of sign-in and of actions taken in the application, kept as part of ordinary operation and security.

We do not run advertising, we do not build profiles for marketing, and we do not sell personal data to anybody.

3. Why we process it, and on what basis

To provide the Service you asked for — creating your account, raising your documents, computing tax, assembling your return data, and showing you your own records. Under the DPDP Act this is processing for the specified purpose for which you gave consent when you opened the account.

To take payment and account for it, including issuing the tax invoice the law requires us to issue for a supply we make to you.

To meet legal obligations — the record-keeping the CGST Act, the Income-tax Act and the Companies Act place on us, and any response we are required to make to a lawful demand.

To keep the Service secure and working — detecting misuse, diagnosing failures, and keeping the audit trail that tells us what happened when something goes wrong.

We do not use your business data to train models, and we do not use it for any purpose other than those above without asking you first.

4. Consent, and how to withdraw it

Where we rely on consent, we ask for it in plain language before the processing starts, and we record which version of this notice you were shown and when.

You can withdraw consent at any time, with the same ease as you gave it, by writing to support@invovibe.online or from the privacy controls in your account settings. Withdrawal is not retrospective: it does not make lawful processing already done unlawful.

Withdrawing consent for processing that the Service needs in order to work will mean we can no longer provide it, and the account will be closed. Withdrawal does not erase the records we are required by tax law to keep — see the retention section, which sets out exactly which records those are and for how long.

5. Retention, and what tax law requires

We keep your account data for as long as the account is open.

Books of account and the documents behind them are kept for 72 months from the due date of furnishing the annual return for the financial year they relate to, which is what Section 36 of the CGST Act 2017 requires of a registered person. Where a proceeding, appeal or investigation is pending, the same section requires those records to be kept for one year after it is finally disposed of, or the 72 months, whichever is later.

Records relevant to income tax are kept for six years from the end of the relevant assessment year, and company records for the period the Companies Act 2013 requires.

For 90 days after an account closes, your data remains available for export on request. After that we delete or anonymise everything except the records named above, which are kept in restricted storage for their statutory period and used for nothing else.

This is the point where the law and a request to be forgotten genuinely conflict, and we would rather say so plainly than imply we can erase what we are required to keep.

6. Your rights

Access. You may ask for a summary of the personal data we hold about you, the processing we have done with it, and the identities of anyone we have shared it with.

Correction and completion. You may ask us to correct inaccurate data, complete incomplete data and update what has changed. Most of it you can edit yourself in the application.

Erasure. You may ask us to erase personal data where we no longer need it for the purpose it was collected for and no law requires us to keep it.

Nomination. You may nominate another person to exercise these rights on your behalf if you die or become incapable of exercising them, as Section 14 of the DPDP Act allows.

Grievance. You may complain to us, and if we do not resolve it you may complain to the Data Protection Board of India.

Write to support@invovibe.online to exercise any of these. We will verify that the request comes from you or your nominee before acting on it, and we will answer within 30 days.

7. Grievance redressal

If something about your data has gone wrong, write to support@invovibe.online with the account, what happened and what you want done.

We acknowledge within 48 hours and aim to resolve within 30 days, which is what the Consumer Protection (E-Commerce) Rules 2020 and the DPDP Act's grievance provisions require of us.

If you are not satisfied with our answer, you may take the matter to the Data Protection Board of India under Section 13(3) of the DPDP Act 2023.

8. Where your data is held, and who else touches it

Your data is held in Google Cloud infrastructure through Firebase, and is processed there and on the devices you sign in from.

Our processors, and what each one does: Google LLC and Google Cloud India — hosting, database and authentication; Razorpay Software Private Limited — payments, which receives the payment details you enter on its page and the amount, and returns the result to us. We share personal data with nobody else except where the law compels us.

Each processor is bound to process the data only on our instructions and to keep it secure. We remain answerable to you for what they do with it.

Where data is transferred or stored outside India, it is done in accordance with Section 16 of the DPDP Act 2023 and to a country the Central Government has not restricted.

9. Security

Data is encrypted in transit using TLS, and encrypted at rest by the storage provider.

Access to production data by our people is limited to what a task requires and is logged.

Authentication is handled by Firebase Authentication; we hold no password of yours in any readable form.

If a personal data breach occurs, we will report it to the Data Protection Board of India and inform every affected Data Principal, in the form and within the time the DPDP Act and its rules require. We will tell you what was affected and what we have done, not merely that something happened.

10. Cookies and similar technology

We use only what the Service needs to work: a session cookie and local storage that keep you signed in and remember your preferences on this device.

We run no advertising cookies, no third-party trackers and no cross-site profiling. There is nothing here to opt out of, which is why you are not asked to dismiss a consent banner on every visit.

Clearing your browser's storage signs you out and removes these.

11. Children's data

The Service is for businesses and is not directed at children. We do not knowingly open an account for anyone under 18.

Where we become aware that we hold the personal data of a child without the verifiable consent of a parent or lawful guardian, we delete it. Section 9 of the DPDP Act 2023 also forbids tracking, behavioural monitoring and targeted advertising directed at children, none of which we do to anybody.

If you believe a child's data has reached us, write to support@invovibe.online and we will remove it.

12. Changes to this policy

The version and the date it took effect are shown at the top of this page. The version number is what we record against your consent, so that it is always possible to say which notice you actually agreed to.

Previous versions are available on request from support@invovibe.online.

Where a change materially affects how we process your personal data, we will give notice in the Service at least 15 days before it takes effect, and ask for fresh consent where the law requires it.