Privacy Policy

1. Introduction

DukaanFlow ("we", "us", "our") is operated by DukaanFlow ("Company"). This Privacy Policy explains what information we collect when you use our inventory, sales, credit (udhar), and billing management application (the "Service"), how we use it, and the choices you have.

2. Information We Collect

• Account information: name, email address, password (stored in encrypted/hashed form), and role (vendor or client).
• Shop information: shop name, address, phone number, and GST number, if provided.
• Business data you enter: inventory items, sales records, expenses, and customer credit (udhar) entries.
• Payment information: when you subscribe to a paid plan, payments are processed by Razorpay. We do not store your card, UPI, or bank details ourselves — Razorpay handles this in line with its own security standards.
• Technical information: IP address, browser type, and device information, collected automatically for security (e.g. rate-limiting) and troubleshooting purposes.

3. How We Use Your Information

• To provide, operate, and maintain the Service.
• To process subscription payments via Razorpay.
• To send you service-related communications (e.g. payment confirmations, security alerts, password reset emails).
• To detect, prevent, and address fraud or abuse.
• To comply with applicable legal obligations.

We do not sell your personal information or your customers' udhar/credit data to third parties.

4. Data Storage & Security

Your data is stored using MongoDB Atlas, a third-party cloud database provider. Passwords are hashed using industry-standard methods (bcrypt) and are never stored or transmitted in plain text. Access to your shop's data is restricted to your account and, where applicable, staff you explicitly grant access to.

5. Third-Party Service Providers

We rely on the following third parties to operate the Service:

• Razorpay — payment processing for subscriptions.
• MongoDB Atlas — database hosting.
• Brevo — transactional email delivery (e.g. password reset emails).

Each of these providers has its own privacy policy governing how they handle data on our behalf.

6. Data Retention

We retain your account and business data for as long as your account is active. If you close your account, we will delete or anonymize your personal data within a reasonable period, except where retention is required by law (e.g. financial records).

7. Your Rights

You may request access to, correction of, or deletion of your personal data by contacting us at dukaanflowhq@gmail.com. Depending on your location, you may have additional rights under applicable data protection law, including India's Digital Personal Data Protection Act, 2023.

8. Grievance Officer

In accordance with the Information Technology Act, 2000 and rules made thereunder, the contact details of the Grievance Officer are:

Grievance Officer, DukaanFlow
Indore, Madhya Pradesh, India
Email: dukaanflowhq@gmail.com

9. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated policy on this page with a new "Last updated" date.

10. Contact Us

If you have questions about this Privacy Policy, contact us at dukaanflowhq@gmail.com.