Privacy notice

Version 2026-10-12

This Privacy notice explains what personal data Deeva Payon Global Private Limited ("the Company", "we", "us") collects when you use the ERPSoft software and the website at erpsoft.cloud (together, "the Service"), why we collect it, how long we keep it and the choices you have. We process personal data in line with the Information Technology Act, 2000, the rules made under it, and the Digital Personal Data Protection Act, 2023.

1. Who is responsible for your data

For your own personal data (the details you give us to register and run your account) the Company is the data fiduciary. For the data of your customers, suppliers, patients, students, members or other people that you enter into the Service, your business is the data fiduciary and we process that data only on your instructions, as a data processor, to provide the Service to you.

2. What we collect

When you register

• Your name, mobile number, email address, state and city.
• The kind of business you run and the roles your business plays (for example retailer or wholesaler).
• The password you set (stored only as a one-way hash, never as plain text), and the time and version of the Terms and this notice you accepted.

When you use the Service

• Your business profile: business name, address, GST registration details, bank and UPI details you choose to print on documents, and logo.
• Your business data: items, parties, invoices, purchases, payments, stock, staff names and contact details, and everything else you enter.
• Plan and payment records: the plan you chose, the dates of your trial and billing cycles, the status of your autopay and the amounts collected. Card numbers, UPI PINs and bank credentials are handled by Cashfree and are never stored by us.
• Technical details needed for security and support: IP address, browser and device type, sign-in times, the pages you open and errors that occur.
• Messages you send us by email, WhatsApp or the enquiry form, with your contact details.

Cookies

The Service uses a session cookie that keeps you signed in and protects forms against forgery; it is essential and cannot be switched off. The website may also use Google Analytics or similar measurement if we switch it on; such cookies help us understand how the website is used and do not identify you to us by name.

3. Why we use your data and on what basis

• To provide the Service (performance of our contract with you): creating your account, verifying your email or mobile number with a one-time code, setting up the modules for your kind of business, running your plan and autopay, sending documents you ask us to send, and giving support.
• To keep the Service secure (our legitimate interest and legal duty): detecting fraud and abuse, limiting sign-in attempts, keeping an audit log of important actions, and keeping backups.
• To meet legal duties: keeping payment and tax records for the periods the law requires, and answering lawful requests from authorities.
• To improve the Service (our legitimate interest): looking at how features are used in aggregated, anonymised form.
• To send you service messages: one-time codes, sign-in codes, account notices, payment notices and important changes to the Service or these terms. These are not marketing and are sent as long as you have an account.
• Marketing (with your consent only): we send promotional messages only if you ask for them, and every such message carries a way to stop them.

4. Automated setup during registration

The trade description you type and the roles you choose are processed automatically to recommend and switch on the modules your business starts with. To do this they may be sent to an automated classification service. Your name, mobile number and email address are never sent to it. No decision with a legal or similarly significant effect on you is made this way, and you can change every module yourself afterwards.

5. Who we share data with

We do not sell personal data. We share it only with:

• Cashfree Payments India Private Limited, to collect your plan payments and run autopay, under its own privacy policy;
• email, SMS and WhatsApp providers, to deliver one-time codes, sign-in codes and the documents you choose to send; when you choose WhatsApp, your mobile number and the message are passed to WhatsApp (Meta);
• hosting and infrastructure providers that store and run the Service under contracts that require them to protect the data;
• the automated classification service described in section 4, which receives only the trade description and roles;
• professional advisers, auditors and authorities, where the law requires it or where it is needed to protect our rights, your safety or the safety of others;
• a successor of our business, if the Service is sold or merged, under the same protections.

People you share a document with (for example a customer who opens an invoice link you sent) see only that document.

6. How long we keep data

• Account and business data: for as long as your account is open, and for 90 days after it is closed so that you can ask for an export; after that it may be deleted. Copies in routine backups are deleted on their own cycle.
• Payment and plan records: for the period required by Indian tax and company law (generally eight years).
• One-time codes and sign-in codes: a few minutes, then only a record that a code was sent and whether it was used.
• Audit and security logs: up to 12 months.
• Unfinished registrations: deleted within 7 days if not verified.
• Enquiries sent through the website: until the enquiry is closed, and up to 12 months after that.

7. How we protect data

One-time codes and passwords are stored only as salted hashes. Saved secrets such as API keys are stored encrypted. Connections to the Service are encrypted (HTTPS). Access to personal data inside the Company is limited to staff who need it for support or operations, and customer contact details are masked in our admin panel unless a staff member deliberately reveals them, which is recorded in an audit log. We keep regular backups. No system is perfectly secure; if a breach affects your personal data we will tell you and the authorities as the law requires.

8. Your rights and choices

Subject to the law, you may:

• see and correct your details: most can be changed yourself under Account and Business & GST inside the Service; for anything else, write to us;
• export your business data from the Service at any time;
• withdraw consent for marketing at any time;
• close your account and ask for your personal data to be erased, except for records we must keep by law;
• nominate another person to exercise these rights for you if you are unable to;
• complain to our Grievance Officer (section 11) and, if you are not satisfied, to the Data Protection Board of India.

We answer requests within 30 days. We may need to verify your identity first, and we will never ask for your password or a one-time code.

9. Children

The Service is for business use by adults. We do not knowingly collect personal data from anyone under 18. If you believe a child has registered, write to us and we will remove the account.

10. Changes to this notice

When this notice changes, the version shown at the top changes. New registrations are asked to accept the current version, and existing users are told about material changes inside the Service or by email.

11. Contact and Grievance Officer

ERPSoft is a unit of Deeva Payon Global Private Limited.

Grievance Officer: support@erpsoft.cloud · Phone: +91 97859 09785 · Registered office: Office No. O-414, 4th Floor, Krish Square, Plot No. 2, Bhagat Singh Colony, Bhiwadi, Rajasthan 301019

We acknowledge every grievance within 48 hours and aim to resolve it within 30 days.