This policy explains how Eklavya Jha — Web Dev handles information through Vasudha The Manager. Questions and requests can be sent to eklavyaprivate22@gmail.com.
1. Information the application handles
Account information includes email, password hashes, roles, membership and session/security records. Firm information may include business names, contacts, invoice and voucher details, ledger entries, GSTIN, PAN, bank details, payment follow-ups and uploaded files. The information supplied depends on your firm’s use of the application.
Technical records can include request times, IP addresses, browser information, errors and activity history. Do not put passwords, verification codes or unnecessary personal information into business notes or uploads.
2. Why information is used
Information is used to authenticate accounts, apply permissions, maintain business records, prepare reports and exports, process authorized imports, deliver account emails and investigate operational or security problems. Firm data is not sold or used by this application for advertising or training AI models.
3. Who can access firm records
Access is controlled by active firm membership and role permissions. Authorized administrators manage those permissions. The operator may need access to technical systems for maintenance and support; provide only the minimum information needed when requesting help.
4. Hosting and service providers
The deployment uses Vercel for the website, Render for the backend and MongoDB Atlas for stored records. Upstash Redis supports temporary verification codes and configured cache services. A configured SMTP email relay delivers transactional account emails. Google Drive can receive backups when the owner enables the supported backup configuration. Google Fonts may receive browser requests when the workspace loads its fonts.
Optional Telegram bots send administrator alerts and, when configured and authorized, firm names and financial summaries to chosen chats. Administrators should select trusted recipients and review the enabled notifications.
These providers process information according to their services and policies. Hosting region, backups and provider logs depend on deployment configuration; this policy does not promise that all information stays in one country.
5. Account email delivery and Google access
The configured SMTP relay receives the recipient address and transactional message to deliver account verification, sign-in, password-reset and security emails. The application generates verification codes and stores only their hashes in temporary Redis state. The SMTP relay does not generate or validate codes and cannot authorize account access.
Receiving an email does not grant the application access to the recipient's email account. Google access is used only for the separately configured backup function, not for email delivery, advertising, sale or unrelated profiling. Revoking Google access can interrupt a Google-based backup; SMTP delivery does not require Google OAuth.
6. Cookies and browser storage
Essential cookies support session refresh and, for eligible accounts that opt in, remembered-browser verification. Sessions expire after four hours; eligible browser trust lasts up to four months and can be invalidated by security changes or explicit revocation. A remembered browser still needs the account password for a new session.
The workspace also uses browser storage for locally saved voucher drafts and pending job/request identifiers. Avoid shared browser profiles. The public pages add no advertising cookies or analytics trackers, and they do not request a login refresh in the background.
7. Protection and its limits
HTTPS, password hashing, role checks, request limits and encryption of selected sensitive fields help protect information. Protected export fields are masked where implemented. The dedicated GSTR-1 workbook has an approved GSTIN disclosure for users with the required report/export permissions. No system can guarantee absolute security or correctness.
8. Retention and deletion
Business records and append-only audit history are retained to support accounting and traceability. Account profile deletion removes the personal account fields covered by that flow and revokes access; it does not erase the firm’s financial history or existing audit records. Exported copies, owner-managed backups and provider retention may continue separately.
There is no universal automatic deletion deadline for business history in the current application. Ask the operator about a specific retention, access or removal request. The firm must consider its applicable accounting and legal obligations before authorizing removal.
9. Ownership, exports and requests
The firm retains ownership of its business records. Authorized users can export supported reports and backups. Contact eklavyaprivate22@gmail.com to request help with access, correction, export or account deletion. Identity and authority may need to be established through the existing account/owner process before a request is acted on.
10. Policy changes
This page shows its update date. Material changes to data handling should be reflected here. Contact the operator if you need clarification before entering data.