Privacy Policy

1. Who we are

Gaddibook is GST billing, inventory, accounting and business-management software for Indian businesses. Gaddibook is operated by Dilabar Hussain (Proprietor), Islampur, Uttar Dinajpur, West Bengal (“Gaddibook”, “we”, “us”).

This Privacy Policy explains how we collect, use, share, store and protect personal data, and the choices and rights you have. We wrote it to meet the Information Technology Act, 2000 and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, and the Digital Personal Data Protection Act, 2023 (“DPDP Act”) and the Digital Personal Data Protection Rules, 2025 as their provisions come into force.

2. What this policy covers

This policy applies when you visit gaddibook.com, sign up for or use the Gaddibook web app, the Gaddibook Android app, the myAttendance staff app, or a Gaddibook Online Store page, and when you contact us. It does not cover websites or services of other companies that we link to, or the separate privacy practices of the businesses that use Gaddibook.

3. Your data and your customers’ data

Gaddibook handles two kinds of personal data, and our role is different for each:

• Data about you, our user. When you create an account, log in, pay for a plan or contact us, we decide why and how that data is used. For this data we are the Data Fiduciary under the DPDP Act.
• Data you store about others. Your customers, suppliers, staff and online-store shoppers — names, mobile numbers, addresses, GSTINs, invoices, balances, salaries, attendance — is entered and controlled by your business. For this data your business is the Data Fiduciary and Gaddibook processes it only on your instructions, to provide the service to you. You are responsible for having a lawful basis (for example, the person’s consent or a legitimate business use) to store it and to contact those people through Gaddibook.

If you are a customer, supplier, staff member or shopper of a business that uses Gaddibook and have a question about your data, please contact that business first. We will help them answer you.

4. Data we collect

Data you give us

• Account and sign-in: your name, mobile number (verified with a one-time password, OTP), and optionally your email address.
• Business profile: business name, GSTIN, PAN, address, state, industry, business type, registration details, logo, signature image, bank account and UPI details you add to show on invoices, and the software you used before (asked at signup).
• Business records: everything you create in Gaddibook — invoices, quotations, challans, purchases, expenses, payments, items, stock, parties, ledgers, reports, notes and custom fields.
• Team members: names and mobile numbers of users you invite and the roles you give them.
• Staff and payroll (if you use Staff Attendance & Payroll): staff names, mobile numbers, salary details, attendance and leave records.
• Files you upload: bill photos or PDFs for AI Autofill, bank statements for reconciliation, item images and logos.
• Payments to us: the plan you buy and the payment reference returned by our payment gateway. We do not receive or store your card number, UPI PIN, CVV or net-banking password.
• Support and enquiries: what you send us through the contact form, email, WhatsApp or calls.

Data collected automatically

• Devices and sessions: the browser or app you log in from, device type, IP address and login times, so you can see and sign out your logged-in devices and so we can enforce device limits and detect misuse.
• Activity records: an audit trail of who created, edited, cancelled or deleted a document in your business, kept for your own records and for security.
• Technical logs: server logs with IP address, time, requested page and errors, used to run, secure and debug the service.
• Cookies and storage: see our Cookie Policy.

Data collected only with permission on your device

• Camera: to scan barcodes, log in to the web app by QR code, or photograph a bill — only when you open those features.
• Location (myAttendance staff app): if an employer turns on location for check-in, the staff app records the GPS location at check-in and check-out and, while a staff member is checked in, may share their live location with the employer. The staff member’s phone asks for location permission first, and the employer must tell their staff about it (see our Acceptable Use Policy).

We do not ask for sensitive personal data such as passwords of other services, biometric data, health records, sexual orientation or medical history. Some financial information (bank account details you add to invoices) is treated as sensitive personal data under the IT Rules, 2011 and protected accordingly.

5. How we use it

• To create and secure your account, verify your mobile number with OTP, and keep you logged in on the devices you choose.
• To provide Gaddibook: create and print documents, keep your books and stock, generate reports and GST return files, sync between web and mobile, and back up your data.
• To send the messages you ask for: invoices, payment reminders and receipts to your customers on WhatsApp or SMS, OTPs to you, and alerts about your own business.
• To read a bill you choose to scan (AI Autofill) and fill its details into a purchase or expense for you to review.
• To process payments for plans, add-ons and messaging credits, issue invoices to you, and manage trials, coupons and referrals.
• To give support, answer enquiries and fix problems.
• To keep Gaddibook safe: prevent fraud and abuse, enforce our Terms, and investigate security incidents.
• To meet legal obligations, such as tax and accounting records for our own sales and lawful requests from authorities.
• To tell you about important changes to the service and, if you agree, about new features and offers (you can opt out at any time).
• To improve Gaddibook using aggregated statistics that do not identify you or your business.

We do not sell your data, and we do not use your business records or your customers’ data to advertise to them or to anyone else.

6. Consent and legal basis

We process your personal data on the basis of the consent you give when you sign up and use features (for example, location or AI Autofill), and for the “legitimate uses” the DPDP Act allows — such as providing a service you asked for, meeting a legal obligation, or responding to an emergency. You can withdraw consent at any time (see Your rights); withdrawing it does not affect processing already done, and some features may stop working without it.

7. Who we share it with

We share personal data only as needed to run the service, with companies that process it for us under contracts that require them to protect it, or when the law requires it:

8. Data stored outside India

Some of our providers (for example Meta, Anthropic, Google, Sentry and Ahrefs) may process data on servers outside India. The DPDP Act allows this except to countries the Government of India restricts by notification; we will stop or change such transfers if a destination is restricted. We choose providers that protect data with security measures at least as strong as ours.

9. How long we keep it

• Account and business records: for as long as your account is active, so your books stay complete. Many businesses must keep accounts and GST records for at least six years; Gaddibook keeps them available to you while you remain a user.
• After you delete your account: we delete or anonymise your data within 30 days of confirming the request; copies in encrypted backups are overwritten within a further 90 days. See Delete your account.
• Our own billing records (invoices we issued you, payment references) are kept for as long as tax and company law requires, usually eight years.
• Security and server logs are kept for 180 days, as required by CERT-In directions, and then deleted.
• OTP codes expire within minutes and are not kept beyond what is needed to prevent misuse.

We may keep data longer only if the law requires it or to deal with a dispute, fraud or legal claim, and only for that purpose.

10. How we protect it

• All connections to Gaddibook use HTTPS (TLS) encryption.
• Sign-in is by OTP to your mobile number; you can see every logged-in device and sign it out, and accounts are limited to a set number of devices.
• Access inside a business is controlled by roles you assign, and an audit trail records changes to documents.
• Secrets such as messaging-account tokens are stored encrypted; card and UPI details never reach our servers.
• Our team accesses customer data only when needed to provide support or keep the service running.
• We keep backups of the database to help recover your data after a failure.

No system is completely secure. If a personal data breach happens, we will inform the affected users and the Data Protection Board of India as the DPDP Rules require, and report cyber-security incidents to CERT-In as Indian law requires, and we will tell you what happened and what you can do.

11. Your rights

Subject to the law, you have the right to:

• Access a summary of the personal data we process about you and the providers we share it with;
• Correct and update inaccurate or incomplete data — most of it you can edit yourself in Settings;
• Erase your data by deleting your account (see Delete your account), unless we must keep it by law;
• Withdraw consent you gave us, for example for marketing messages or location;
• Download your invoices, registers and reports as Excel or PDF, and GST returns as JSON, from the app at any time;
• Nominate another person to exercise your rights if you die or become incapable;
• Raise a grievance with our Grievance Officer, and if unresolved, approach the Data Protection Board of India.

To use these rights, write to support@gaddibook.com from your registered email or mention your registered mobile number. We may verify your identity by OTP before acting, and we respond within the time set out on our Grievance Redressal page.

12. Children

Gaddibook is meant for businesses and is not for anyone under 18. We do not knowingly collect personal data from children. If you believe a child has given us personal data, contact us and we will delete it.

13. Messages from us

We send service messages you cannot opt out of while you use Gaddibook — OTPs, payment receipts, plan expiry notices and security alerts. With your consent we may also send product updates and offers by WhatsApp, SMS or email; you can stop them at any time by replying STOP where offered, using the unsubscribe link, or writing to us.

14. Changes to this policy

We may update this policy as Gaddibook or the law changes. The “Last updated” date at the top shows the latest version. If a change materially affects how we use your personal data, we will tell you in the app or by message before it takes effect.

15. Contact and grievances

For any question or complaint about this policy or your personal data:

• Grievance Officer: Dilabar Hussain
• Email: support@gaddibook.com
• Address: Dilabar Hussain (Proprietor), Islampur, Uttar Dinajpur, West Bengal

See Grievance Redressal for how we handle complaints and how quickly we respond.