Privacy Policy
Last updated September 2026. This is the whole of it — there is no second document.
The short version
We hold your shop's records so the app can show them back to you. We do not sell them, we do not advertise against them, and we do not use them to train anything. You can export everything at any time, and you can delete everything at any time.
Who is responsible for what
For your account — your name, email and phone number — we are the Data Fiduciary under the Digital Personal Data Protection Act 2023.
For your customers' details — the names, numbers and visit history you enter — you are the Data Fiduciary and we are your Data Processor. We hold that data on your instructions and do nothing else with it. If you teach or coach, some of those people may be children; their data is your responsibility as fiduciary and ours as processor, and the Data Processing Addendum says so explicitly.
What we collect, and why
| Your account Name, email, password, phone |
To sign you in and to contact you about your account. Nothing else. |
| Your shop Business name, address, GSTIN, UPI ID, logo |
To print correct bills and to let your customers pay you directly. |
| Your records Customers, bills, payments, bookings, staff |
To be the app. This is the data you came here to keep. |
| Your device Model, app version, push token |
To send notifications you asked for and to tell you when an update is required. |
| Diagnostics Crash reports and error logs |
To fix what breaks. Personal details are stripped before these are stored. |
We ask for nothing we do not use. There is no advertising identifier, no location tracking and no analytics on what you tap.
How long we keep things
These periods are enforced by a job that runs every night — they are not aspirations.
| Bills, payments and customers | For as long as your account is open. They are your business records, and Indian tax law expects you to be able to produce them. |
| Sent messages | 2 years |
| Change history (who did what) | 7 years, matching the GST record-keeping period |
| Expired sign-in tokens | 90 days |
| Payment provider webhooks | 90 days |
| Exported files | 7 days, then the file is deleted from our servers |
Your rights
Get a copy. Settings → Reports → Export everything. You get a ZIP of spreadsheets covering every record we hold, by email, within minutes.
Correct something. Every field in the app is editable by you.
Delete everything. Settings → Account → Delete account. We wait 30 days in case you change your mind — you can cancel at any point in that window — and then the data is permanently removed. See how to delete your account.
Complain. To our Grievance Officer below, and after that to the Data Protection Board of India.
Who else touches your data
Companies that process data on our behalf, and nothing beyond that.
| Company | What for | Where |
|---|---|---|
| Hetzner | Application hosting and database | Germany |
| Cloudflare R2 | Logo and export file storage | European Union |
| Amazon SES | Transactional email | India (ap-south-1) |
| Razorpay | Our own licence billing | India |
| Expo | Push notification delivery | United States |
We do not sell your data, share it with advertisers, or use it to train machine learning models. Not now and not as a change of policy later — the day that changed we would have to tell you and ask.
If something goes wrong
If your data is exposed, we will tell you and the Data Protection Board within 72 hours of learning about it, with what happened, what was affected and what to do.
Grievance Officer
Grievance Officer
support@applightinfotech.com
A person reads this address. We answer within 7 days.
Parchi