Privacy Policy

• Account information — name, email address, and password (stored as a hash, never in plain text) when you sign up
• Business information — company details, GSTIN, bank details, and the invoices, parties, items, and other records you create in the Service
• Usage data — log data such as IP address and timestamps, used for security purposes including rate-limiting abusive login and signup attempts
• Contact form submissions — name, email, phone number, and message content you submit through our Contact page

We use the information we collect to:

• Provide, operate, and maintain the Service
• Process GST compliance filings (e-way bills and e-invoices) on your behalf, via our third-party API provider, when you choose to generate them
• Send transactional emails such as account approval notices and password reset links
• Respond to support requests submitted via the Contact page
• Detect, prevent, and address fraud, abuse, and security issues

We do not sell your personal or business data. We share data only with the following categories of service providers, each solely for the purpose listed:

• GST compliance API providers (our government-authorized e-way bill and e-invoice (GSP) integration partners) — solely to generate and fetch the e-way bills and e-invoices you request
• Payment processor (our Razorpay or PayU-powered checkout) — solely to process subscription payments and issue receipts
• Email and SMS delivery providers — solely to send transactional emails and alerts you have opted into
• Cloud infrastructure provider — hosts the servers and database the Service runs on, under a standard hosting agreement
• Law enforcement or regulators — only where required by applicable law, a valid legal process, or to protect the rights and safety of ClayBill or its users

Every third party listed above is contractually restricted to using your data only to provide the specific service we've engaged them for, and not for their own marketing or any unrelated purpose.

We retain your account and business data for as long as your account is active, and for a reasonable period afterward to comply with legal, tax, and accounting obligations. Database backups are retained on a rolling basis and are automatically pruned after 14 days.

We use industry-standard measures to protect your data, including password hashing, encryption of sensitive credentials at rest, and access controls limiting who can view your company's data. No method of transmission or storage is 100% secure, and we cannot guarantee absolute security.

Depending on your relationship with us, you have the right to:

• Access — request a copy of the personal data we hold about you
• Correct — ask us to fix inaccurate or incomplete information
• Erase — request deletion of your personal data, subject to our legal and tax retention obligations
• Restrict or object — ask us to limit certain processing, such as marketing communications
• Data portability — request an export of your data in a common format (invoices, party ledgers, and reports can also be self-exported from within the Service at any time)
• Withdraw consent — where processing is based on consent, withdraw it at any time without affecting processing already carried out

To exercise any of these rights, contact us at the email below. We will respond within a reasonable time and may need to verify your identity before acting on a request. Some information may need to be retained to comply with legal, tax, or accounting obligations even after a deletion request.

The Service is a business tool intended for use by adults acting on behalf of a company and is not directed at, or knowingly used to collect information from, individuals under 18 years of age. If you believe a minor has provided us with personal information, contact us and we will delete it.

Your data is stored and processed on cloud infrastructure used to run the Service. We do not knowingly transfer your personal data outside India for processing, except where a third-party service provider listed in “Data Sharing” above requires it to deliver the specific feature you've requested (for example, an email delivery provider routing a transactional email). Any such transfer is governed by that provider's own security and privacy commitments.

We use essential cookies to keep you signed in and to maintain your session. We do not use third-party advertising or tracking cookies.

In accordance with the Information Technology Act, 2000 and the rules made thereunder, the Grievance Officer for ClayBill (a product of Anha Labs LLP) can be reached at claybill.admin@gmail.com for any complaints or concerns regarding this Privacy Policy or the handling of your personal data. We aim to acknowledge grievances within 24 hours and resolve them within 15 days, as required by law.

We may update this Privacy Policy from time to time. We will post any changes on this page with a revised “Last updated” date. Where a change is material, we will make reasonable efforts to notify active account holders by email before it takes effect.

Questions about this Privacy Policy can be sent to claybill.admin@gmail.com or via our Contact page.