Privacy Policy

This Privacy Policy explains what Zuditt AI Innovations LLP ("Zuditt", "we", "us") collects through Zuditt Invoice ("the Service"), why, and what rights you have over it. It should be read alongside our Terms of Service.

1. Two kinds of personal data

This policy covers your data as a Zuditt Invoice account holder (your name, email, business details, billing). It also covers your customers' data — the names, emails, phone numbers, and addresses you enter while creating invoices and customer records. For that second category, you are the data fiduciary/controller and we are only the processor: you decide whose data to enter and why, you're responsible for having a lawful basis to hold it, and requests from your customers about their own data should go to you, not us — we have no direct relationship with them and no way to independently verify or act on their instructions.

2. What we collect

• Account data: name and email, via Supabase Auth (magic-link/OTP sign-in — we don't store passwords ourselves).
• Business profile: business name, GSTIN, address, logo, and (if you choose to add them for display on your invoices) bank account details.
• Customer & invoice data you enter: your customers' names, emails, phone numbers, billing addresses, and the invoices, payments, and credit notes you create for them.
• Payment-provider credentials: if you connect your own Razorpay account to accept payments, your API key and secret are encrypted at rest before storage and are never exposed to your browser or to us in plain text after you save them.
• Your own subscription billing: if you upgrade to a paid plan, payment is handled entirely by Razorpay — we receive confirmation that a payment succeeded and basic transaction metadata, never your card or bank details directly.
• Usage data: basic product-usage events (e.g. which features get used, pages visited) stored in our own database, plus product-analytics events sent to PostHog (see §4) to understand and improve the Service. Never sold or used for advertising, on our own platform or anyone else's.
• Cookies: functional session cookies needed to keep you signed in, plus a first-party analytics cookie set by PostHog to recognize repeat visits for the usage data above. No third-party advertising or cross-site tracking cookies.

3. How we use it

• To operate the Service — create your invoices, process payments, run reminders.
• To send transactional email (invoices, payment receipts, reminders, and account emails) — see §4 for who sends these on our behalf.
• To respond to support and grievance requests.
• To detect abuse and keep the Service secure.
• To meet our own legal and tax obligations.

We do not sell personal data to anyone, for any reason.

4. Who we share it with

We use a small number of infrastructure providers to run the Service, each of whom only sees what they need to do their specific job:

• Supabase — our database, authentication, and file storage provider.
• Vercel — application hosting.
• Resend — delivers the transactional emails described above.
• Razorpay — processes both your own subscription payment to us, and (if you connect your own account) the payments your customers make to you.
• PostHog — product analytics (page views, feature usage, which marketing links convert). Sees which pages you visit and which buttons you click, not your invoice or customer data.

We don't share your data with anyone else except where required by law, to enforce our Terms, or to protect the rights, safety, or property of Zuditt or our users.

5. Where data is processed

Some of the providers listed above operate global infrastructure and may process or store data on servers outside India. By using the Service, you consent to this transfer. We only work with providers who maintain appropriate technical and contractual safeguards for data they process on our behalf.

6. Security

Each business's data is isolated from every other business at the database level (row-level security), connected payment-provider credentials are encrypted at rest, and all traffic to the Service is encrypted in transit. No method of transmission or storage is perfectly secure, but we design and review the Service with these protections as a baseline, not an afterthought.

7. Data retention

We keep your data for as long as your account is active. You can delete individual customers or invoices from within the Service at any time. If you close your account, we delete or anonymize your personal data within 30 days, except where we're required to retain records for longer (for example, financial records relevant to our own tax obligations). Invoices and customer records are your business records — you're responsible for keeping your own copies to meet your own statutory retention obligations before deleting anything.

8. Your rights

Under India's Digital Personal Data Protection Act, 2023, and as a matter of our own policy, you can ask us to:

• Confirm what personal data of yours we hold, and access a copy of it;
• Correct or update inaccurate or incomplete data;
• Erase your data, subject to §7 above;
• Nominate another individual to exercise these rights on your behalf in the event of your death or incapacity;
• Withdraw consent where our use of your data depends on it.

To exercise any of these, email sales@zuditt.com. If you're not satisfied with our response, see our Grievance Redressal Policy for how to escalate.

9. Children

The Service is intended for use by businesses and individuals aged 18 and over. We don't knowingly collect personal data from anyone under 18.

10. Changes to this policy

We may update this policy from time to time; the "Last updated" date above will change accordingly. For material changes, we'll make a reasonable effort to notify account owners in advance (e.g. by email).

11. Contact

Questions about this policy, or to exercise the rights in §8: sales@zuditt.com, Zuditt AI Innovations LLP, KMC 18 - 289 D, City Mall Building, MG Road, Kasaragod, Kerala, India. For unresolved concerns, our Grievance Officer is Salman Farize (sales@zuditt.com, +91 79947 30307).