Skip to content
BillNBin
Legal

Privacy Policy

This policy explains what personal data BillNBin handles, why we handle it, and what you can ask us to do with it. It is written against the Digital Personal Data Protection Act, 2023, and it describes what the software actually does rather than what it might do one day.

Effective 15 September 2026

Who we are

BillNBin is inventory, billing and GST software operated by BillNBin, operated by CodeQuackers ("we", "us"). For the personal data held inside a business's account, that business is the Data Fiduciary and we are its Data Processor, acting on its instructions. For your own use of our website and our relationship with the business that holds the account, we act as a Data Fiduciary ourselves.

This distinction is not legalese for its own sake. If your name and phone number were entered by a shop you bought from, that shop decides how they are used, and a request to correct or delete them should go to the shop first. We will support them in acting on it.

What this covers

This policy covers our public website and the software we provide to businesses. It does not cover a business's own handling of your data, or any third-party service a business chooses to connect.

What we collect

We keep the categories below deliberately small.

Account and team data

  • Name, email address and phone number of each user
  • Role, permissions granted, and sign-in activity
  • Password in hashed form — we never store or see the password itself

Business records you enter

  • Business name, address, GST registration and tax settings
  • Items, stock movements, invoices, credit notes, purchases, payments and expenses
  • Customer and supplier names, phone numbers and addresses where you record them

Data we generate in operating the service

  • Audit entries — who changed what, and when, including numbering, backdating and approval actions
  • Technical logs of requests, errors and security events, including IP address
We do not collect payment card data. BillNBin does not process payments: payments against an invoice are recorded by your staff, and settlement happens outside the platform. We also do not ask for Aadhaar or any government identifier beyond the tax registration details a business needs for compliance.

Why we use it

  • To provide the service — recording transactions, computing tax splits, producing documents and reports, and keeping each business's records separate.
  • To operate and secure it — authenticating users, enforcing permissions, detecting misuse, and maintaining an audit trail.
  • To support you — responding to your enquiries and diagnosing problems you report.
  • To meet legal obligations — retaining the financial records Indian tax law requires us to keep.
  • To contact you — service messages such as day-close reports, alerts you have configured, and notice of material changes. These are part of the service, not marketing.

We do not use your identifiable business records to train machine-learning models, sell them, or use them for advertising. Aggregated, de-identified usage data — for example the number of active businesses — may be used to operate and improve the platform.

Where we rely on your consent, we ask for it freely, for a stated purpose, and you can withdraw it at any time by writing to us. Withdrawal does not affect processing already carried out, and it may mean we can no longer provide part of the service.

If you are a business entering your customers' data, consent is your job, not ours. Before you record a customer's name, phone number or address, you are responsible for having the basis to do so. We give you the tools to do that — including the ability to delete a customer record — but we cannot obtain consent on your behalf.

Who can see it

Within a business, data is visible to the users that business has created, subject to the permissions it has set. Our own staff access tenant data only where necessary for support, maintenance or a legal requirement, and such access is logged.

We share personal data with service providers that host and run the platform:

  • Cloud hosting and database infrastructure
  • Transactional email delivery for alerts and day-close reports
  • Web font delivery for the public pages

These providers act on our instructions under contract. We do not sell personal data, and we do not share it for anyone else's marketing.

Sharing a bill on WhatsApp is under your control. BillNBin opens WhatsApp on your own device with a pre-filled message. We do not send your data to WhatsApp on your behalf, and we do not receive anything back from it. If we ever enable a paid messaging integration, it will be optional and this policy will describe it before it applies.

We may disclose data where the law requires it, or to establish or defend legal claims. Where we are permitted to tell you, we will.

Keeping businesses apart

Every record belongs to exactly one business. Access is scoped to that business at the database layer rather than filtered in the interface, and the underlying record of which business a row belongs to is not editable by users. Attempts to reach across that boundary are refused and logged.

This matters for privacy as much as for security: the strongest guarantee that one business cannot see another's customers is that its queries are structurally unable to return them.

How long we keep it

  • Business records — invoices, credit notes, purchase documents and their tax details are retained for 8 years, because Indian tax law requires those records to be kept.
  • Account and user data — deleted when the business relationship ends, or when a user is removed from an account.
  • Technical logs — kept for a short operational window, then deleted.
  • Audit entries — kept for the life of the record they describe, so a change remains explainable.

Deletion is therefore deliberately partial on termination: the financial records stay, because we are obliged to keep them. Everything else is removed.

How we protect it

  • Data is encrypted in transit.
  • Passwords are stored only as hashes, never reversibly.
  • Access is controlled by per-user roles and permissions, with sensitive actions gated behind owner approval.
  • Actions that affect records — numbering, backdating, corrections, approvals — are written to an audit trail.
  • Access to production systems is restricted and logged.

No system is perfectly secure. If a personal data breach occurs that affects you, we will notify you and the Data Protection Board of India as required by law.

Your rights

Under the DPDP Act you have the right to:

  • Access — know what personal data of yours we hold, and obtain a summary.
  • Correction — have inaccurate or incomplete data corrected or completed.
  • Erasure — have your data deleted, subject to the retention obligations above.
  • Grievance redressal — have a complaint heard, and escalate to the Data Protection Board if it is not resolved.
  • Nomination — nominate someone to exercise your rights in the event of death or incapacity.

Write to codequackers.in@gmail.com and we will respond within the period the Act allows. Where we are acting as a processor for a business, we will pass your request to that business and help it respond.

If you are a business, you can export your data yourself at any time using the export features, without needing to ask us — a right you should not have to request.

Cookies and local storage

We use a small amount of local storage and the minimum necessary cookies to run the service: keeping you signed in, protecting forms against cross-site request forgery, and remembering whether you prefer the light or dark theme. None of it is used for advertising or cross-site tracking, and none of it is shared with third parties.

Children

BillNBin is a business tool and is not intended for use by children. We do not knowingly collect personal data of children, and we do not carry out tracking or behavioural monitoring that targets them. If you believe a child's data has been entered, write to us and we will remove it.

Changes to this policy

We may update this policy as the product and the law develop. Material changes will be communicated to the contact on each account before they take effect, and the effective date at the top of this page will change.

Contact and grievance

Privacy questions and requests go to codequackers.in@gmail.com, or on +91 78910 79575.

Grievances are handled by CodeQuackers (codequackers.in), who can be reached on either of those. We answer within a working day, and if you are not satisfied with the outcome you may complain to the Data Protection Board of India.

General support queries go to codequackers.in@gmail.com.

Our Terms of Service explain the wider agreement between us and the business holding the account.