Privacy Policy

eHisaab is operated by [legal entity name], [registered address], PAN [PAN]. This policy explains how we handle personal data in line with Nepal's Individual Privacy Act, 2075 (2018) and its regulations.

• Account data: your name, email address and password (stored only as a secure hash). If you sign in with Google, the name and email Google shares with us.
• Two-step verification: a record that you enrolled an authenticator app. We do not receive your codes in advance.
• Business data you enter: business name, address, phone, PAN/VAT number, and records of customers and vendors, including their names, emails, phone numbers, addresses and PAN/VAT numbers.
• Financial records you enter: invoices, bills, payments, transactions, stock and attached receipts.
• Security and audit data: sign-in times, failed sign-in attempts, sign-outs, exports, IP address and browser details, and a record of changes made in your books.
• Messages you send us through the contact form.

• To create and secure your account and let you sign in.
• To provide the accounting, invoicing, inventory and reporting features you use.
• To keep an audit trail that protects you and your business against unauthorised changes.
• To detect and prevent misuse, such as repeated failed sign-ins or bulk data exports.
• To send service emails, such as sign-up confirmation and password reset links.
• To answer your messages.
• [Any other purpose, for example billing or product analytics, only if it applies]

We do not sell personal data.

• People in your business: members you invite can see your business records according to the role you give them. Owners, admins and accountants can read the audit log.
• Anyone you send an invoice link to can see that single invoice.
• Our service providers that host and run eHisaab, listed under Sub-processors in our Terms.
• eHisaab staff: [describe who on the team can access customer data and when].
• Authorities, where Nepal law requires us to disclose it.

Your data is stored with our hosting provider in [hosting region / country]. [Describe any transfer outside Nepal and the safeguards in place.]

• Account data: [retention period] after you close your account.
• Business and financial records: [retention period]. Note that Nepal tax law may require businesses to keep accounting records for a set period.
• Audit log and security records: [retention period].
• Contact form messages: [retention period].
• Backups: [retention period].

You can view and correct most of your own data directly in the app. To ask for a copy of your personal data, a correction, or deletion, email [privacy contact email] from the email address on your account. We will reply within [time period].

Some records cannot be deleted on request: posted invoices and the audit log are kept unchanged so your books stay legally sound, and we may need to keep data the law requires us to retain. If you are a customer or vendor of a business that uses eHisaab, please contact that business first, as it controls the records about you.

eHisaab does not set cookies. The app saves the following items in your browser's local storage so it works:

• sb-…-auth-token: keeps you signed in (sign-in session).
• accountify.business: remembers which business you last opened.
• accountify.prefs: your language, calendar, privacy mode and app lock settings.
• ehisaab.last-activity: time of your last activity, used for the 30-minute automatic sign-out.
• ehisaab.login-logged: a temporary flag (session storage) that stops one sign-in being recorded twice.
• ehisaab.storage-notice: remembers that you closed this notice.

How we protect your data is described on our Trust page at /security.

We will update this page when this policy changes, and tell you in the app or by email if a change is significant.

Privacy questions and requests: [privacy contact email].