Privacy policy

This policy explains what personal data Pocket Journal collects, why, and what you can ask us to do with it. It covers two parts of Pocket Journal:

• The website is pocketjournal.in: the pages about Pocket Journal, its pricing and its blog.
• The apps are the billing apps for each kind of business (Food, Retail, Travel and any we add later). Each runs at its own address under pocketjournal.in, such as food.pocketjournal.in, retail.pocketjournal.in and travel.pocketjournal.in. This covers every way you use them: in a browser, installed on a phone or computer, or any other form.

Pocket Journal is operated by Aritra Paul, a sole proprietorship, at Bhaktinagar, Shaid Colony, Siliguri, Jalpaiguri, West Bengal 734007. In this policy "we" and "us" mean that operator, and "you" means anyone who visits the website or uses the apps. We follow the Digital Personal Data Protection Act, 2023 and other applicable Indian law.

The short version

• The website uses analytics to see which pages people visit. It runs no ads.
• The apps run no analytics or ads. They set one cookie, which keeps you logged in.
• Your business's records belong to your business. We store them so the app can work, and we do not read, sell or reuse them.
• We keep your bills and ledgers for 8 years, so you can ask for any year your business needs for tax.
• You can export your data, correct it, or ask us to delete it.

What we collect

When you visit the website. Our hosting provider records standard request logs, such as IP address, browser type, the page requested and the time. They are used to keep the website running and to stop abuse, and are kept for a short period. We also use an analytics service on the website to count visits and see which pages are read, using details such as the page, the site you came from, your device and browser type, and your approximate location. We use this only in total, to improve the website, and never to identify you. If you email us, we keep the email and your address so that we can reply.

When your business signs up. We collect the business name, GSTIN, address and phone number, and the name, email address and role of each staff member who gets a login. Passwords are stored only as a one-way hash, so we cannot read them.

When you use the app. We store the records you enter: invoices, items, prices, customers, payments and ledger entries. We also store files you upload, such as product photos, supplier bills and travel documents. We also log sign-ins and some actions, such as who cancelled an invoice, so that your business has an audit trail.

When you pay us. We keep invoices and payment records. If a payment provider handles the card or UPI payment, it receives your payment details directly. We never see or store full card numbers.

Why we use it

• To run the apps and keep your account secure.
• To bill you for the plan and the usage in each billing cycle.
• To reply to messages, support requests and demo requests.
• To tell you about changes to the service, these terms or your account. We do not send marketing email unless you have asked for it.
• To meet legal duties, such as keeping tax records.

We use account data because it is needed to provide the service you signed up for. Where we rely on your consent, you can withdraw it at any time by writing to us. Doing so does not affect anything we did before you withdrew it.

Your customers' data

Invoices often carry your customers' names, phone numbers, addresses and GSTINs. For that data, your business decides what is collected and why, and we process it only to provide the app to you. We do not contact your customers or use their data for anything else.

If one of your customers asks to see, correct or delete their data, the request is yours to handle. You can make the change in the app, or write to us and we will help.

Cookies

The website may set analytics cookies, which help us count visits and see which pages are read. They are not used for advertising. You can block or delete them in your browser settings, and the website still works.

The apps set one cookie when you log in. It identifies your session, it is needed for the app to work, and it ends when you log out or the session expires. The apps use no analytics, tracking or advertising cookies.

Who we share it with

We do not sell personal data or share it for advertising. We share it only with:

• Service providers who run parts of the service for us. Vercel hosts the website and apps, Neon hosts the databases, and Amazon Web Services stores uploaded files. An analytics provider measures visits to the website, never the apps. If we use a payment provider, it handles payments. Each one gets only what its job needs.
• Authorities, when Indian law requires it, or to protect the rights or safety of our users or the public.
• A successor, if the business is transferred, sold or registered as a company. The successor must keep to this policy.

Where it is stored

Our providers may store data on servers outside India. Wherever the data is stored, it is protected as this policy describes and as Indian law requires.

How long we keep it

• Business records (invoices, ledger entries, payments and supplier bills) are kept for 8 years from the end of the financial year they belong to. GST law requires your business to keep these records for several years, and we keep them so that you can meet that duty. Your plan decides how many past years you can see in the app. Older years are not deleted: ask, and we send them to you.
• Uploaded photos and other files that are not business records, such as product photos, are kept while your account is open and deleted 30 days after it closes.
• Account details (business details and staff logins) are kept while your account is open. After it closes, we keep only what is needed to send you your records on request.
• Our invoices to you and payment records are kept for as long as tax law requires.
• Request logs are kept for a short time and then deleted.

After the retention period ends, we delete the data, and backups are cleared within a further 90 days. If you ask us to delete business records earlier, we will, unless the law requires us to keep them.

How we protect it

All connections use HTTPS. Passwords are hashed. Each business's data is separated from every other business's, and every request is checked against the company of the user who is logged in. Only the operator can reach production systems. No system is perfectly secure, so if a breach affects your data, we will tell you and the authorities as the law requires.

Your rights

You can ask us to:

• tell you what personal data we hold about you and how we use it
• correct data that is wrong or incomplete
• delete data we no longer need
• name someone to act for you if you die or are unable to act

Write to support@pocketjournal.in. We may need to confirm who you are before we act.

Children

The service is for businesses. It is not meant for anyone under 18, and we do not knowingly collect children's data.

Grievances

If you have a complaint about how your data is handled, write to our grievance officer:

Aritra Paul
Bhaktinagar, Shaid Colony, Siliguri, Jalpaiguri, West Bengal 734007
support@pocketjournal.in

We will acknowledge your complaint within 7 days and aim to resolve it within 30 days. If you are not satisfied, you may complain to the Data Protection Board of India.

Changes to this policy

When this policy changes, we update the date at the top of the page. If a change affects how we use your data, we will notify account holders by email before it takes effect.