Privacy policy

Bixobook is operated by Bixobook (“Bixobook”, “we”, “us”). This policy explains how we handle personal data when you use the Bixobook app on Android, iOS and the web, the shopkeeper panel at shopkeeper.bixobook.in, the add-on store at shop.bixobook.in, this website, and the shop websites and online stores we host for our merchants (together, the “Services”).

We follow the Digital Personal Data Protection Act, 2023 (“DPDP Act”), the Information Technology Act, 2000 and the rules made under them. By using the Services you agree to the handling described here. If you do not agree, please do not use the Services.

Shop owners and staff. When you sign up or work in a Bixobook account, we decide why and how your personal data is used. For this data we are the Data Fiduciary.

Your customers, suppliers and shoppers. A shop records its own customers and suppliers in Bixobook, for example in bills, khata entries, orders and WhatsApp campaigns. A shopper who orders from a shop’s website gives their details to that shop. For this data the shop is the Data Fiduciary, and we process it only on the shop’s behalf and on its instructions, to provide the Services. If you are a shopper or a shop’s customer, please contact the shop first about your data. We will help the shop answer you, and you can also write to our Grievance Officer.

Shops are responsible for having a lawful basis, such as consent, for the customer data they enter, and for the messages they send through Bixobook.

We collect only what we need to run the Services:

• Account details: your mobile number (we sign you in with a one-time code), name, email address, and, if you use it, your Google account’s name, email and picture when you choose “Sign in with Google”.
• Business details: business name, type, address, state, GSTIN and GST registration type, logo, opening hours, bank or UPI details printed on bills, and the details of staff you invite and the roles you give them.
• Business records you create: items, stock, bills, purchases, payments, expenses, khata balances, customer and supplier names, phone numbers, addresses and GSTINs, online orders, reviews, coupons and marketing campaigns.
• Shopper details when someone orders from a shop’s website or table QR menu: name, phone number, email if given, delivery address and the order.
• Payments: for plans, wallet top-ups and online orders, payments are handled by Razorpay. We receive the payment status, amount, payment method type and reference IDs. We never see or store your full card number, CVV, UPI PIN or net banking password.
• Support: messages and attachments you send to our support team.
• Technical data: IP address, device and browser type, app version, sign-in sessions, and logs of actions taken in an account (for security and the audit trail). If you allow it, the app uses your camera only to scan barcodes and to photograph items.

We use personal data to:

• create and secure your account, send sign-in codes and keep you signed in;
• provide the features you use: billing and GST invoices, khata, stock, reports, your shop website, online orders, WhatsApp and SMS messages, and printing;
• process subscription, wallet and add-on payments, and issue GST invoices for them;
• send service messages, such as order alerts, payment receipts, plan reminders and important changes to the Services;
• answer support requests;
• prevent fraud and abuse, such as repeated sign-in code requests or misuse of free plans, and keep the Services secure;
• improve the Services using aggregated and de-identified usage data;
• meet our legal duties, such as tax law, accounting and lawful requests from government authorities.

AI features. When you use the AI copywriter or dashboard insights, we send the relevant business figures and text to our AI provider to generate the result. This can include your sales totals, top items, and the names and dues of your top customers, but never their phone numbers or addresses. Our provider does not use this data to train its models.

We do not sell personal data, and we do not show third-party advertising in the Services.

We share personal data only as needed to provide the Services, with:

• Service providers who work for us under contract: Razorpay (payments), Meta’s WhatsApp Business Platform (WhatsApp messages), SMS providers such as MSG91 (sign-in codes and SMS), email providers, Google (Sign in with Google), our AI provider, and cloud hosting, storage and backup providers.
• The shop you deal with: when a shopper orders from a shop’s website, the shop receives the order and the shopper’s contact and delivery details.
• People in your business: staff you invite see the data their role allows.
• Authorities when the law requires it, or to protect the rights, safety and property of Bixobook, our users or the public.
• A buyer or successor if our business is merged or sold, under terms that keep this policy’s protections.

Data is stored on secured servers run by hosting providers we select. Some of our service providers may process data outside India. Where they do, it is only for the purposes above and in line with the DPDP Act and any restrictions the Government of India notifies.

We protect data with encryption in transit (HTTPS), encryption of sensitive fields such as integration keys, access controls by role, two-step sign-in for our admin team, audit logs and regular backups. No system is perfectly secure. If a personal data breach affects you, we will inform you and the Data Protection Board of India as the law requires.

We keep account and business data for as long as your account is open. Bills, payments and other accounting records may need to be kept for up to 8 years under GST and income tax law.

When you ask us to close your account, we delete or anonymise your personal data within 30 days, except what the law requires us to keep. Backups are overwritten on their normal cycle, within 90 days. Logs kept for security are deleted after 180 days.

Under the DPDP Act you can:

• ask for a summary of the personal data we hold about you and how we use it;
• correct, complete or update it (most of it you can edit yourself in the app);
• ask us to erase it, or close your account;
• withdraw consent you gave earlier, for example for marketing messages. This does not affect what we did before you withdrew it;
• nominate another person to exercise these rights if you die or become unable to;
• complain to our Grievance Officer, and, if you are not satisfied, to the Data Protection Board of India.

To use these rights, write to support@bixobook.in from your registered email, or from Help & support in the app. We may ask you to confirm your identity first. We reply within 30 days.

Shops can export their data from the app at any time (items, customers, bills and reports as Excel or CSV files), before closing an account or moving to another service.

We do not use advertising or tracking cookies. Our websites store a few things in your own browser so that they work: your sign-in session, the items in your cart, and, if you place an order, your name and delivery address so you do not have to type them again. You can clear them at any time in your browser settings.

The Services are meant for businesses and adults. We do not knowingly collect personal data from children under 18 and do not track or target them. If you think a child has given us personal data, write to us and we will delete it.

We may update this policy as the Services or the law change. We will post the new version here with a new date. If a change significantly affects how we use your data, we will tell you in the app or by email or SMS before it takes effect.

For any question or complaint about privacy, contact our Grievance Officer at support@bixobook.in. We acknowledge complaints within 48 hours and resolve them within 30 days.

You can find all our contact details on the contact page.