Privacy Policy

1. Who we are

TelBooks is a product of [Taxtel legal name], [registered address]. We are the data fiduciary for the personal data described here under the Digital Personal Data Protection Act, 2023 (DPDP Act). For the accounting data of your own customers, vendors and employees that you put into TelBooks, you decide what to record and we process it on your behalf to provide the service.

2. What we collect

• Account details: your name, email address and a password (stored only as a one-way hash), and your roles in each organization.
• Organization details: organization name, type, state, GSTIN, PAN, addresses and settings you enter.
• Accounting data: invoices, expenses, vouchers, journal entries, customers, vendors, bank accounts and the figures and notes in them.
• Uploaded documents: scanned bills, proofs, logos and signatures that you attach.
• Bank statements: statement files and the transaction lines you import into the Bank Feed.
• Email records: a log of emails we send you (recipient, which message, whether it was delivered or bounced). We do not keep the message body or the links in it.
• Activity records: an audit log of actions taken in an organization (who did what and when), and basic technical records needed to run and secure the service.

3. Why we use it

• To create your account, sign you in and run your organizations, roles and approvals.
• To provide the accounting features you ask for, including reading scanned documents and bank statements.
• To send service emails: email verification, password reset, invitations, and notices about your account.
• To keep the service secure, prevent misuse, back it up and fix problems.
• To meet legal obligations.

[add marketing or analytics purposes here only if they will be used; otherwise leave this out]

4. Who processes it for us

We use service providers to run TelBooks. They process data only to provide their service to us:

• Hosting: [hosting provider and location].
• Email: Amazon Web Services (Amazon SES, Mumbai region) sends our emails.
• Document reading (OCR): Amazon Textract reads scanned bills and statements you upload ([region where the OCR service runs]).

We do not sell your data. We share it with others only where the law requires it or where you ask us to. [list any other processors, e.g. payment gateway, once chosen]

5. How long we keep it

We keep your data while your account is active. After you cancel, we keep it for [data export period] so you can export it, and then delete it within [deletion timeline], except where the law requires us to keep something longer. Email logs are kept for [email log retention]. Backups are overwritten as they age out. You can ask us to delete your data sooner (see your rights below).

6. How we protect it

In plain words, these are the measures that exist today:

• the connection between your browser and TelBooks is encrypted (HTTPS);
• passwords are stored as one-way hashes, never in readable form;
• access is role-based: people see and do only what their role in an organization allows, and every organization's data is separated from the others;
• an audit log records important actions;
• the database is backed up every night, and the most recent backups are kept.

No online service can promise perfect security. If a personal data breach affects you we will tell you and the authorities as the law requires.

7. Your rights

Under the DPDP Act you can:

• ask for a summary of the personal data we hold about you and how it is used;
• ask us to correct or complete it, or to erase it when it is no longer needed;
• withdraw consent for processing that depends on your consent;
• have your grievance heard and answered;
• nominate another person to exercise these rights if you die or become unable to.

To use a right, write to [support email]. We will reply within [response time].

8. Children

TelBooks is for businesses and adults. We do not knowingly collect personal data of children.

9. Grievance contact

Grievance officer: [grievance officer name], [grievance email], [support phone]. If we do not resolve your concern you may approach the Data Protection Board of India as the law provides.

10. Changes to this policy

We may update this policy. We will tell you about material changes [how and how far ahead].