Privacy policy
Last updated 3 October 2026
Who we are
Zap Bill X is run by Tech Conductor Technologies Pvt Ltd (“we”, “us”), registered office A04 RM Creation, Guwahati, 781025. This policy covers the phone app, the web app, the Windows desktop app when it is available, this website and our cloud services.
We wrote it to follow India’s Digital Personal Data Protection Act, 2023 (the DPDP Act) and the Digital Personal Data Protection Rules, 2025, and the Information Technology Act, 2000 and the rules made under it. For any question or request about your data, write to our Grievance Officer at [email protected].
Two kinds of data, two roles
Zap Bill X holds two different kinds of personal data, and our role is different for each.
- Account data is about you and the people in your business who use Zap Bill X: names, phone numbers, email addresses, devices and payments. We decide how it is used, so we are its Data Fiduciary, and this whole policy applies to it.
- Business data is your books, including the names, phone numbers, addresses, GSTINs and balances of your customers, suppliers and staff. The shop decides what to enter and why, so the shop is the Data Fiduciary. We process business data only on the shop’s behalf, to provide Zap Bill X to it.
If you are a customer or supplier of a shop that uses Zap Bill X, please contact that shop about your data first. If you write to us, we will pass your request to the shop and help it respond.
What we collect
| Data | What it includes | Where it comes from |
|---|---|---|
| Account details | Your name, mobile number and email address | You, and Google when you sign in with Google |
| Devices | Device name and type, app version, notification token, and which businesses each device is signed in to | Your devices |
| Sign-in and security records | Sign-ins, QR sign-in approvals, purchases and other security events, with IP address, browser or device, and approximate city | Our servers, when these events happen |
| Payments | What you bought, amounts, Razorpay order and payment IDs, payment method and status. Never your full card number. | Razorpay and you |
| Billing details | The name, GSTIN, state and address you give for our invoice | You, at checkout |
| AI usage | How many AI uses your business has made, to apply your allowance | Our servers |
| AI feature inputs | A voice recording, a photo of a bill, a question and the parts of your books needed to answer it, or item names | You, only when you use an AI feature |
| Support messages | What you send us by email, phone or WhatsApp | You |
| Business data | Your books, held for the shop as described above | The shop and its staff |
We don’t collect passwords: sign-in uses Google or a one-time SMS code. If your books contain financial information such as bank account details, we protect it like the rest of your business data.
Why we use it
| Purpose | Legal basis |
|---|---|
| Create your account, sign you in and keep it secure | Your consent |
| Store, sync and back up your books, and run the features you use | Your consent; for business data, the shop’s instructions |
| Take payments, apply your plan, and issue GST invoices and credit notes | Your consent, and our duties under tax and company law |
| Send sign-in codes, invoices, trial and renewal reminders, deletion warnings and notifications you turn on | Your consent |
| Run AI features | Your consent, given each time you use one |
| Answer your support requests | Your consent |
| Prevent fraud and misuse, investigate security incidents and answer lawful requests | Our duties under law, including CERT-In directions under the IT Act |
We don’t sell personal data and don’t use it for advertising. The AI providers we use are set up not to train their models on what we send them.
Consent and withdrawing it
We ask for your consent when you create an account, and again before features that need more data, such as notifications. You can withdraw consent at any time, as easily as you gave it:
- turn off notifications in your phone’s settings;
- stop using AI features (they send data only when you use them);
- sign out of a device or remove it from your business;
- ask us to close your account and delete your data by writing to [email protected].
Withdrawing consent doesn’t undo processing already done. If you withdraw the consent we need to run your account, we can no longer provide the service, and we stop processing your data except what the law requires us to keep (see “How long we keep it”).
Where your data is kept and how we protect it
- Our servers and database run on a server in India. Backups and stored files are in an S3-compatible storage service in India.
- Zap Cloud backups are encrypted with AES-256-GCM using a key unique to each business. We keep 30 daily and 12 monthly backups.
- Connections between the apps, this website and our servers are encrypted (HTTPS).
- Access to our systems is limited to the people who need it to run the service.
- Each of your devices keeps a full copy of your books so you can work offline. That copy is protected by your device’s own lock and the app’s PIN lock. On a shared computer, sign out of the web app: signing out removes that browser’s copy after you confirm.
- You can also back up to your own Google Drive or to a file. Those copies are under your control.
No system is perfectly secure. If something goes wrong, we act as described under “If there is a data breach”.
Who else handles your data
We use these service providers. Each gets only the data it needs for its task.
| Provider | What for | What it receives |
|---|---|---|
| Google (Firebase Authentication) | Sign-in with Google or with a mobile number and SMS code | Name, email address, mobile number and sign-in details |
| Google (Firebase Cloud Messaging) | Notifications to your phone | Your device’s notification token and the notification |
| Razorpay | Payments and refunds | Order amount and contact details. You enter card, UPI or bank details with Razorpay, not with us. |
| AI provider (Anthropic by default; we may use others) | AI features, only when you use one | Only what that feature needs: a voice recording, a bill photo, your question with the relevant parts of your books, or item names |
| Email provider | Sending invoices and reminders | Your name, email address and the email’s content |
| GST and WhatsApp service providers | Filing and messages, when connected (not yet in use) | Only what is needed for the filing or message you choose to send |
Some of these providers, such as Google and the AI provider, may process data outside India. The DPDP Act allows this except to countries the Government of India restricts, and we follow any such restriction.
We also disclose personal data when the law requires it, for example to tax authorities, courts, CERT-In or the police acting under a valid legal order.
Cookies and visitor statistics
We use only essential cookies: one keeps you signed in to the web app. We use no advertising or tracking cookies. If visitor statistics are switched on, we use Umami, which counts page visits without cookies and without identifying you.
The web app also keeps a copy of your books in your browser’s storage so it works offline. Signing out removes it.
How long we keep it
| Data | How long |
|---|---|
| Account details, devices and support messages | While your account is open. Deleted when you close it, except what the law requires us to keep. |
| Business data on our servers, for a licensed business | Until the owner deletes the business or closes the account |
| Business data after a trial ends without a purchase | 12 months, then deleted. We warn you 30 days and 7 days before. |
| Zap Cloud backups | 30 daily and 12 monthly copies, replaced in turn. Data deleted from our servers is gone from the backups within 12 months, as old backups expire. |
| Payments, our invoices and credit notes, billing details | As long as tax and company law require (currently up to 8 years) |
| Security logs | One year, in India, or longer where another law requires |
| Books on your devices | Until you delete the app or sign out of the web app. These copies are under your control. |
Your rights
Under the DPDP Act you have the right to:
- Access: get a summary of the personal data we hold about you, what we do with it, and who we have shared it with.
- Correction: have wrong or incomplete data corrected or updated. You can change most account details in the app yourself.
- Erasure: have personal data deleted that we no longer need or that you have withdrawn consent for. We keep only what the law requires, such as our invoices.
- Withdraw consent, as described above.
- Grievance redressal: complain to our Grievance Officer and get a response.
- Nomination: name another person to use these rights for you if you die or become unable to act.
To use any of these rights, write to [email protected]. We may ask you to confirm your identity first. We respond within 30 days. If you are not satisfied with our response, you can complain to the Data Protection Board of India; the DPDP Act asks you to use our grievance process first.
For business data, the shop’s owner can view, correct, export and delete it in the app at any time. If your details are in a shop’s books, ask the shop.
Children
Zap Bill X is for businesses and is not meant for anyone under 18. We don’t knowingly create accounts for children or collect their data. If we learn that an account belongs to someone under 18, we close it and delete its data. Shops should not enter a child’s personal data in their books without the verifiable consent of a parent or guardian where the law requires it.
If there is a data breach
If a personal data breach affects your account data, we tell you without delay: what happened and when, what it may mean for you, what we are doing about it, and what you can do to protect yourself. We report it to the Data Protection Board of India as the DPDP Rules require, with a full report within 72 hours, and to CERT-In within 6 hours of noticing it, as its directions require.
If a breach affects a shop’s business data, we tell the shop without delay so it can inform the people concerned, and we help it do so.
Security logs
As CERT-In’s directions under the IT Act and the DPDP Rules require, we keep logs of our systems, such as sign-ins and access to our servers, in India for one year, or longer where another law requires. We use them only for security, investigating incidents and answering lawful requests.
Changes to this policy
When we change this policy, we post the new version here and update the date at the top. For important changes we tell you by email or in the app before they take effect, and ask for your consent again where the law requires it.
Grievance Officer
- Name: Om Prakash Mahato
- Email: [email protected]
- Post: Tech Conductor Technologies Pvt Ltd, A04 RM Creation, Guwahati, 781025
We acknowledge grievances within 24 hours and resolve them within 15 days. Our other contact details are on the contact page.