Privacy Policy

1. Overview

By using NoteKar, you agree to the collection and use of information in accordance with this policy. This policy applies to all users of our services across India.

NoteKar operates as a Business Solution Provider (BSP) on the WhatsApp Business Platform, governed by Meta's Business and Commerce policies in addition to Indian data protection laws.

2. Data We Collect

2.1 Information You Provide Directly

• Account Registration: Your name, WhatsApp-linked mobile number, business name, city/district, and business category (e.g., Kirana, medical, vegetable vendor).
• Voice Notes: Audio recordings you send to NoteKar's WhatsApp number. These are transcribed using our secure, on-premise speech recognition pipeline and are never stored in raw audio form after processing.
• Transaction Data: Sales entries, credit (udhari) records, customer names, item names, quantities, and payment modes that you dictate or type.
• Photos / Documents: Images of supplier invoices or bills you share for OCR extraction. These are processed and immediately discarded.
• Customer Contacts: Names and phone numbers of your customers that you add for credit tracking and WhatsApp payment reminders.

2.2 Automatically Collected Information

• WhatsApp message metadata (timestamps, read receipts) as provided by Meta's Business API.
• Device type and OS version (for app compatibility diagnostics only).
• Usage patterns within the platform (which features are used most frequently) — collected in anonymized aggregate form only.
• Error logs and crash reports from our servers — these do not contain personal transaction data.

2.3 Information We Do Not Collect

• We do not collect your UPI PIN, banking passwords, or OTPs at any time.
• We do not store raw audio files after transcription is complete.
• We do not access your WhatsApp personal chats, contacts list, or media outside of conversations with NoteKar's business account.

3. How We Use Your Data

We use your data solely to provide, improve, and support the NoteKar service:

1. Service Delivery: To process voice notes, log accounting entries, maintain your ledger, and generate reports within ERPNext.
2. Payment Reminders: To generate customer-specific payment messages or UPI QR codes that you choose to send via WhatsApp deep links.
3. AI Improvement: Anonymized and aggregated transcription data may be used to improve our Indian-language speech model. You may opt out of this.
4. Customer Support: To investigate issues, bugs, or disputes you report to our support team.
5. Billing & Subscription: To manage your plan, process renewals, and send subscription reminders.
6. Security: To detect and prevent unauthorized access, fraud, or misuse of the platform.

We do not use your business data for advertising, profiling, or sale to third parties.

4. Data Sharing & Disclosure

We share your data only in the following limited circumstances:

4.1 Service Providers (Sub-processors)

• ERPNext / Frappe Cloud: Our backend ERP platform, which stores accounting records on servers located in India.
• Meta (WhatsApp Business API): Messages pass through Meta's infrastructure. Meta's use of this data is governed by their own privacy policy.
• Payment Gateway: We use Razorpay or similar RBI-licensed processors for subscription billing. Your card/UPI details are stored on their PCI-DSS compliant systems, not on ours.

4.2 Legal Obligations

We may disclose data when required by law, court order, or regulatory authority (e.g., Income Tax Dept., MCA, SEBI) under applicable Indian statutes. We will notify you of such disclosures unless prohibited by law.

4.3 Business Transfers

In the event of a merger, acquisition, or asset sale, user data may be transferred as part of that transaction. You will be notified with 30 days' advance notice and have the right to request deletion before the transfer.

4.4 No Sale of Data

NoteKar does not sell, rent, or trade your personal or business data to any third parties for commercial purposes.

5. Data Storage & Security

All user data is stored on servers located within India, in compliance with the Digital Personal Data Protection Act, 2023 (DPDPA) data localization principles.

• Encryption: All data is encrypted at rest (AES-256) and in transit (TLS 1.3).
• Access Controls: Strict role-based access — only authorized NoteKar engineers with a verified business need can access user data, under logged audit trails.
• Data Retention: Your accounting records are retained for as long as your subscription is active, plus 7 years (as required by GST and income tax regulations). Voice transcriptions are retained for 90 days for error correction, then permanently deleted.
• Backups: Data is backed up daily with 30-day backup retention, stored in encrypted form.

6. WhatsApp & Meta Platform

NoteKar operates as a verified WhatsApp Business Platform user. Key points:

• NoteKar uses only the official WhatsApp Business API. We do not use any unofficial automation tools, bots, or scripts that could violate WhatsApp's Terms of Service or risk your account.
• Messages between you and NoteKar's AI are end-to-end encrypted within WhatsApp.
• Customer-facing payment reminder messages are not automated bulk broadcasts. They are generated as pre-filled deep links that you personally review and send from your own phone.
• Your personal WhatsApp account is never accessed or controlled by NoteKar's systems.

7. Your Rights

Under Indian data protection law (DPDPA 2023) and NoteKar's commitment to user control, you have the following rights:

• Right to Access: Request a copy of all personal data we hold about you.
• Right to Correction: Request correction of inaccurate personal data.
• Right to Erasure: Request deletion of your account and associated data (subject to statutory retention requirements under GST/IT law).
• Right to Portability: Export your accounting records in CSV or Excel format at any time from within the platform.
• Right to Withdraw Consent: Withdraw consent for AI model training using your anonymized data at any time by sending "OPTOUT AI" to our WhatsApp number.
• Right to Grievance Redressal: Lodge a complaint with our Data Protection Officer (DPO) within 30 days, and if unresolved, escalate to the Data Protection Board of India.

To exercise any of these rights, WhatsApp us at +91 92747 72201 or email [email protected].

8. Cookies & Tracking

Our marketing website (notekar.in) uses minimal cookies:

• Essential Cookies: Session management for the web ERPNext portal (Advance plan users). Cannot be disabled.
• Analytics: We use privacy-respecting, self-hosted analytics (Plausible or Umami) that do not use tracking cookies or collect personal identifiers. No data is shared with Google Analytics.

Our WhatsApp-based service does not use cookies.

9. Children's Privacy

NoteKar is designed for business owners and is not directed at children under 18 years of age. We do not knowingly collect personal data from minors. If you believe a minor has used our service without parental consent, please contact us immediately at [email protected] and we will delete the data promptly.

10. Changes to This Policy

We may update this Privacy Policy periodically to reflect changes in law, our practices, or our services. When we make material changes, we will:

• Send a notification via WhatsApp to all registered users at least 14 days before the change takes effect.
• Update the "Last Updated" date at the top of this page.
• For significant changes affecting your rights, obtain fresh consent where required by law.

Continued use of NoteKar after changes become effective constitutes your acceptance of the revised policy.

11. Contact Us

For any privacy-related queries, requests, or complaints, contact our Data Protection Officer: