Privacy Policy

Zentra(“we”, “us”) is a business-management platform for Indian shops, operated by Chandrakanth G Bhatt (proprietor) of Visakhapatnam, India. Two different kinds of data run through it, and the difference matters:

• About you, the shop owner. Your name, contact details and account. Here Zentra decides why and how that data is used, so under the DPDP Act, 2023 Zentra is the Data Fiduciary.
• About your customers, staff and suppliers. You collect those; you decide why they are in the system. Under the same Act you are the Data Fiduciary for that data and Zentra is the processor that holds it on your instructions.

We do not use your customers’ data for our own purposes: no advertising, no resale, no profiling, no training our models on it. The only thing we do with it is show it back to you.

Everything below is data you or your staff type, upload or generate.

• Your name, email address and phone number, and the password hash Supabase stores for you.
• Business identity: name, trade type, city and address, phone, email and GSTIN if you enter one.
• What you sell: items and services, prices, HSN or SAC codes, units, stock counts and stock movements.
• Your customers: names, phone numbers, addresses and their ledger of bills, credit and payments.
• The bills themselves: line items, totals, tax breakup, payment mode, and any photo or note attached.
• Staff and payroll records you add: names, roles, shifts, attendance and salary entries.
• Marketing content you create: campaigns, coupons, gift cards, posters and review requests.
• Support messages you send us.

Each purpose, the data it touches, and the ground we rely on. Consent for these purposes is taken when you create the account; you can withdraw it as described in clause 5.

• Session cookies. A handful, all essential: the sign-in session with our authentication provider, and which business is active so the app opens on the right shop. No advertising, no analytics, no third-party cookie set by us.
• Local storage in your browser. The active business identifier and the data your screens last showed, so the app opens fast and keeps working when the network does not. This is a real copy of your bills on the device you used — clear it on a shared or borrowed machine.
• The offline cache. Zentra installs as a Progressive Web App and caches app files and recent data on the device. Tap resetin the app to wipe that copy, or clear the site’s storage in your browser settings.

Turning cookies off signs you out and stops the app from working, so there is nothing to accept or reject: the only cookies are the ones the product needs.

Under sections 5 to 8 of the DPDP Act, 2023 you may ask for the following, free of charge, for the data we hold about you:

• Access and copy. A summary of your personal data and of the sharing described in clause 7. Your business records themselves you can export yourself — items, customers and reports all have Excel (CSV) export, and bills download as PDF.
• Correction and completion. Fix a wrong name, phone, address, GSTIN or bill entry from inside the app; anything the app will not let you change, we change for you.
• Erasure. Ask us to close the account and delete your data (clause 9).
• Withdraw consent. Stop using the app, or tell us to stop a feature that runs on your instruction (AI screens, marketing sends). Withdrawal does not undo processing already lawfully done and does not delete records the law asks you to keep.
• Nominate. Name a person who may exercise these rights if you are unavailable or deceased; tell us in writing and we record it against the account.
• Grievance redressal. Clause 10.

Send the request from the e-mail address on the account to ayoraindex@gmail.com. We act on it as soon as we can and normally within seven working days; if we cannot, we tell you why and what happens next. For the data we hold about your customers, requests must come from you — you are their fiduciary, and we act on your instruction.

• Collect your customers’ name and number lawfully and tell them you hold it. Zentra cannot do that for them.
• Marketing goes out from your account, to your customers, through yourWhatsApp or your own share sheet. Only message people who will expect to hear from you, and honour a stop request the moment it arrives. Bulk commercial messages in India are regulated by TRAI’s rules; the compliance duty is yours, not ours.
• Reviews we collect go to Google at the customer’s own tap, and sit in your queue until you publish them. Do not pay or bundle incentives for a review — Google’s policy and the Consumer Protection from Unfair Trade Practices Rules both prohibit it.
• If a customer asks you to delete or correct their record, do it in the app; the change is immediate and applies to the exports and backups that follow.

We share your data with no one except the processors below and, where the law requires, a court, authority or auditor with a valid order. We never sell it.

Some of these providers may process data outside India. Cross-border handling by the providers named above is permitted under the DPDP Act and the Data Protection Rules made under it; where a country is not on the list notified by the Central Government, we do not send data there. Your own exports, posters and shares leave Zentra only when you press the button that sends them — for example a WhatsApp share goes to Meta because you chose to share it.

• When you dictate or type “make a bill for…”, or upload a photo of an invoice, that text or image goes to Google’s Gemini API to be read, and the answer comes back into your app. When you make a poster, the description of the picture goes to AI Horde. Nothing else from your database travels with it.
• We do not use your data to train these models. Requests sent through the API are nevertheless handled under that provider’s own terms and may be retained by them for safety review; do not put documents, passwords, health data, financial details of a third party, or anything you would not want a vendor to see into those boxes.
• AI output is a draft. It can misread a rate, a tax slab or an HSN code. Check it before you hand the bill to a customer — the invoice is yours, not the model’s.

• While your account is open, your records stay in the live database. Nothing is deleted just because it is old.
• If the 7-day trial runs out without a plan, the account is locked, not deleted. Your data waits; resume on any plan and it is all still there.
• Ask us in writing to close the account and we delete your business records from the live database. There is no self-serve delete button yet, which is why the request comes to a human.
• Nightly snapshots are kept in two places — the operator’s own machine and a private storage bucket with our database provider — and each one is overwritten after 14 days. So deleted data is gone from the app at once and from the backups within fourteen days.
• If you need bills preserved because GST law asks you to keep records for six years, or eight years for audited accounts under the Income-tax Act, tell us before deletion and export them yourself. We are not your statutory record-keeper.

• Every table is protected by row-level security, so a query only ever returns rows for a business the signed-in person belongs to. This is enforced in the database, not in the app, so it still holds if someone skips the interface.
• Traffic is HTTPS/TLS. Passwords are hashed by our authentication provider — we never see or store the plain text. The database and the backup bucket are private buckets.
• Your own data is encrypted at rest by the database provider, as is the backup copy.
• Administrative keys are held by the operator and are never shipped to a browser. Staff you invite get only the roles you give them; a cashier cannot open the owner’s settings.

No system is unbreakable, and we will not pretend otherwise. What we control: least privilege, isolation per business, and backups that let us restore.

On confirming a personal data breach that affects your data, we notify youby the e-mail on the account without undue delay, and we inform the Data Protection Board of India and each affected data principal in the manner the DPDP Rules prescribe. We will tell you what was involved and what we did about it; we will not name another business’s records to you.

Under section 5(7) of the Information Technology Act, 2000 with the applicable intermediary rules, and rule 4 of the SPDP Rules, 2011, and for the grievance redressal the DPDP Act expects:

If you are not satisfied with how we handle a complaint, you may approach the Data Protection Board of India for matters under the DPDP Act, or the District Consumer Commission / consumer redressal portal under the Consumer Protection Act, 2019. You do not need a lawyer to file with either.

Zentra is a tool for business owners, and we do not knowingly collect personal data of anyone under 18, the age the DPDP Act treats as a minor. Staff records can contain a young employee’s details: that is entered by you, and the consent duty for a minor rests with the parent or guardian. Write to us if you believe a minor’s data has reached us and we will remove it.

If we change this policy in a way that matters, we tell you in the app and by e-mail before it takes effect, and we keep the previous text available on request. Minor clarifications are published on this page with the date at the bottom.

This policy is written under the laws of India. For anything here, ayoraindex@gmail.com.