This Privacy Policy describes how HisaabKitaab ("we", "our", or "us") collects, uses, and protects your information when you use our website and services.
1. Information We Collect
Personal Information
- Name, email address, and phone number provided during registration.
- GST number and business details (for Business Portal users).
- Password (stored as bcrypt hash \u2014 we never see or store plain text passwords).
Financial Data
- Income and expense entries you create on the platform.
- Sales, purchase, and voucher data (Business Portal).
- Wallet transaction history (top-ups and deductions).
Automatically Collected
- IP address and user agent (logged for security purposes in activity_logs).
- Session data (stored securely with HTTP-only, secure, SameSite cookies).
2. How We Use Your Information
Your information is used solely to provide and improve our services. Specifically:
- To authenticate your account and maintain session security.
- To store and display your financial entries, reports, and dashboard data.
- To process wallet transactions and charging (when enabled).
- To send notifications about account activity (joint account requests, B2B matches, etc.).
- To send emails (verification, password reset, reports) via our email queue system.
- To generate GST reports and other financial documents for your use.
- To log activities for security auditing and error troubleshooting.
3. Data Sharing
We do NOT sell, rent, or share your personal or financial data with any third party for marketing purposes. Data is shared only in the following cases:
- Joint Account: When you link an account, the linked user can see your shared entries.
- B2B Matching: When you create a sales entry with a party's GST number, and that party is registered on our platform, the entry summary is shared with them for reconciliation.
- Legal Compliance: If required by Indian law or government authorities.
4. Data Security
We implement industry-standard security measures to protect your data:
- Passwords are hashed using PHP's PASSWORD_BCRYPT (never stored in plain text).
- All database queries use PDO prepared statements to prevent SQL injection.
- All user-generated output is escaped with htmlspecialchars() to prevent XSS attacks.
- CSRF tokens are used on all forms to prevent cross-site request forgery.
- Session cookies are set with secure, HTTP-only, and SameSite=Strict flags.
- Sensitive configuration files (env.php) and log files are blocked from direct web access via .htaccess.
- HTTPS is enforced across all domains.
5. Data Retention
Your data is retained as long as your account is active. If you request account deletion or if the admin suspends/deletes your account, your personal entries and data will be marked as deleted. Activity and error logs are automatically cleaned up daily via a cron job (configurable retention period).
6. Cookies
We use only essential session cookies for authentication. These cookies are HTTP-only, secure, and SameSite=Strict. We do not use tracking cookies, advertising cookies, or third-party analytics cookies.
7. Your Rights
You have the right to:
- View and edit your personal information from the Profile section.
- Change your password at any time.
- Request account deletion by contacting us.
- Unlink joint accounts at any time.
8. Changes to This Policy
We may update this Privacy Policy from time to time. Any changes will be reflected on this page with an updated date. Continued use of the platform after changes constitutes acceptance of the updated policy.
9. Contact
If you have any questions about this Privacy Policy, please contact us at support@yourdomain.com.