Privacy Policy

Welcome to Bharat Enterprise Billing System ("Platform", "we", "us", or "our"). We are a cloud-based, multi-tenant billing, inventory, purchasing, and business management platform designed for pharmaceutical distributors, retailers, wholesalers, and small-to-medium businesses across India.

We are dedicated to safeguarding the privacy and security of your commercial and personal data. This Privacy Policy explains what information we process, why we process it, how we protect it, and the controls you have over your data.

By registering for an account or using our Platform, you acknowledge the data processing practices described in this Privacy Policy. If you do not agree, please discontinue using the Platform.

This policy is formulated in straightforward language so that business owners and their operational teams can clearly understand how business information is managed.

We collect and process only the information necessary to provide you with a reliable billing, invoicing, purchasing, inventory management, and operational reporting experience.

2.1 Account & Authentication Information

• Full name, official email address, and contact phone number.
• Registered business name, trade name, and commercial address.
• Encrypted account credentials (passwords hashed using industry-standard bcrypt; never stored in plaintext).
• Account designation and access tier (Admin or Employee).

2.2 Customer & Ledger Data

• Customer/client business names, billing/shipping addresses, phone numbers, email addresses, and GSTIN.
• Customer ledger entries, receipts, balance adjustments, and outstanding payment records.

2.3 Supplier Data

• Supplier vendor business names, contact persons, phone numbers, and email addresses.
• Supplier billing addresses, GSTIN numbers, state codes, payment terms, opening balances, and vendor notes.
• Supplier data is entered and managed directly by your organization for inward procurement tracking.

2.4 Purchase & Inward Stock Data

• Purchase invoice numbers, inward reference identifiers, and purchase dates.
• Line item product details, invoiced quantities, free promotional quantities, purchase rates, selling rates, and MRP.
• Batch lot numbers, manufacturing dates, and expiry dates.
• Applicable tax rates (CGST, SGST, IGST), taxable amounts, discounts, and invoice totals.

2.5 Inventory, Batch & Movement Data

• Warehouse stock quantities and product catalog configurations (standard or batch-enabled).
• Batch records, lot numbers, received dates, and expiry timelines.
• Immutable StockMovement transaction ledger entries recording stock additions (purchases), deductions (sales invoices), returns (credit notes), and manual inventory adjustments.

2.6 Invoice, Payment & Credit Note Data

• Tax invoices, proforma bills, credit notes, itemized rates, discounts, and GST breakdowns.
• Internal customer payment records, payment modes (Cash, Bank Transfer, UPI, Cheque), and receipt timestamps.

2.7 Employee & Role-Based Access (RBAC) Data

• Employee user profiles, contact details, assigned system roles, and assigned granular module permissions.
• Activity and audit logs documenting employee actions within the tenant (e.g., transaction creation, modification, or cancellation) to preserve administrative traceability.

2.8 Subscription & Billing Data

• Active subscription plan (Starter, Business, or Professional), billing frequency, and validity period.
• Payment transaction references and timestamps generated by our secure third-party payment gateway partner.
• Free trial, grace period, and plan upgrade/downgrade history.

2.9 Referral Program Data

• Unique referral codes and shareable links generated for your account.
• Referral conversion statuses and credited reward days.

2.10 Technical, Browser & Device Information

• IP address, browser type and version, operating system, and hardware concurrency indicators utilized for lightweight performance optimizations.
• Application error logs, system diagnostics, and operational performance metrics.

We process your business and account data strictly for legitimate operational and business purposes, including:

• Service Delivery — Providing core billing, tax invoicing, customer ledger tracking, credit note generation, and GST-related reporting tools.
• Inventory & Batch Management — Tracking real-time warehouse stock, managing batch lots, executing automated FIFO allocation, and maintaining the inventory movement audit trail.
• Purchase & Supplier Processing — Managing inward supplier bills, tracking vendor balances, updating stock on purchase completion, and recording stock reversals upon purchase cancellation.
• Operational Reporting & Intelligence — Generating purchase summaries, movement history, supplier procurement activity, and inventory intelligence insights.
• Access Control & Team Management — Enforcing tenant isolation and role-based employee permissions configured by organization Admins.
• Account & Subscription Administration — Managing trial access, billing cycles, renewals, plan transitions, and referral rewards.
• Platform Reliability & Security — Monitoring platform health, diagnosing errors, preventing unauthorized multi-tenant access, and deterring fraudulent activity.
• Service Communications — Delivering essential administrative notifications, security alerts, policy updates, and subscription status reminders.

We do not sell, rent, monetize, or trade your personal or business data to third parties for advertising or marketing purposes.

The Platform employs a multi-tenant cloud architecture designed with strict logical segregation:

• Tenant-Scoped Queries — Every backend API request, database query, and reporting computation is strictly scoped to the authenticated user's organization identifier. No tenant can view, access, or modify another tenant's records.
• Tenant-Scoped Unique Constraints — Database indexes for customer numbers, invoice identifiers, and product codes are enforced per tenant, preventing cross-tenant data exposure.
• Admin Organization Ownership — All commercial data belongs to the organization (tenant Admin), not to individual employee users.
• Continuous Security Verification — Our authorization layers are structured to ensure that tenant context cannot be spoofed or bypassed.

• Encrypted Passwords — All passwords are encrypted with bcrypt using strong salt factors and are never stored in readable plaintext.
• Token-Based Authentication — User sessions are authenticated using secure JSON Web Tokens (JWT) that expire automatically upon inactivity.
• Role-Based Permission Middleware — All backend endpoints verify that the requesting user holds the specific permission required for the requested action.

Your data is securely hosted and processed using reputable, enterprise-grade cloud service providers:

All cloud infrastructure providers enforce encryption in transit (TLS/HTTPS) and adhere to rigorous international security and availability standards.

• Authentication Tokens — Secure storage of session tokens necessary to keep you authenticated across requests.
• User Interface Preferences — Browser local storage for theme choices, collapsed sidebar states, and table column visibility.
• Form Session Recovery — Temporary browser session storage to prevent loss of in-progress invoice or purchase entries during active typing.

We do not deploy third-party advertising cookies, behavioural retargeting pixels, or marketing trackers.

• Active Subscriptions — All business data (products, customers, suppliers, purchases, invoices, stock movements) is retained for the duration of your active account.
• Subscription Downgrades — Downgrading subscription tiers adjusts access to higher-tier features, but does not delete historical transactions, invoices, purchases, or ledger entries.
• Account Closure — Upon explicit request for account termination, tenant data is scheduled for permanent deletion from active databases within 90 days, subject to statutory retention obligations.
• Disaster Recovery Backups — Periodic automated cloud database snapshots may persist temporarily in disaster recovery archives until cycled out in accordance with standard backup rotation schedules.

We strictly protect your commercial privacy. Data is disclosed only in the following limited circumstances:

• Infrastructure Processors — Trusted cloud and payment infrastructure providers (MongoDB Atlas, Vercel, Render) strictly to the extent required to operate the Platform.
• Statutory & Legal Requirements — When disclosure is formally required by an applicable court order, law enforcement directive, or statutory government mandate under Indian law.
• Protection of Rights & Safety — To investigate security incidents, enforce our Terms & Conditions, or prevent fraud.
• Business Transfers — In the event of a merger, acquisition, or restructuring, with advance notice provided to active account holders.

To preserve data sovereignty and confidentiality, the Platform deliberately avoids unnecessary external integrations. We do not integrate with:

• Third-party advertising networks or marketing tracking networks.
• Third-party social media authentication trackers.
• External behavioral surveillance tools.

• The Platform is a software tool, not a certified accounting firm or statutory tax advisor.
• You are solely responsible for ensuring that product tax rates, HSN/SAC classifications, supplier GSTINs, customer GSTINs, and generated tax invoices comply with applicable GST legislation.
• The accuracy of tax summaries and reports depends entirely upon the rates, classifications, and entries configured by you.
• Customer payment entries recorded in the Platform are internal records entered by you; the Platform does not process external customer payments.

• Admin Authorization — Tenant Admins hold exclusive authority to create employee accounts and designate role-based module permissions.
• Subordinate Access — Employee access is granted on behalf of the tenant Admin and does not confer personal ownership of tenant data.
• Access Deactivation — Admins must promptly suspend or delete employee credentials when team members depart or reassign responsibilities.
• Activity Logging — To safeguard business records against internal errors or disputes, employee actions (including purchase entries, invoice creation, and stock adjustments) may be logged with timestamps and user identifiers.

We deploy multiple layers of technical, administrative, and physical safeguards to protect your business information:

• Encryption in Transit — All network communications between your browser and our servers are encrypted using modern Transport Layer Security (TLS/HTTPS).
• Encryption at Rest — Data stored within MongoDB Atlas is encrypted using industry-standard disk encryption.
• Password Protection — Passwords are hashed using bcrypt and are inaccessible even to our technical staff.
• Logical Tenant Isolation — Authorization middleware verifies organization scope on every database transaction.
• Vulnerability Management — Dependencies and software components are routinely patched and updated.

• Access & Review — You can access, review, and verify your business data, product catalog, customer records, supplier profiles, and transaction history directly within the Platform.
• Correction & Updates — You can update or correct erroneous business or contact details via system interfaces.
• Data Export — You may export reports, invoices, and summaries to standard spreadsheet or PDF formats for external archiving.
• Account Closure — You may request complete account termination and data purge by contacting our support team.

If you have any questions, privacy inquiries, or requests regarding the processing of your data: