Privacy Policy

Last updated: 25 September 2026

In short: we keep only what's needed to run your billing, we never sell your data or show ads, your shop's data is visible only to people you approve, and you can download or delete it.

This Privacy Policy explains how MartDesk, run by Aditya, Begusarai, Bihar, India ("we", "us") collects and uses personal data when you use the MartDesk application (the "Service"). It is written to follow India's Digital Personal Data Protection Act, 2023 and the Information Technology Act, 2000 and its rules. Words like "Shop Admin" mean the same as in our Terms.

1. Our two roles

Your own account data (the shop owner's and staff's name, email, mobile number, and payments to MartDesk): we decide how it is used, so for this we are the data fiduciary.
Data your shop keeps about its own customers and suppliers (their names, mobile numbers, udhaar, bills): your shop decides what to record and why, so your shop is the data fiduciary and MartDesk only processes it for you, as your data processor. Your shop is responsible for having a valid reason (such as the customer's consent or the sale itself) to record it.

2. What we collect

Data	Why
Name, email, mobile number, password (stored only as a secure hash by our login provider)	Create your login, identify you, contact you about your account
Shop name, address, state, GSTIN, UPI ID, logo	Print on your bills and set up GST and UPI QR
Products, prices, stock, bills, returns, purchases, customers, suppliers, khata	Run the billing, stock and khata features for your shop
Payments to MartDesk: plan, amount, UTR, optional screenshot and "paid from" note	Check and switch on your plan, keep payment records
Support messages and screenshots	Answer your questions
Basic technical data (login times, error messages, browser type)	Keep the Service secure and working

We do not collect Aadhaar, PAN, card numbers, bank passwords, location tracking or contacts from your phone. Please don't put such details in notes or screenshots.

3. Shared barcode list

When a shop saves a product with a printed barcode, the product's name, MRP, unit, category, GST % and HSN go into a list shared by all MartDesk shops, so a shop scanning the same product gets these filled in. This is product information, not personal data. Selling price, cost price, stock, sales, customers and anything about your shop are never shared.

4. Voice billing

If you use "Say items", your browser turns your speech into text using its own speech service (for Chrome, provided by Google, under Google's terms). MartDesk receives only the text and does not store any recording.

5. Who we share data with

Supabase stores the database and handles logins (data stored in the Mumbai, India region).
Vercel serves the app's files (it may serve them from servers outside India; it doesn't store your shop data).
Open Food Facts: for a barcode that isn't in our list, the app may send only the barcode number to look up a product name.
WhatsApp / email: only when you choose to send a bill, reminder or message.
Authorities, if the law requires it (for example a valid legal order).

We don't sell or rent personal data and we don't use it for advertising.

6. Who can see your shop's data

Only approved members of your shop (with limits the Shop Admin sets, for example staff can't see profit), and MartDesk when needed to run the Service, check a payment, answer support or fix a problem. The database has rules that stop one shop from reading another shop's data.

7. On your device

So billing works without internet, the app keeps a copy of your products, customers and settings, and bills not sent yet, in the browser on that device. It is removed when you log out (unless bills are still waiting to be sent). Anyone using that device and browser could see it, so use a device lock and log out on shared computers. Full list: Cookies & Storage. We use no advertising or tracking cookies and no analytics.

8. How long we keep data

Shop data: while your shop's account exists. After you ask us to delete it, within 30 days, except records the law requires us to keep.
Payments to MartDesk: as long as tax and accounting laws require.
Support messages and screenshots: up to 2 years, or sooner if you ask.
If a shop stays inactive and unpaid for 2 years, we may delete it after telling the Shop Admin on their email / mobile.

9. Security

Data is sent over HTTPS, access is controlled by login and per-shop database rules, and staff access is limited. No system is perfectly secure. If a breach affects your personal data, we will tell you and the authorities as the law requires.

10. Your rights

You can:

see and correct your data in the app, and download all your shop's data (Settings → Download all my data);
ask for a summary of your personal data and who we shared it with;
withdraw consent and ask us to delete your account and data (this ends the Service for that account);
nominate someone to use these rights for you if you die or can't act;
complain to our Grievance Officer (see Contact), and if not solved, to the Data Protection Board of India.

Your shop's customers should ask your shop about their data; we'll help your shop answer.

11. Children

The Service is for adults running or working in a shop. We don't knowingly create accounts for anyone under 18.

12. Changes

We'll post updates here and show a notice in the app for important changes.