Login
Legal

Privacy Policy & Data Use

Last updated: 30 August 2026 · Applies to the BahiQo mobile apps and this website

This Privacy Policy explains how BahiQo (“we”, “us”, “our”) collects, uses, stores, shares, and protects your information when you use our Android/iOS apps, APIs, and related services (the “Service”). BahiQo is a digital bahi khata / credit ledger for shops and small businesses.

By creating an account or using BahiQo, you agree to this Policy. If you do not agree, please do not use the Service.

Summary: We collect your mobile number to sign you in, business and ledger data you enter, optional photos/invoices you upload, and basic device/app information needed to run reminders and secure access. We do not sell your personal data.

1. Who we are

BahiQo is a brand of W3CTRL, operated for business users who maintain customer/supplier credit ledgers. For privacy requests, contact us at [email protected] (or the support email shown in the app).

2. Information we collect

2.1 Account & identity

  • Mobile number — primary login identifier (OTP-based authentication).
  • Name — optional/display name you provide.
  • Email — if you choose to add it to your profile or business.
  • Profile photo — if you upload one.

2.2 Business & ledger data (you control this content)

  • Business profile (name, mobile, address/tax ID fields if entered).
  • Customers and suppliers (name, mobile, notes, due dates, defaulter flags, photos).
  • Ledger transactions (credit, payments, opening balance, adjustments, reversals, descriptions).
  • Reminders and notification preferences.
  • Invoice/image attachments you upload to transactions.
  • Reports and balances derived from your ledger entries.

2.3 Device, security & technical data

  • Device identifiers / installation info used for push notifications and session control.
  • App version, OS type, approximate diagnostics needed to fix crashes and abuse.
  • API authentication tokens (Sanctum bearer tokens) and shared app API token usage for request validation.
  • IP address, timestamps, and security logs for fraud prevention and auditing.

2.4 Payment / subscription (if enabled)

  • Subscription plan status and payment references processed via payment partners.
  • We do not store full card numbers on BahiQo servers when payments are handled by a payment gateway.

2.5 Information we do not intentionally collect

  • We do not require Aadhaar, PAN, or bank passwords to use the core ledger.
  • We do not scrape your contacts unless you explicitly choose a feature that needs permission and grant it on the device.

3. How we use your information

  • Create and authenticate your account (OTP login/register).
  • Provide multi-business ledgers, balances, statements, reminders, and reports.
  • Store and serve media you upload (avatars, party photos, invoices) via configured storage.
  • Enforce security controls (API token, session/device limits, account deletion).
  • Improve reliability, prevent abuse, and comply with law.
  • Communicate service notices (OTP SMS, important account/security messages).

4. Legal bases (where applicable)

We process data to:

  • Perform our contract with you (provide the Service you requested).
  • Pursue legitimate interests (security, fraud prevention, product improvement) in a balanced way.
  • Meet legal obligations when required by applicable law or lawful authority requests.
  • Act on your consent where a feature is optional (e.g., uploading a photo, enabling certain notifications).

5. Data security — how we protect your information

We apply layered technical and organisational measures appropriate to a financial-ledger style app:

  • Transport security: API and admin access are served over HTTPS.
  • Authentication: Login uses OTP to your registered mobile; API calls require a shared app token plus your user bearer token; business data is scoped by business membership (X-Business-Id).
  • Access control: Server-side checks prevent accessing another business’s customers, suppliers, or ledger rows.
  • Encrypted secrets: Sensitive admin settings (API token, cloud storage keys) are stored encrypted at rest in application settings.
  • Media storage: Uploaded images/PDFs are stored on configured object storage (e.g. Cloudflare R2) or local disk with UUID filenames, type/size checks, and blocked dangerous extensions.
  • Least exposure: Password-style secrets are not echoed unnecessarily; financial edits use reverse/adjust flows instead of silent mutation of posted ledger rows.
  • Account deletion: In-app account deletion anonymises personal identifiers and revokes tokens (Apple App Store requirement).
  • Admin controls: Storage, API access, and multi-device login policies are managed from a secured admin panel.
No method of transmission or storage is 100% secure. You should protect your phone with a lock screen, not share OTPs, and revoke access on lost devices from Settings where available.

6. Data sharing

We may share data only as needed with:

  • Infrastructure providers — hosting, database, object storage (e.g. Cloudflare R2), SMS OTP gateway.
  • Push notification providers — e.g. Firebase Cloud Messaging for reminders.
  • Payment processors — if you buy a subscription.
  • Legal / safety — when required by law, court order, or to protect rights, safety, and integrity of the Service.

We do not sell your personal information or ledger contents to data brokers for advertising.

7. Data retention

  • Account and business ledger data are retained while your account is active so you can run your bahi khata.
  • After account deletion, personal identifiers are anonymised/removed as described in the deletion flow; some anonymised financial records may remain for integrity, dispute, or legal reasons.
  • Security logs and backups may be retained for a limited period for operational and compliance needs.
  • Media files linked to deleted accounts/entities are removed where technically feasible.

8. Your rights & choices

  • Access / correction: Update profile and business data in the app; contact support for help.
  • Deletion: Use in-app Delete account (Settings), or request deletion by email.
  • Notifications: Control device notification permissions in OS settings; cancel pending reminders in-app where available.
  • Media: Remove profile/party photos and transaction invoices via the app APIs/screens.

9. Children’s privacy

BahiQo is intended for business users (typically 18+). We do not knowingly collect personal information from children. If you believe a minor has created an account, contact us and we will take appropriate steps.

10. International / cross-border processing

We serve businesses in more than one country. Infrastructure or CDN/storage providers may process data in other regions under their security and contractual controls. We choose providers with industry-standard safeguards.

11. Third-party links & permissions

The app may request device permissions (camera, photos, notifications, etc.) only to support features you use. OS permission dialogs explain the purpose; you can deny or revoke them in system settings (some features will then be limited).

12. Changes to this Policy

We may update this Privacy Policy from time to time. The “Last updated” date at the top will change. Material changes may also be notified in-app or on the website. Continued use after updates means you accept the revised Policy.

13. Contact

Privacy questions or requests:
Email: [email protected]
Product: BahiQo — https://www.bahiqo.com