Privacy policy

Who we are

bookslyt is run by Bookslyt, 6th and 7th Floor, Tower 2, Phoenix H10, Phoenix SEZ Access Road, Phase 2, HITEC City, Madhapur, Hyderabad, Telangana 500081, India ("we"). This policy covers bookslyt.com, the bookslyt app, and the staff portal.

Two kinds of data, two roles

About you, the person signing in (your name, email, phone, the businesses you belong to, how you use the app): we decide how this is used, so for it we are the Data Fiduciary under the Digital Personal Data Protection Act, 2023.

Your business's records (customers, suppliers, bills, payments, bank lines, and your employees' details and pay): you decide what goes in and why, so your business is the Data Fiduciary and we process it on your behalf, only to run bookslyt for you. You are responsible for having a lawful basis to keep your employees' and customers' data, and for telling them; we help you meet their requests.

What we collect

• Account details: name, email, password (stored only as a one-way hash by our sign-in provider), and for staff, the phone number or email their employer invited.
• What you put in: business details (GSTIN, PAN, address, bank and UPI details for invoices), contacts, bills, items, payments, journal entries, bank statements and alerts you upload or forward, bill photos, and payroll data (salaries, PAN, UAN, bank accounts, attendance, leave, tax declarations).
• Statement PDF passwords you save for the email feed, stored encrypted and used only to open those statements.
• Usage and device data: pages used, errors, IP address and browser, and push-notification subscriptions if you turn reminders on.
• When you agreed to these terms and this policy.

Why we use it

• To run the service: keep your books, make invoices, payslips and reports, send the emails and reminders you ask for, and sign you in.
• To keep it safe: stop abuse and fraud, and find and fix faults.
• To bill you for a plan, and to meet our own legal and tax duties.
• To answer you when you write to us.

We don't sell personal data, don't use your books for advertising, and don't use them to train AI models.

AI features

When you scan a bill, ask a question about your books, speak an entry, or let bookslyt suggest a category, the text, photo or audio needed for that one request is sent to our AI providers (Anthropic for text and images, Sarvam AI for speech) to get an answer. They process it for us, for that request; Anthropic's commercial terms don't let it train its models on what we send. Everyday questions that bookslyt can answer from your books directly don't go to an AI provider at all.

Who helps us run it

These processors handle data for us, each only for its part:

• Supabase: the database, file storage and sign-in.
• Vercel: hosting the app (servers in Mumbai).
• Resend: sending email (invoices, invites, reports) and receiving the bank emails you forward.
• Anthropic and Sarvam AI: the AI features above.
• An SMS provider through Supabase, for staff sign-in codes; browser push services (Google, Apple, Mozilla) for reminders you turn on.

Some of these process data outside India. We only use providers with contracts that protect it, and we follow any restrictions the Government of India notifies on transfers.

How long we keep it

Your business's records are kept while your account is open. Indian law asks businesses to keep books, GST records and payroll records for at least 8 years, so we keep them until you delete them or close your account. When you ask us to close it, we delete your data within 30 days, except what we must keep by law (such as our own invoices to you), and backups, which roll off within 30 days more. Sign-in codes and security logs are kept for up to a few days.

Security

Data is encrypted in transit and at rest. Each business's records are kept apart by row-level access rules in the database, posted entries can't be edited (only voided, with a reason), and saved passwords are encrypted. Staff in your business see only what their role allows; your employees see only their own payslips. If a breach affects your personal data, we'll tell you and the Data Protection Board of India as the law requires.

Your rights

You can ask to see the personal data we hold about you, have it corrected or completed, have it erased, withdraw consent (which stops the service for the parts that need it), and nominate someone to act for you if you die or can't act. You can download your books at any time from Reports. For an employee's or customer's data in your books, they should ask the business first; we'll help the business answer.

Write to support@bookslyt.com. We answer within 7 days and act within 30.

Children

bookslyt is for businesses. You must be 18 or over to make an account, and we don't knowingly collect children's data.

Grievance Officer

Grievance Officer, bookslyt, Bookslyt, 6th and 7th Floor, Tower 2, Phoenix H10, Phoenix SEZ Access Road, Phase 2, HITEC City, Madhapur, Hyderabad, Telangana 500081, India. Email: support@bookslyt.com. We acknowledge a complaint within 24 hours and resolve it within 15 days. If you're not satisfied, you can complain to the Data Protection Board of India.

Changes

If we change this policy in a way that matters, we'll tell you in the app or by email before it applies. See also the terms.