Privacy Policy
The short version. Your shop’s data belongs to your shop. We do not sell it, we do not advertise against it, and we do not use your sales figures to train anybody’s AI model. We collect what the app needs to bill, sync and support you, and you can take it with you or have it deleted.
1. Who we are
DukanUp (“we”, “us”) operates the DukanUp Android application and the website at www.dukanup.com. For the purposes of the Digital Personal Data Protection Act, 2023, we are the Data Fiduciary for the personal data described in this policy.
Where you use DukanUp to record data about your own customers, staff and suppliers, youare the one deciding what to collect and why; we process that data on your instructions in order to provide the service to you.
2. What we collect
| Category | Examples | Source |
|---|---|---|
| Account & identity | Name, mobile number, email address, password (stored only as a hash), role (owner, manager, cashier, accountant). If you choose Sign in with Google: the name and email address on your Google account, and nothing else from it | You, at sign-up; Google, if you sign in with Google |
| Shop profile | Shop name, address, GSTIN, receipt header, logo, default tax and stock settings | You, in Settings |
| Business records | Invoices, line items, payments, products, stock levels, purchases, suppliers, expenses, returns, day-close figures | Created by you in the app |
| People you record | Customer names and phone numbers for khata and delivery; staff names, attendance and salary entries | Entered by you |
| Payments to us | Plan, subscription status, billing cycle, payment reference ids | Our payment processor |
| Technical & diagnostic | App version, device model, OS version, coarse language/region, error logs from our servers, and a notification token so we can send alerts to your phone | Collected automatically |
| Voice billing usage | Counts only: how many items were heard, how many you corrected, and how long the voice sheet was open. Never the audio and never what was said | Collected automatically when you use voice billing |
| Support | Messages you send us and the attachments you include | You |
| Website visits | Pages viewed and which buttons were pressed, counted in aggregate. No cookies, and nothing that identifies you. Our videos load nothing from YouTube until you press play; once you do, the video is played by YouTube (youtube-nocookie.com) and Google's privacy policy applies to that playback | Collected automatically on www.dukanup.com |
Card details never reach us. Subscription payments are handled by our payment processor. We receive a payment reference and a status, never your card number, UPI PIN or bank credentials.
3. Why we collect it, and on what basis
| Purpose | Lawful basis |
|---|---|
| Creating your account and running the app | Performance of our contract with you |
| Syncing your bills and stock across your devices and staff | Performance of our contract |
| Taking subscription payments and issuing receipts | Contract, and legal obligation |
| Keeping tax-relevant records available to you | Legal obligation |
| Support, fraud prevention and keeping the service secure | Legitimate use / legitimate interests |
| Aggregate, non-identifying product analytics | Legitimate interests |
| Counting website visits in aggregate, to see which pages help shopkeepers | Legitimate interests |
| Optional product emails and offers | Your consent, which you can withdraw at any time |
We do not sell personal data, and we do not share it with advertising networks or data brokers.
4. Device permissions we ask for
| Permission | What it is used for | If you refuse |
|---|---|---|
| Camera | Scanning product barcodes, and photographing a supplier bill for Bill Scan | You can still add products and purchases by typing |
| Microphone | Voice billing: you say the items and quantities, and the app turns the words into bill lines for you to check. Your phone’s own speech-recognition service (on most phones, Google’s) converts the speech to text, on the phone or on that provider’s servers, under its own privacy terms. DukanUp receives only the text, never the recording, and does not store either | You can still bill by scanning, searching or typing |
| Notifications | Low-stock alerts, sync results, plan and payment reminders | The app works; you see the alerts inside it instead |
| Storage / photos | Saving a receipt PDF, attaching a screenshot to a support message, setting your shop logo | Sharing and printing still work through the share sheet |
| Network state | Knowing when connectivity returns so queued bills can upload | Not applicable, required for offline sync |
DukanUp does not request contacts, precise location, SMS, call log or Bluetooth access. Receipts print through your phone’s own print option, or are shared as a PDF.
5. Sathi AI and AI features
Sathi AI answers questions about your shop, and the AI features read supplier bills and draft product entries. How this works matters, so we are specific:
- Common questions never go to an AI provider. Questions like today’s sales, low stock and outstanding khata are answered by DukanUp itself from your shop’s figures: on our servers when you are online, and from a snapshot held on your phone when you are offline.
- Anything else is sent to an AI provider along with only the figures needed to answer it. We send what the question requires, not your full customer list or your whole ledger.
- Your data is not used to train models. We use providers under terms that prohibit training on content submitted through their API.
- AI output can be wrong. Bill Scan produces a draft you review before saving. Nothing an AI feature produces is written to your books without your confirmation.
6. Who we share data with
Only with the service providers needed to run DukanUp, each bound by contract to use the data solely to provide their service to us:
| Provider type | What they handle | Where |
|---|---|---|
| Cloud hosting & edge network | Running the API and storing your shop’s records | India region, with global edge routing |
| Managed database | Storing invoices, stock, customers and settings | India (Mumbai) |
| Authentication | Sign-in, sessions, password resets | India (Mumbai) |
| Payment processor | Subscription payments and mandates | India |
| AI providers | Sathi AI answers and document reading, as described above | United States |
| Push notifications (Google Firebase Cloud Messaging) | Delivering alerts and support replies to your phone, using a notification token | Global |
| Sign in with Google (Google) | Confirming who you are, only if you choose to sign in with Google | Global |
Your shop’s records are stored in India. A question you send to Sathi AI, with the figures needed to answer it, and a supplier bill you scan, are processed by our AI provider outside India, in the United States.
We may also disclose data where we are legally required to (a valid order from a court or a competent authority) or to establish or defend a legal claim. If we are ever part of a merger or acquisition, your data moves with the service and we will tell you before it does.
7. How long we keep it
| Data | Retention |
|---|---|
| Account, shop profile, and the people recorded in your shop | While your account is open. Deleted at once when you delete your account in the app (Settings › Delete my account), or within 30 days of a request by email; see Delete your account |
| Invoices and tax records | Retained in a restricted archive, with personal details removed, for as long as Indian tax law requires books of account to be kept: six years under the Income-tax rules and seventy-two months under GST, counted from the end of the relevant year, so up to 8 years. Then deleted |
| Payment records | As required by law and by our payment processor |
| Diagnostic logs | Up to 90 days |
| Support messages | Up to 24 months |
| Backups | Rolling backups are overwritten within 35 days of a deletion |
8. How we protect it
- All traffic between the app and our servers is encrypted in transit (TLS 1.2+); stored data is encrypted at rest.
- Session tokens are held in the device’s hardware-backed secure storage (the Android Keystore), not in plain files.
- Passwords are stored only as salted hashes. Nobody at DukanUp can read your password.
- Staff access to production data is restricted, logged, and granted only for support with a reason recorded.
- Your shop’s data is separated from every other shop’s at the query level, and your role decides what you can see inside your own shop.
No system is perfectly secure. If a breach affects your personal data, we will notify you and the Data Protection Board of India as the law requires.
9. Your rights
Under the Digital Personal Data Protection Act, 2023, you may:
- Access a summary of the personal data we hold about you and how it is processed
- Correct anything inaccurate, and complete anything incomplete
- Erase your personal data where we no longer need it for a lawful purpose
- Withdraw consent for anything you consented to, such as marketing emails
- Nominate another person to exercise these rights if you die or become incapacitated
- Complain to our Grievance Officer, and then to the Data Protection Board of India
Write to privacy@dukanup.com from your registered address. We answer within 30 days. There is no charge.
10. Deleting your account
You can delete your DukanUp account and its data from inside the app, or by request from our website. The full process, including what is deleted immediately and what is held in a restricted tax archive, is on the Delete your account page.
11. Children
DukanUp is a business tool and is not directed at children. We do not knowingly create accounts for anyone under 18. If you believe a child has an account with us, write to us and we will remove it.
12. Changes to this policy
When we change this policy we update the date at the top. For changes that meaningfully affect your rights or what we do with your data, we will tell you in the app or by email before the change takes effect.
13. Contact us
| Privacy questions | privacy@dukanup.com |
|---|---|
| Grievance Officer | grievance@dukanup.com |