Privacy Policy
The short version. Your shop’s data belongs to your shop. We do not sell it, we do not advertise against it, and we do not use your sales figures to train anybody’s AI model. We collect what the app needs to bill, sync and support you, and you can take it with you or have it deleted.
1. Who we are
DukanUp (“we”, “us”) operates the DukanUp Android application and the website at www.dukanup.com. For the purposes of the Digital Personal Data Protection Act, 2023, we are the Data Fiduciary for the personal data described in this policy.
Where you use DukanUp to record data about your own customers, staff and suppliers, youare the one deciding what to collect and why; we process that data on your instructions in order to provide the service to you.
2. What we collect
| Category | Examples | Source |
|---|---|---|
| Account & identity | Name, mobile number, email address, password (stored only as a hash), role (owner, manager, cashier, accountant) | You, at sign-up |
| Shop profile | Shop name, address, GSTIN, receipt header, logo, default tax and stock settings | You, in Settings |
| Business records | Invoices, line items, payments, products, stock levels, purchases, suppliers, expenses, returns, day-close figures | Created by you in the app |
| People you record | Customer names and phone numbers for khata and delivery; staff names, attendance and salary entries | Entered by you |
| Payments to us | Plan, subscription status, billing cycle, payment reference ids | Our payment processor |
| Technical & diagnostic | App version, device model, OS version, coarse language/region, crash reports, error logs | Collected automatically |
| Support | Messages you send us and the attachments you include | You |
| Founding-shop enquiries | Shop name and mobile number, if you fill in the form on our website to reserve a founding place | You, on www.dukanup.com |
| Website visits | Pages viewed and which buttons were pressed, counted in aggregate. No cookies, and nothing that identifies you | Collected automatically on www.dukanup.com |
Card details never reach us. Subscription payments are handled by our payment processor. We receive a payment reference and a status, never your card number, UPI PIN or bank credentials.
3. Why we collect it, and on what basis
| Purpose | Lawful basis |
|---|---|
| Creating your account and running the app | Performance of our contract with you |
| Syncing your bills and stock across your devices and staff | Performance of our contract |
| Taking subscription payments and issuing receipts | Contract, and legal obligation |
| Keeping tax-relevant records available to you | Legal obligation |
| Support, fraud prevention and keeping the service secure | Legitimate use / legitimate interests |
| Aggregate, non-identifying product analytics | Legitimate interests |
| Confirming your founding place and telling you the app has launched, if you asked us to on our website | Your consent, which you can withdraw at any time by replying to us |
| Counting website visits in aggregate, to see which pages help shopkeepers | Legitimate interests |
| Optional product emails and offers | Your consent, which you can withdraw at any time |
We do not sell personal data, and we do not share it with advertising networks or data brokers.
4. Device permissions we ask for
| Permission | What it is used for | If you refuse |
|---|---|---|
| Camera | Scanning product barcodes, and photographing a supplier bill for Bill Scan | You can still add products and purchases by typing |
| Notifications | Low-stock alerts, sync results, plan and payment reminders | The app works; you see the alerts inside it instead |
| Storage / photos | Saving a receipt PDF, attaching a screenshot to a support message, setting your shop logo | Sharing and printing still work through the share sheet |
| Network state | Knowing when connectivity returns so queued bills can upload | Not applicable, required for offline sync |
| Bluetooth | Connecting a thermal receipt printer | Receipts can still be shared or printed over the system printer |
DukanUp does not request contacts, precise location, SMS, or call log access.
5. Sathi AI and AI features
Sathi AI answers questions about your shop, and the AI features read supplier bills and draft product entries. How this works matters, so we are specific:
- Common questions never leave your phone. Questions like today’s sales, low stock and outstanding khata are answered from a snapshot held on the device, which is why they work offline.
- Anything else is sent to an AI provider along with only the figures needed to answer it. We send what the question requires, not your full customer list or your whole ledger.
- Your data is not used to train models. We use providers under terms that prohibit training on content submitted through their API.
- AI output can be wrong. Bill Scan produces a draft you review before saving. Nothing an AI feature produces is written to your books without your confirmation.
6. Who we share data with
Only with the service providers needed to run DukanUp, each bound by contract to use the data solely to provide their service to us:
| Provider type | What they handle | Where |
|---|---|---|
| Cloud hosting & edge network | Running the API and storing your shop’s records | India region, with global edge routing |
| Managed database | Storing invoices, stock, customers and settings | [region] |
| Authentication | Sign-in, sessions, password resets | [region] |
| Payment processor | Subscription payments and mandates | India |
| AI providers | Sathi AI answers and document reading, as described above | [region] |
| Crash & error reporting | Diagnosing app crashes | [region] |
We may also disclose data where we are legally required to (a valid order from a court or a competent authority) or to establish or defend a legal claim. If we are ever part of a merger or acquisition, your data moves with the service and we will tell you before it does.
7. How long we keep it
| Data | Retention |
|---|---|
| Account and shop profile | While your account is open, then deleted within 30 days of a deletion request |
| Invoices and tax records | Retained in a restricted archive for 8 years where required by Indian tax law, then deleted |
| Payment records | As required by law and by our payment processor |
| Crash and diagnostic logs | Up to 90 days |
| Support messages | Up to 24 months |
| Backups | Rolling backups are overwritten within 35 days of a deletion |
8. How we protect it
- All traffic between the app and our servers is encrypted in transit (TLS 1.2+); stored data is encrypted at rest.
- Session tokens are held in the device’s hardware-backed secure storage (the Android Keystore), not in plain files.
- Passwords are stored only as salted hashes. Nobody at DukanUp can read your password.
- Staff access to production data is restricted, logged, and granted only for support with a reason recorded.
- Your shop’s data is separated from every other shop’s at the query level, and your role decides what you can see inside your own shop.
No system is perfectly secure. If a breach affects your personal data, we will notify you and the Data Protection Board of India as the law requires.
9. Your rights
Under the Digital Personal Data Protection Act, 2023, you may:
- Access a summary of the personal data we hold about you and how it is processed
- Correct anything inaccurate, and complete anything incomplete
- Erase your personal data where we no longer need it for a lawful purpose
- Withdraw consent for anything you consented to, such as marketing emails
- Nominate another person to exercise these rights if you die or become incapacitated
- Complain to our Grievance Officer, and then to the Data Protection Board of India
Write to privacy@dukanup.com from your registered address. We answer within 30 days. There is no charge.
10. Deleting your account
You can delete your DukanUp account and its data from inside the app, or by request from our website. The full process, including what is deleted immediately and what is held in a restricted tax archive, is on the Delete your account page.
11. Children
DukanUp is a business tool and is not directed at children. We do not knowingly create accounts for anyone under 18. If you believe a child has an account with us, write to us and we will remove it.
12. Changes to this policy
When we change this policy we update the date at the top. For changes that meaningfully affect your rights or what we do with your data, we will tell you in the app or by email before the change takes effect.
13. Contact us
| Privacy questions | privacy@dukanup.com |
|---|---|
| Grievance Officer | grievance@dukanup.com |