LEGAL

Privacy Policy

Last updated: May 2, 2026

🇮🇳 All your data is stored in India. We comply with the Digital Personal Data Protection Act, 2023 (DPDP Act).

1. What Data We Collect

Account data:

→WhatsApp number (for authentication)
→Name, email (optional)
→Business name, GST registration details

Financial data (you provide):

→Invoices, receipts, bank statements
→Payroll, employee information
→GST returns, TDS data
→All accounting entries

Usage data (automatic):

→Pages visited, features used
→WhatsApp messages sent to OnGravy
→Error logs for debugging
→Device type, browser

2. How We Use Your Data

→To provide and improve OnGravy
→To auto-fill GST returns with your transaction data
→To send proactive alerts (GST deadlines, fraud alerts)
→To generate reports and insights
→To send billing notifications
→We do NOT use your data to train AI models
→We do NOT sell your data to any third party

3. Where Data Is Stored

All data is stored in India:

→Database: Supabase, Mumbai (AWS ap-south-1)
→Cache: Upstash Redis, Mumbai
→Files: Supabase Storage, Mumbai

We do not transfer data outside India except for payment processing via Razorpay (India-based) and WhatsApp API via Meta (messages only, not financial data).

4. Data Sharing

We share data only with:

→GST Portal (GSTN) — only when you file returns
→Razorpay — only payment amounts, never full financial data
→WhatsApp (Meta) — only the messages you send to OnGravy
→AWS Textract — OCR processing (not stored by AWS)

We never share with: Advertisers · Data brokers · Other companies for marketing

5. Data Retention

→Active accounts: data kept as long as subscription is active
→Cancelled accounts: 90-day export window, then permanently deleted
→Audit logs: kept for 7 years (GST compliance requirement)
→WhatsApp messages: not stored after processing

6. Your Rights (DPDP Act 2023)

You have the right to:

→Access all your data (export from Settings)
→Correct inaccurate data
→Delete your account and all data
→Know who we share data with
→Withdraw consent (will terminate service)

To exercise your rights: privacy@ongravy.in

7. Security

→AES-256-GCM encryption for sensitive fields
→HTTPS everywhere, TLS 1.3
→WhatsApp OTP authentication — no passwords
→Row-level security: your data is completely isolated
→Regular security audits
→No employee can access your financial data without your consent

8. Cookies

We use only essential cookies: authentication session and theme preference (dark/light). We do not use advertising or tracking cookies of any kind.

9. Children

OnGravy is not intended for users under 18. We do not knowingly collect data from minors.

10. Contact

Privacy Officer: Pratik Revankar
Email: privacy@ongravy.in
Address: OnGravy Technologies Pvt Ltd, Goa, India