Privacy Policy

This Policy applies to the public website, account registration and sign-in, the authenticated ZyBill application, cloud business records stored for a Business Account, and iblu assistant surfaces where they are enabled.

Defined terms: Company means RD Ainan Global Technologies Pvt. Ltd.. Service means ZyBill. User means a person who creates or uses a ZyBill login. Business Account means the workspace and records tied to a business membership.

We collect information you provide, information generated when you use the Service, and information you explicitly import.

Account. Name, email address, password credential data, and authentication or session information. Passwords are stored as secure one-way hashes (currently Argon2). We do not store account passwords in plain text.

Business Profile. Legal and trade name, GST registration status, GSTIN and PAN if you enter them, address, state, contact information, and bank or UPI details you voluntarily configure for invoices or payment instructions.

Customer and vendor data. Names, addresses, GSTIN, phone, email, and other transaction-related details you enter about parties you bill or pay.

Financial and operational records. Invoices, quotations, proforma invoices, delivery challans, payments, expenses, purchases, vendor bills and vendor payments, credit notes, debit notes, inventory and stock movements, and report outputs generated from those records.

Technical data. Where collected in the ordinary operation of the Service: IP address, device or browser information, server logs, authentication and session logs, and security events.

Import. Local ZyBill data you explicitly choose to import into a cloud Business Account.

iblu. If you use iblu, the Service may process your questions and a summarized view of your current Business Account (for example sales, outstanding, GST summaries, inventory, and recent activity). iblu is not currently connected to an external AI provider. Replies may be generated from structured Business Account summaries and local logic. If a live third-party model is connected later, this Policy will be updated to name the category of processor.

We use information to:

• provide, operate, and maintain the Service;
• authenticate Users and manage Business Account membership and roles;
• run billing, payments, inventory, purchases, expenses, documents, and reports;
• provide customer support and service communications;
• protect security, prevent fraud or abuse, and investigate incidents;
• improve reliability and features of the Service;
• meet legal, tax, accounting, or regulatory obligations that apply to the Company.

We aim to handle personal data in accordance with applicable Indian data protection requirements, including the Digital Personal Data Protection Act, 2023 and rules made thereunder (including the Digital Personal Data Protection Rules, 2025, as they apply), and other applicable Information Technology and consumer-protection law. Processing is subject to applicable law.

We process personal data as needed to provide the Service you request, to perform our contract with you, to protect the Service and Users, and where required or permitted by law. We do not claim that this Policy is a complete statement of every legal obligation, and we do not claim that ZyBill is “fully DPDP compliant.”

We may share information with infrastructure and hosting or database providers that process data on our instructions to operate the Service; with professional advisers under confidentiality; and with authorities when required by law, court order, or to protect rights, safety, or security. In a merger, acquisition, or similar business transfer, information may transfer as part of the assets, subject to applicable law.

We do not sell personal data for money. We do not publish a list of subprocessors here because those arrangements may change; they will be disclosed where the law requires.

We use measures appropriate to a cloud Business Account product, including authenticated access, business-scoped records so one Business Account’s data is not mixed with another’s in ordinary operation, password hashing, HTTP-only session cookies, role-based access controls, database access controls, and backups. In production, the Service is intended to be served over encrypted HTTPS.

No method of transmission or storage is completely secure. We do not promise absolute security.

We retain records for as long as reasonably necessary to provide the Service, satisfy legal or accounting obligations, resolve disputes, or enforce agreements. We do not publish a single fixed retention period in years because statutory tax and accounting retention that applies to your business may differ from operational retention for the Service.

Business Users remain responsible for how long they must keep invoices and books under GST and other applicable law, including after they stop using ZyBill.

Subject to applicable law, you may request access to information about processing, correction or updating of inaccurate personal data, erasure where applicable, withdrawal of consent where processing is based on consent, nomination of another person to exercise rights in accordance with applicable law, and raising a grievance.

Erasure is not unlimited. We may retain information where the law requires, where records are needed for accounting or tax, disputes, security, or to provide the Service you still use. Deleting a User login does not automatically erase statutory business records the Business Account must keep.

ZyBill is intended for business and professional use. We do not knowingly solicit personal data from children. If you believe a child has provided personal data, contact us using the details in the Contact section once they are published.

The Service uses essential authentication and session cookies (including Auth.js session cookies) so you can stay signed in. These cookies are required for the authenticated application.

This Policy does not describe advertising or analytics cookies because we do not claim such cookies are in use. If analytics or marketing cookies are added later, this section will be updated.

The Company uses cloud infrastructure and service providers. We do not state a specific country of storage on this page because that has not been published in legal configuration. Providers may process data in locations permitted under applicable law.

We may update this Policy as the Service or the law changes. The updated version will be posted on this page. Material changes should be reviewed before you continue using the Service. An effective or last-updated date will appear at the top of this page when configured.

Privacy and grievance requests should be sent using the contacts below when they are published.

• Phone: +91 95716 76766
• Office address: 14/86, Basement of Lenskart, Girdhar Marg, Malviya Nagar, Jaipur, Rajasthan 302017, India

Use the Contact page for general enquiries.