1 Overview

Sava Rupee Technologies Pvt. Ltd. ("Sava Rupee", "we", "us", or "our") provides AI-powered billing and accounting software to businesses in India and elsewhere. We respect your privacy and are committed to protecting your personal data.

This Privacy Policy explains what information we collect, how we use it, when we share it, and the rights you have over your data. It applies to our website at savarupee.in, our mobile apps (Android and iOS), and our desktop and API products.

By using Sava Rupee, you agree to the practices described in this policy. If you don't agree, please don't use our services.

2 Information we collect

We collect information in three ways: information you provide to us, information collected automatically when you use our services, and information from third parties.

Information you provide

Information collected automatically

• Device & usage data — IP address, device type, OS version, browser, app version, crash logs, feature usage analytics
• Location data — coarse location derived from IP address; precise location only if you grant permission for features like mileage tracking
• Cookies & similar tech — see Section 11

Information from third parties

• Payment processors share transaction status (success/failure, amount)
• Authentication providers (Google Sign-In, Apple Sign-In) share your name and email after you authorise the connection
• Tax authorities (GSTN portal) — if you opt to file directly, we exchange filing acknowledgements

3 How we use your information

We use the information we collect to:

• Provide, maintain, and improve Sava Rupee — including syncing your data across devices, generating reports, and computing tax
• Send transactional messages (invoices, receipts, payment reminders) you create within the app to your customers
• Process subscription payments and prevent fraud or abuse
• Provide customer support, including troubleshooting issues you report
• Send service updates, security alerts, and (with your consent) marketing communications you can unsubscribe from at any time
• Analyse aggregate usage to improve product features — we never sell or rent personal data
• Comply with legal obligations including tax, audit, and lawful government requests

We rely on the following legal bases under Indian DPDP Act 2023 and the GDPR (where applicable): your consent, performance of our contract with you, our legitimate interests, and legal obligations.

4 How we share information

We never sell your personal data. We share information only in these limited situations:

• Service providers — cloud hosting (AWS Mumbai region), email delivery, error monitoring, customer support tools — all bound by data-protection agreements
• Payment processors (Razorpay, Stripe, PayPal) when you pay for a subscription
• Government & legal when required by valid Indian court order, summons, or applicable law
• Business transfers — if Sava Rupee is acquired or merges, your data may transfer to the successor, who will be bound by this policy
• With your consent for any other purpose disclosed at the time

Customer data you create in Sava Rupee (your customers, invoices, GST records) is your data — we act only as a processor and never use it for our own marketing.

5 Data retention

We keep your personal information only as long as we need to provide our services or as required by law:

Where law requires us to retain certain financial records (such as e-invoice metadata for tax audit), we retain only the minimum necessary, in encrypted form, and segregated from active systems.

6 How we protect your data

Security is a first-class feature, not an afterthought. We implement industry-standard controls:

• Encryption in transit — TLS 1.3 with HSTS for all connections
• Encryption at rest — AES-256 for stored data and database snapshots
• Access controls — strict role-based access, multi-factor required for all employees
• Audit logging — every administrative action is logged and reviewed
• Vulnerability program — annual third-party penetration tests and a public responsible-disclosure program
• SOC 2 Type II annual audit (next report available on request under NDA)

See our full Security page for technical details.

7 Your rights & choices

Under the Digital Personal Data Protection Act 2023 and other applicable laws, you have the following rights:

• Access — request a copy of the personal data we hold about you
• Correction — ask us to correct inaccurate or incomplete data
• Erasure — request deletion of your data (see Section 8)
• Portability — receive your data in a structured, machine-readable format (CSV / JSON)
• Withdraw consent — opt out of marketing or specific processing activities
• Object & restrict — limit how we process your data in certain circumstances
• Grievance — complain to our Grievance Officer (Section 13) or to the Data Protection Board of India

To exercise any of these rights, email privacy@savarupee.in. We respond within 30 days.

8 Delete your account & data

You can request permanent deletion of your Sava Rupee account and the personal data we hold about you at any time. This section explains exactly what gets deleted, what gets retained for legal reasons, and how to start the request — meeting Google Play and Apple App Store data-deletion requirements.

How to request deletion

You can request account deletion through any of the following channels — no account login or subscription required:

What gets deleted

Once you confirm deletion and the 14-day grace period ends, the following data is permanently erased from our production systems:

• Your profile (name, email, phone, password hash, business name, profile photo, logo)
• App preferences and settings
• Linked devices, push-notification tokens, and active sessions
• Support transcripts and chat messages with our team
• Saved templates, draft documents, and unsubmitted forms
• Analytics events, in-app messages, and feature-usage data tied to your account
• Payment-method tokens (we never store full card numbers)

What is retained (and why)

Specifically, we retain the following only in encrypted, segregated archives not accessible from active systems:

The retained data is access-restricted, contains no contact information or content, and is fully purged at the end of the legal retention period. It cannot be used to identify or contact you outside of a formal legal request.

14-day grace period & cancellation

After you confirm deletion, your account is immediately locked and inaccessible — but the actual data erasure happens 14 days later. This grace period exists so you can:

• Reverse the decision if you change your mind (sign in within 14 days and click "Restore account")
• Recover any data you forgot to export

After day 14, deletion is irreversible.

Data export before deletion

We strongly recommend exporting your data before requesting deletion:

• Invoices & estimates — Settings → Export → Choose PDF or Excel
• Customer list — Settings → Export → Customers (CSV)
• Full data archive — Settings → Privacy → "Download my data" (ZIP, generated within 24 hours and delivered by email)

Backups

Encrypted database backups containing your data are kept on a rolling 35-day window. These cannot be selectively edited (it would compromise their integrity for disaster recovery). After 35 days, backups containing your data are fully overwritten.

Third parties

When you delete your account, we notify our processors (email provider, error monitoring, push-notification services) to delete your data on their systems within their own deletion timelines (typically 30–90 days).

9 Children's privacy

Sava Rupee is a business tool not directed at children under 18. We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, contact us and we will delete it promptly.

10 International data transfers

Sava Rupee primary servers are located in AWS Mumbai (ap-south-1). Some service providers (email delivery, error monitoring) may process limited data outside India. We use Standard Contractual Clauses and equivalent safeguards for any cross-border transfer of personal data.

11 Cookies & tracking technologies

We use cookies and similar technologies to:

• Keep you signed in (session cookies, essential)
• Remember your preferences like theme and language (preference cookies)
• Understand product usage in aggregate (analytics cookies — anonymised)

We do not use third-party advertising cookies or cross-site tracking. You can refuse non-essential cookies via the consent banner that appears on first visit, or by clearing cookies in your browser. Refusing analytics cookies does not affect product functionality.

12 Changes to this policy

We may update this Privacy Policy from time to time to reflect changes in our services, applicable laws, or industry practices. When we make material changes we will:

• Update the "Last updated" date at the top of this page
• Notify you by email if changes materially affect your rights
• Post a banner on the app for at least 30 days before the new terms take effect

13 Contact us

For privacy questions, data-access requests, or to file a complaint:

• Email: privacy@savarupee.in
• Account deletion: delete@savarupee.in
• Postal address: Sava Rupee Technologies Pvt. Ltd., 123 Business Park, Ahmedabad, Gujarat 380015, India

Grievance Officer

As required by the DPDP Act 2023 and IT Rules 2021:

• Name: Ms. Priya Mehta
• Email: grievance@savarupee.in
• Phone: +91 98765 43210 (Mon–Fri, 10:00–18:00 IST)

The Grievance Officer responds to complaints within 15 working days as required by Indian regulations.

1 Acceptance of terms

These Terms of Service ("Terms") form a binding contract between you and Sava Rupee Technologies Pvt. Ltd., a company incorporated in India with its registered office at 123 Business Park, Ahmedabad, Gujarat 380015 ("Sava Rupee", "we", "our").

By creating an account, accessing, or using any Sava Rupee product — including our website, mobile apps (Android, iOS), desktop application, or API — you agree to be bound by these Terms and our Privacy Policy. If you do not agree, do not use the services.

2 Eligibility & account

To use Sava Rupee you must:

• Be at least 18 years of age and have the legal capacity to enter into contracts
• If signing up on behalf of a company or other legal entity, have the authority to bind that entity
• Not be barred from receiving services under Indian law or any other applicable jurisdiction

You are responsible for keeping your login credentials confidential and for all activity under your account. Notify us immediately at security@savarupee.in if you suspect unauthorised access. We may suspend accounts that show signs of compromise.

3 Subscription & payment

Plans & pricing

Sava Rupee is offered on a subscription basis (monthly or annual). Plan details and current pricing are shown on our pricing page. Prices are in Indian Rupees (INR) and exclusive of GST, which will be added to your invoice as per applicable law.

Billing

• Subscription fees are billed in advance for the chosen billing cycle
• Payment methods accepted: credit/debit card, UPI, net banking, and bank transfer
• Subscriptions auto-renew at the end of each billing cycle unless cancelled at least 24 hours before renewal
• Failed payments may result in service suspension after a 7-day grace period

Refunds

We offer a 7-day money-back guarantee on new monthly subscriptions and a 30-day money-back guarantee on new annual subscriptions. Refund requests after these windows are reviewed case-by-case. Refunds are issued to the original payment method within 7–10 business days.

Price changes

We may revise prices with at least 30 days' notice. Price changes apply only to new billing cycles after the notice period.

4 Free trial

New customers may receive a 7-day free trial. No credit card is required to start the trial. After the trial:

• If you subscribe, you keep all your data and continue without interruption
• If you don't subscribe, your account becomes read-only for 30 days — you can export data but not create new records
• After 30 days of inactivity, the trial account is permanently deleted

One trial per business entity. Abuse of multiple trial accounts may result in termination.

5 Your content & data

Everything you create in Sava Rupee — your invoices, customers, financial records, templates, logos, signatures — belongs to you. We do not claim ownership over your business data.

You grant us a limited, non-exclusive licence to host, store, transmit, and display your content solely to provide the service. We will never use your content to train AI models, market to your customers, or sell to third parties.

You represent that you have the rights to all content you upload (especially logos, signatures, and customer data) and that your use of the service complies with applicable laws including the Indian Income Tax Act, GST Act, and data-protection laws.

6 Acceptable use

You may not, and may not permit anyone else to:

• Use Sava Rupee for any unlawful purpose, including tax evasion, money laundering, or fraud
• Issue invoices for goods or services you did not actually provide
• Reverse-engineer, decompile, or attempt to extract source code from our apps
• Probe, scan, or test the vulnerability of our infrastructure without our written authorisation
• Use the service to send unsolicited bulk email (spam) or harass others
• Resell, sub-licence, or white-label the service without a separate agreement
• Upload viruses, malware, or any code intended to harm our systems or other users
• Use automated means (bots, scrapers) to access the service beyond our published API rate limits
• Impersonate any person or entity or misrepresent your affiliation

Violations may result in immediate suspension or termination without refund.

7 Service availability

We target 99.9% monthly uptime excluding scheduled maintenance windows announced at least 48 hours in advance. Real-time status and historical uptime are published at status.savarupee.in.

For paid annual subscriptions, if we fail to meet the 99.9% uptime SLA in a calendar month, you may request a service credit of 10% of that month's fee (capped at 50% per quarter). Submit credit requests to billing@savarupee.in within 30 days of the incident.

8 Intellectual property

The Sava Rupee software, brand, logo, design, documentation, and underlying technology are owned by Sava Rupee Technologies Pvt. Ltd. and protected by Indian and international intellectual property laws. These Terms grant you a limited, non-exclusive, non-transferable, revocable licence to use the service for your own internal business purposes — nothing more.

You may not remove or alter our copyright notices, branding, or trademarks from any part of the service.

If you provide feedback, suggestions, or improvement ideas, you grant us a perpetual, royalty-free licence to incorporate them into the product without obligation.

9 Termination

By you

You can cancel your subscription at any time from Settings → Subscription. Cancellation takes effect at the end of the current billing cycle — you continue to have access until then. To delete your account and data, see Section 8 of our Privacy Policy.

By us

We may suspend or terminate your account immediately if you:

• Materially breach these Terms (especially Section 6 — Acceptable Use)
• Fail to pay overdue charges after a 14-day cure notice
• Use the service in a way that exposes us to legal or regulatory risk

On termination, your right to use the service ends. We retain data as described in our Privacy Policy and applicable law.

10 Disclaimers

SAVA RUPEE PROVIDES THE SERVICE "AS IS" AND "AS AVAILABLE". To the maximum extent permitted by law, we disclaim all warranties — express, implied, statutory, or otherwise — including fitness for a particular purpose, merchantability, and non-infringement.

Important — tax disclaimer: Sava Rupee is a tool that helps you compute and prepare GST returns, e-invoices, and other tax records. It is not a substitute for professional tax advice. Final responsibility for the accuracy and timely filing of your tax returns rests with you and your tax advisor.

11 Limitation of liability

To the maximum extent permitted by law:

• Sava Rupee's total liability under or in connection with these Terms in any 12-month period shall not exceed the fees you paid to us in that period
• Neither party is liable for indirect, incidental, special, consequential, or punitive damages — including lost profits, lost revenue, lost data, business interruption, or goodwill
• These limits apply regardless of the cause of action (contract, tort, statute, or otherwise), even if we were advised of the possibility of such damages

Some jurisdictions don't allow exclusion of certain warranties or liabilities, so parts of this section may not apply to you.

12 Indemnification

You will defend, indemnify, and hold harmless Sava Rupee and its affiliates from claims arising out of:

• Your violation of these Terms or applicable law
• Your content infringing the rights of any third party
• Your tax filings or business activities conducted through the service

13 Governing law & dispute resolution

These Terms are governed by the laws of India. Any dispute will be resolved as follows:

1. Informal resolution: contact legal@savarupee.in first. We will respond within 15 working days and try to resolve in good faith.
2. Arbitration: if unresolved within 60 days, the dispute will be settled by arbitration under the Arbitration and Conciliation Act 1996, by a sole arbitrator appointed by mutual agreement, seated in Ahmedabad, Gujarat, in English.
3. Courts: only the courts of Ahmedabad have exclusive jurisdiction for matters not subject to arbitration (e.g., injunctive relief for IP infringement).

14 Changes to these Terms

We may modify these Terms from time to time. Material changes will be announced at least 30 days in advance by email and in-app notification. Continued use after the effective date constitutes acceptance. If you don't agree to the changes, cancel your subscription before they take effect.

15 Contact

Questions about these Terms? Write to us:

• Legal: legal@savarupee.in
• Billing: billing@savarupee.in
• Support: hello@savarupee.in
• Postal: Sava Rupee Technologies Pvt. Ltd., 123 Business Park, Ahmedabad, Gujarat 380015, India

1 Our security commitment

Sava Rupee stores invoices, financial records, and customer data for thousands of businesses across India. We take that responsibility seriously. Security is built into every layer of our product — infrastructure, code, processes, and people.

This page describes the technical and organisational measures we use to protect your data. It's a living document — we update it as our practices evolve.

2 Infrastructure & hosting

Sava Rupee runs on Amazon Web Services (AWS) in the Mumbai region (ap-south-1), an Indian data centre meeting AWS's strict physical security standards. All customer data is stored within India, supporting data-localisation requirements under the DPDP Act.

Our architecture is built on AWS managed services:

• Compute on AWS ECS Fargate (no shared kernels, isolated containers)
• Data persistence on AWS RDS (PostgreSQL, encrypted) and S3 (object storage, encrypted)
• CDN via Amazon CloudFront with WAF (Web Application Firewall) rules
• Secrets stored in AWS Secrets Manager with automatic rotation
• Network segmentation via VPC, private subnets, and security groups

Production environments are completely isolated from development and staging. No customer data ever resides in non-production systems.

3 Encryption

In transit

• All connections use TLS 1.3 with strong cipher suites (AES-256-GCM, ChaCha20-Poly1305)
• HSTS (HTTP Strict Transport Security) enforced with 1-year max-age and includeSubDomains
• Certificates issued by Amazon Trust Services and rotated automatically
• Older TLS (1.0, 1.1) is disabled

At rest

• Database encryption with AES-256 keys managed by AWS KMS
• S3 object encryption (SSE-KMS) for file uploads (logos, attachments, exports)
• Backups encrypted with separate, region-restricted keys
• Sensitive fields (passwords, API tokens) double-encrypted at application level using argon2id / authenticated AES

Application secrets

Secrets are never stored in source code or container images. They are retrieved at boot-time from AWS Secrets Manager and rotated quarterly.

4 Access control

Customer accounts

• Passwords hashed with argon2id (memory cost 64 MiB, 3 iterations, 4 parallel lanes)
• Optional two-factor authentication (TOTP via authenticator app)
• Session tokens are signed JWTs with 7-day expiry, revocable on logout or password change
• Account lockout after 10 failed login attempts (sliding 15-minute window)
• Email notification on every new device sign-in

Employee access

• Production access requires SSO + hardware MFA (YubiKey)
• Just-in-time, time-bound access — no standing production credentials
• Strict role-based access control — engineers access only what their role requires
• All administrative actions are logged to an append-only audit trail
• Background checks on all employees with production access
• Quarterly access reviews; immediate revocation on role change or offboarding

No single employee can access your data without leaving an audit trail and obtaining peer approval for sensitive operations.

5 Application security

Development lifecycle

• Every code change goes through peer review before merging to main
• Automated static analysis (SAST) on every pull request
• Software composition analysis (SCA) for third-party dependencies; high/critical CVEs block deployment
• Dynamic application security testing (DAST) runs nightly against staging
• Mandatory secure-coding training for engineers (annual refresh)

Protection against common attacks

6 Backups & disaster recovery

• Automated daily backups with 35-day retention
• Point-in-time recovery available for the last 7 days (5-minute granularity)
• Backups encrypted with separate KMS keys; restoration procedures tested quarterly
• Cross-AZ replication for primary databases — automatic failover within 60 seconds
• RPO (Recovery Point Objective): ≤ 5 minutes  ·  RTO (Recovery Time Objective): ≤ 1 hour

7 Monitoring & incident response

• 24×7 monitoring of infrastructure, application performance, and security events
• Anomaly detection on authentication patterns, API usage, and data access
• Centralised log management with 180-day retention; logs tamper-proofed via write-once storage
• Documented incident response plan with named roles and escalation paths
• If a security incident affects your data, we will notify you within 72 hours as required by the DPDP Act
• Post-incident reports published publicly when appropriate

8 Compliance & certifications

• SOC 2 Type II — annual audit by an independent CPA firm (report available under NDA)
• ISO/IEC 27001 — certification in progress (target: Q4 2026)
• DPDP Act 2023 — compliant data-protection program with appointed Grievance Officer
• GST e-Invoice — integrated with GSTN via authorised IRP (Invoice Registration Portal)
• PCI DSS — we do not store full card numbers; payment processing is handled by PCI-DSS Level 1 partners (Razorpay, Stripe)
• Annual third-party penetration tests by accredited security firms; latest report summary available on request

9 Vulnerability disclosure

We welcome reports from security researchers. If you discover a vulnerability:

1. Email security@savarupee.in with details and reproduction steps
2. Encrypt sensitive details with our PGP key (fingerprint published at /.well-known/security.txt)
3. Give us reasonable time to investigate and remediate before public disclosure (we target 90 days)
4. Avoid actions that could harm users, data, or service availability during testing

In return, we commit to:

• Acknowledge your report within 2 business days
• Provide regular status updates
• Credit you in our Hall of Fame (with permission)
• Pay a bounty for valid vulnerabilities — amounts range from ₹5,000 (low) to ₹2,50,000 (critical)

10 Your role in security

Strong security is a shared responsibility. Help us keep your data safe by:

• Using a strong, unique password (we recommend a password manager)
• Enabling two-factor authentication (Settings → Security)
• Reviewing your active sessions regularly and signing out unused devices
• Keeping your devices and the Sava Rupee app updated to the latest version
• Being alert for phishing — we will never ask for your password by email or phone
• Reporting suspicious activity to security@savarupee.in immediately

11 Contact our security team

• Security reports: security@savarupee.in
• Status page: status.savarupee.in
• Compliance & audit requests: compliance@savarupee.in