My Factory BillsPrivacy policy
Who we are
My Factory Bills is operated by Rajat Kamboj, operating as a sole proprietor under the name My Factory Bills, from Bazpur, Uttarakhand, India. In this policy "we" and "us" mean that entity, and "you" means the person who holds an account.
What we collect
Your account
Your email address, and a password stored only as a one-way hash — we cannot read it, and neither can anyone who obtained a copy of our database. If you tell us your firm's name, address and GSTIN, we hold those so they can be printed on your invoices.
The business records you enter
Invoices, purchases, parties, items, payments, employees, attendance and salary records. This is your data. We store and process it so the app can do its job; we do not sell it, mine it, or use it to build any profile of you or your business.
Payment information
Subscription payments are handled by Razorpay. Card numbers, UPI IDs and bank details are entered on Razorpay's systems and never reach our servers. What we keep is the subscription's status, plan, billing period and Razorpay's own identifiers for it — enough to know whether your account is paid, and nothing more.
Technical and usage data
If you consent to analytics, Google Analytics records pages visited, approximate location by country, and general device and browser information. Record identifiers are removed from page addresses before they are sent, so a URL like /invoices/<id>/edit reaches Google as /invoices/:id/edit — the identity of individual invoices, customers and employees is never transmitted.
Data about other people that you enter
This section matters more than it might appear. When you record a customer's details, or an employee's attendance and salary, you are entering personal data about someone else.
For that data, you are the Data Fiduciary under the DPDP Act — it is your relationship with those people, and your responsibility to have a lawful basis for holding it and to answer any request they make. We act as a Data Processor: we store and process it on your instructions, we do not use it for our own purposes, and we do not contact the people it describes.
Where your data is stored
In Mumbai, India. Our database runs on Supabase's Indian region (ap-south-1), so your business records stay within India in normal operation.
Two things do involve services outside India: Google Analytics, if you consent to it, and email delivery for account notices. Those carry usage and email data, not your business records.
The app also keeps a copy of your data on your own device, in the browser's local storage, so it keeps working without internet. That copy is on your phone or computer, not on our servers, and is cleared when you sign out or clear the site's data.
Who else can see it
We do not sell your data or share it for advertising. It reaches these service providers only:
| Who | What they handle |
|---|---|
| Supabase | Database and authentication — your account and business records (Mumbai, India) |
| Razorpay | Subscription payments and card details, which never reach us |
| Google Analytics | Anonymous usage statistics, only with your consent |
| Hostinger | Hosting for the website and app |
| Email delivery | Trial and renewal reminders sent to your address |
We may also disclose data where the law requires it — a valid order from a court or authority.
Cookies and analytics
Analytics is off until you agree. We use Google Consent Mode: until you choose "Accept" on the notice, no analytics cookies are stored at all. Choosing "Decline" changes nothing about how the site or app works.
We store one small cookie regardless — mfb_consent — solely to remember your answer so we stop asking. To change your mind, clear this site's cookies in your browser and the notice will appear again.
Security
Traffic is encrypted in transit. Passwords are stored only as one-way hashes. Access to your records is enforced in the database itself through row-level security, so one account cannot read another's data even if the app were tricked into asking.
We should be honest about the limit of any such statement: no system is perfectly secure. If we ever discover a breach affecting your data, we will inform you and the Data Protection Board as the DPDP Act requires.
How long we keep it
Your records are kept for as long as your account is open. If you close it, we retain data for 90 days so an account can be recovered if closing was a mistake, after which it is deleted. You can export everything to Excel or PDF at any time, and we would encourage you to do so before closing.
Some billing records are kept longer where tax and accounting law requires it.
Your rights
Under the Digital Personal Data Protection Act, 2023, you may:
- Access the personal data we hold about you.
- Correct anything inaccurate, incomplete or out of date — most of this you can edit yourself in the app.
- Erase your data, where we are not required to keep it by law.
- Withdraw consent you previously gave, as easily as you gave it.
- Nominate someone to exercise these rights if you die or become incapacitated.
- Complain to the Data Protection Board of India if we have not resolved your grievance.
To exercise any of these, write to the address in the next section. We will respond within a reasonable period.
Children
My Factory Bills is a business tool and is not intended for anyone under 18. We do not knowingly collect data from children.
Changes to this policy
If we change this policy we will update the date at the top, and tell you by email if the change is significant.
Contact and grievances
For any question about this policy, or to exercise the rights above, contact our Grievance Officer:
Rajat Kamboj
myfactorybills@gmail.com
+91 97605 27757
Bazpur, Uttarakhand, India
If you are not satisfied with our response, you may complain to the Data Protection Board of India.