Privacy Policy

1. Who this applies to

This policy applies to visitors to our website, trial users, paying subscribers, and anyone who interacts with our support or marketing channels. It covers the Courier Billing web application and related infrastructure (for example hosting, authentication, and payment pages linked from the app).

For users in India, we process personal data in line with the Digital Personal Data Protection Act, 2023 (“DPDPA”), as applicable. We act as the Data Fiduciary for personal data you provide or that we collect about you in connection with the service. You may contact us using the details in Section 14, and where the law allows, you may also approach the Data Protection Board of India.

2. Categories of information we collect

We collect only what is reasonably needed to run, secure, bill for, and improve Courier Billing:

• Account and profile: name, email address, password (stored using one-way hashing where we control storage), optional phone number, and profile or organisation details you add.
• Sign-in with Google (if you use it): when you choose Google authentication, Google may share with us (via our auth provider) identifiers such as your Google account ID and email, as permitted by your Google settings and Google’s policies.
• Business, tax, and branding data: company or Franchise name, addresses, GSTIN or other tax identifiers, bank or payment-instruction text you place on invoices, logos or letterhead assets you upload, and similar fields needed for GST-ready invoices and records.
• Operational billing data (your “content”): data you import or enter—such as upload sessions, consignment or booking rows, client master data, pricing slabs, assignments between clients and consignments, invoice drafts, generated invoice numbers, PDFs, notes, and corrections you make in the product.
• Daily bookings, walk-ins, expenses, and Booking Data: counter and walk-in booking entries, expense records, and the Booking Data (DSR) rows you upload, including consignment numbers, destination PIN codes, weights, COD values, and any amounts you type in by hand. Walk-in entries can include customer-related details you choose to record.
• Billing-location and pricing setup: the origin, state, zone, and lane settings you configure so that parcels are classified and priced correctly, and the rate cards you maintain for each client. We also hold cost and profit figures we calculate from these settings.
• Referral and verification data: the email address of a person who referred you (or whom you referred), which we use only to apply referral credit, and one-time codes we email you to verify signup or sensitive actions.
• Payment metadata: subscription status, plan tier, billing period dates, transaction IDs, payment status, and limited payment-method labels. Card or UPI account numbers are handled by our regulated payment partner; we do not store full card numbers.
• Technical, security, and support data: IP address, device and browser type, approximate timestamps, authentication events, the referring site hostname (so we can see which channels send visitors, in aggregate on the admin dashboard), feature usage needed to operate the service, crash or error diagnostics (tied to an internal user ID, not your name or email), page-performance measurements, support ticket content you send us, and abuse-prevention signals. We do not store full referring URLs.
• Local device storage (offline / performance): the application may cache parts of your data on your device (for example via browser storage) so that you can work with reduced connectivity. That includes changes you have made but that have not yet synced, which wait in a local queue and are sent when your connection returns. That data stays under your control on the device until synced, cleared, or overwritten.

We do not sell personal data. We do not use your consignment or client lists to advertise third-party products, and we do not build individual “profiles” for unrelated marketing.

3. How and why we use information

We process data on lawful bases recognised under applicable law, including: performance of our agreement with you (providing the service you signed up for), your consent where we ask for it (for example marketing emails if we ever offer them separately), and legitimate interests that are not overridden by your rights (for example securing accounts, preventing fraud, improving reliability, and limited product analytics in aggregate form).

• Host, authenticate, and deliver the Courier Billing application and its features.
• Process subscriptions and payments, send receipts, and handle billing support.
• Store and retrieve your uploads, assignments, pricing calculations, and invoice PDFs as you use the product.
• Calculate GST, client prices, estimated courier costs, expenses, profit, and analytics from the data you enter or upload, and match your walk-in and client consignments against your Booking Data.
• Apply referral credit and free-trial or plan entitlements to your account.
• Send service messages (security alerts, password resets, critical product notices, subscription lifecycle emails).
• Detect, investigate, and block abuse, attacks, or policy violations.
• Meet legal, regulatory, and tax record-keeping duties, and respond to lawful requests from authorities.
• Improve stability and performance, including through aggregated or de-identified statistics where feasible.

We do not use solely automated processing to make decisions about you that produce legal or similarly significant effects, beyond ordinary account security (such as blocking clearly abusive logins).

4. Processors and other recipients

We use vetted service providers (“processors”) who process data on our instructions and under contract. Depending on how you use Courier Billing, this may include:

• Database, authentication, and file storage (Supabase) for account storage, application data, sign-in, private file storage (including cached invoice PDFs and uploaded spreadsheets awaiting processing), and backups.
• Web hosting and delivery (Vercel) to serve the website and application, including aggregate page-view and performance measurement (Vercel Web Analytics and Speed Insights).
• Background processing (Fly.io) to process large uploads and, when your device cannot do so, to render invoice PDFs. Servers used for this are located in Singapore.
• Payment services (Razorpay) for collecting subscription fees and processing refunds where applicable.
• Transactional email (Resend) for verification codes and support messages. Sign-up confirmation and password-reset emails are sent by our authentication provider.
• Error monitoring (Sentry) to find and fix crashes. We configure it not to send default personal data, we attach only an internal user ID, and we scrub free-text fields before events are sent.

We may also disclose information if we reasonably believe disclosure is required to comply with law, enforce our Terms, protect users or the public, or as part of a merger, acquisition, or asset sale— in the latter case we will require the successor to honour this policy or notify you of material changes as required by law.

5. International transfers

Our primary users are in India, but servers or subprocessors may be located in India and other countries. For example, our background-processing servers are in Singapore, and our error-monitoring and analytics providers may process limited technical data outside India. Where personal data is transferred across borders, we implement safeguards consistent with applicable law (such as contractual clauses or intra-group arrangements) and we assess the necessity of each transfer.

6. Retention

We keep personal and business data for as long as your account is active and for a reasonable period afterwards to resolve disputes, enforce agreements, and comply with law. Certain billing, invoice, and tax-related records may be retained for longer periods where statute or regulation requires (for example multi-year retention for GST ledgers in India). Invoice PDFs are stored once and reused for later downloads for as long as the invoice exists; deleting an invoice removes it from your account. Spreadsheets you upload are used to process your bookings and are not used for any other purpose. When you delete your account from Profile → Security, we delete your account and workspace data, except records we must keep by law. When retention periods end, we delete or irreversibly anonymise data where feasible.

7. Security

We use administrative, technical, and organisational measures appropriate to the risk, including:

• Encryption in transit (HTTPS/TLS) for browser and API traffic, plus browser security headers and a content-security policy that limits which sites the app can load code from or send data to.
• Tenant isolation: database row-level security keeps each account’s data separate. Privileged database functions check ownership before they change anything, and administrative functions are not callable from the public internet.
• Sign-in protection: passwords are hashed by our authentication provider, email verification codes are used at signup and for sensitive actions, and repeated attempts on sensitive endpoints are rate-limited.
• Files: uploads and cached invoice PDFs are kept in private storage. Downloads use short-lived signed links rather than public URLs.
• Payments: card and UPI details go directly to Razorpay. We verify the signature on every payment notification before changing an account’s plan.
• Engineering practice: automated secret scanning and database-migration checks run on every change, we review dependencies, and error reports exclude your name and email.
• Backups to support recovery from hardware or software failure.
• Your device: because the app can keep an offline copy of your data, sign out on shared computers and protect your device with a passcode.

If you believe you have found a security issue, please email support@courierbilling.in with the details and avoid accessing data that is not yours.

No method of transmission or storage is perfectly secure. If we become aware of a breach that is likely to harm your interests, we will notify you and regulators as required by applicable law, including the DPDPA where it applies.

8. Your rights and choices

Subject to applicable exceptions, you may request:

• Access to the personal data we hold about you.
• Correction of inaccurate personal data (you can also update many fields in-app, such as your name, phone, and franchise details; your login email is locked).
• Erasure or account closure, which you can do yourself from Profile → Security (you confirm by typing your email), except where we must retain certain records by law or for established legitimate purposes.
• Withdrawal of consent where processing is consent-based, without affecting the lawfulness of prior processing.
• Nomination of another individual to exercise rights on your behalf where the law permits you to do so.

To exercise these rights, email support@courierbilling.in from your registered email where possible. We may need to verify your identity before acting. Many exports (such as invoice PDFs and certain reports) are available directly inside the application.

9. Cookies and similar technologies

We use cookies and similar storage where needed to:

• Maintain signed-in sessions and protect against session hijacking.
• Remember preferences you set in the product.
• Measure basic product usage or reliability when we enable analytics cookies.

You can block or delete cookies through your browser; blocking strictly necessary cookies may prevent login or core features from working.

10. Marketing

We send transactional and security-related email as part of operating the service. If we send optional marketing, we will rely on consent or another lawful basis as required, and we will provide an unsubscribe mechanism.

11. Children

Courier Billing is intended for businesses and adults. We do not knowingly collect personal data from anyone under 18. If you believe a minor has provided us data, contact us and we will take steps to delete it.

12. Third-party sites

Our site or app may link to third-party websites (for example documentation or payment pages). Their privacy practices are governed by their own policies, not this one.

13. Changes to this policy

We may update this Privacy Policy to reflect new features, legal requirements, or subprocessors. We will revise the “Last updated” date and, where changes are material, provide additional notice (for example by email or in-app banner). Continued use after the effective date of an update constitutes your acknowledgement of the revised policy where the law allows.

14. Contact and grievance redressal

Questions, access requests, corrections, deletion requests, or complaints about how we handle personal data: support@courierbilling.in. Please include enough detail for us to locate your account. We will respond within timelines required by applicable law where those timelines apply.