In plain words
- We collect what we need to run your billing and nothing to sell. We never sell your data.
- Your data is stored in India.
- Tax documents are kept for 8 years because GST law asks for it. Other data is deleted sooner.
- You can see, correct or erase your data and withdraw consent. Our grievance officer replies within 30 days.
1About this notice
This notice is written to meet the Digital Personal Data Protection Act 2023 (“DPDP Act”) and the rules made under it.
2Who is responsible
For personal data of people who use Moharbill (owners, staff, CAs, website visitors), Hexa Secure Labs is the Data Fiduciary.
For personal data of your customers and suppliers that you enter in your books (for example a proprietor's name, mobile and address on a bill), your firm is the Data Fiduciary and we are your Data Processor: we process it only on your instructions and under our terms with you.
3What we collect
| Category | Examples | Where it comes from |
|---|---|---|
| Identity and contact | Name, mobile number, email, preferred language | You, at sign-up |
| Business details | Firm name, GSTIN, PAN, address, turnover band, bank details for invoices | You; GSTIN details fetched from the GST public search |
| Books and documents | Invoices, credit notes, purchase bills, parties, items, payments, e-way bills, TDS records | You and your users |
| Portal credentials | IRP / e-way bill API username and keys (encrypted). We never ask for your GST portal password | You, in Settings |
| Payments to us | Plan, invoices, payment status. Card and UPI details stay with the payment gateway | Razorpay or Easebuzz |
| Usage and device | IP address, browser, device type, pages used, error logs | Collected automatically |
| Support | WhatsApp chats, emails, call notes, approved support sessions | You, when you contact us |
4Why we use it
- To provide the Service: make bills, get IRNs and e-way bills, prepare returns, send reminders you set up.
- To bill you and issue GST invoices for your subscription.
- To keep accounts safe: OTP sign-in, fraud and abuse checks, security logs.
- To meet the law: tax record keeping, lawful requests from authorities, CERT-In reporting.
- To improve Moharbill: using usage data in aggregated form. We do not train models on your books.
- To send product news or offers, only if you separately opt in. You can stop these at any time.
We rely on your consent, or on the legitimate uses allowed by section 7 of the DPDP Act, such as complying with a law that requires us to keep tax records.
5Consent and withdrawing it
- We ask for consent with a clear notice, in your language, before we collect data that needs it. Each purpose is listed separately.
- You can withdraw consent as easily as you gave it: in Settings → Privacy, by replying STOP on WhatsApp, or by writing to the grievance officer.
- Withdrawing does not affect what was done before. If you withdraw consent needed to run the Service, we may have to close the account, but we still keep tax documents as required by law.
- You may also manage consent through a registered Consent Manager when these become available.
6Who we share it with
We never sell personal data. We share it only with:
- People you invite, such as your accountant or CA, with the role you choose.
- Government systems when you ask us to: the IRP for e-invoices, NIC for e-way bills, GSTN for returns.
- Our processors under written contracts: cloud hosting in India, the WhatsApp Business API provider, SMS and email providers, payment gateways (Razorpay, Easebuzz), and our GST Suvidha Provider.
- Authorities, when the law requires it. We tell you unless the law forbids us to.
7Your data stays in India
Your books, account data and backups are stored on servers located in India. Where a service you choose works abroad, for example WhatsApp message delivery by Meta, only the message content needed for that service leaves India, and only when you use that feature.
8How long we keep it
| Data | Kept for | Why |
|---|---|---|
| Tax documents and books | 8 years | From the end of the financial year they relate to. Section 36 of the CGST Act asks for books to be kept until 72 months from the due date of that year's annual return. |
| Account and contact data | Account life + 90 days | Deleted after closure unless needed for a dispute or the law |
| Security and system logs | At least 180 days | CERT-In directions of April 2022 |
| Support conversations | 2 years | To help you with repeat issues |
| Marketing consent | Until withdrawn | Deleted within 7 days of withdrawal |
When a retention period ends we delete the data or make it anonymous. If you have not used your account for a long time, we will remind you before deleting anything not covered by the law.
9How we protect it
- Encryption in transit (TLS) and at rest; portal credentials are stored encrypted with separate keys.
- Role-based access for your users; every change to a bill is in the audit log.
- Our staff cannot see your books without a support session you approve. Sessions expire and are logged.
- If a personal data breach happens, we inform the Data Protection Board of India and affected people as the DPDP Act requires, with what happened and what you can do.
10Your rights
- Access: get a summary of the personal data we hold about you and who we shared it with.
- Correction and erasure: correct, complete or update your data, or ask us to erase it. Tax documents we must keep by law are erased once the retention period ends.
- Grievance redressal: complain to our grievance officer and get a reply.
- Nominate: name someone who can use these rights for you if you die or cannot act.
To use a right, go to Settings → Privacy or write to the grievance officer. We may ask you to confirm it's you with an OTP. Please give correct information and don't file false complaints; these are your duties under section 15 of the DPDP Act.
11Children
Moharbill is for businesses and is not meant for anyone under 18. We do not knowingly collect children's data.
12Grievance officer
Write to the Grievance Officer, Hexa Secure Labs, at grievance@moharbill.com. We acknowledge within 2 working days and resolve within 30 days. If you are not satisfied, you can complain to the Data Protection Board of India.
13Changes to this notice
We will tell you before a material change takes effect and, where needed, ask for fresh consent. The date at the top shows the latest version.