Draft: under legal review. This text may change before the public launch.

Privacy Policy

Version 2026-11-03-draft · 3 November 2026

1. About this policy

This policy explains what personal data NextWebX ("NextWebX", "we") handles in the hosted edition of NextWebX Accounting, why, and what you can do about it. It follows the Digital Personal Data Protection Act, 2023 ("DPDP Act") and its Rules.

2. Two roles

  • Your account and billing data (your name, email, password, two-step sign-in, sign-in history, devices, the organisations you belong to, your subscription and our invoices to you): we decide why and how it is processed, so we are the Data Fiduciary.
  • Your business records (invoices, clients, suppliers, staff, products, books, the files you save): the organisation that keeps them is the Data Fiduciary, and we are its Data Processor under the Data Processing Agreement (/legal/dpa). If you are a client or supplier of one of our customers and want to use your rights over that data, contact that business first; we will help them answer you.

3. What we collect

  • Account: name, email address, a password hash (never the password itself), an optional phone number, two-step sign-in secret (encrypted), the version of these terms you accepted and when.
  • Use and security: sign-in attempts with time and IP address, devices signed in (browser and operating system), errors the app reports, actions written to your organisation's audit log (who did what, when, from which IP address).
  • Billing: the plan, payment status from Razorpay (we never see or store card or UPI details), GSTIN, billing name and address, and the GST invoices we issue to you.
  • Your business records, as described above, only to provide the Service.

4. Why we use it

  • To provide the Service and keep it secure (sign-in, two-step sign-in, preventing abuse, the audit log).
  • To bill you and keep the tax records the law requires.
  • To send service emails: verification, password reset, invites, export links, billing notices, deletion notices.
  • To answer support requests, only as far as needed.

We rely on your consent (given at sign-up), on the performance of our agreement with you, and on our legal obligations (tax and accounting law). We do not sell personal data, do not use it for advertising, and do not use your business records to train any model.

5. Where it is kept and who helps us

Data is stored in India. We use a small number of service providers (sub-processors): our cloud hosting, database, file storage and email provider (currently Amazon Web Services, Mumbai region); Razorpay for payments; and Google, only if you connect Google Drive yourself. Each is bound to protect the data and to use it only for us.

6. How long we keep it

  • Account data: while your account exists. When you delete your account it is erased, except that its number stays in audit entries (shown as "deleted user") because those entries are part of a business's tamper-evident audit trail.
  • Business records: while the organisation exists. When it is deleted (30 days after the request, which can be undone until then) every record, file and setting is erased, and the encryption key of its secrets is destroyed.
  • Encrypted database backups age out within 35 days, so a deleted record can survive in a backup for up to 35 days, unreachable from the Service.
  • Our GST invoices to you and our payment records: as long as tax law requires (at least 72 months).

7. Security

Connections are encrypted (HTTPS). Files are stored encrypted at rest. Secrets such as email passwords and the Google Drive connection are encrypted with a key of each organisation's own. Passwords are hashed with scrypt. Organisations are kept apart at every layer and tested for it. Our staff open an organisation only with its owner's 72-hour permission, or in a logged emergency procedure that emails every owner at once. If a personal data breach happens we will inform affected customers and the Data Protection Board of India as the DPDP Act and Rules require.

8. Your rights

  • Access: Settings > Data & privacy > "Download my account data" gives you your account data; an owner can export the whole organisation.
  • Correction: change your name, email or password in the app, or write to us.
  • Erasure: delete your account (Settings > Data & privacy), or, as an owner, the organisation.
  • Grievance: write to the Grievance Officer (below). If you are not satisfied with the answer you may complain to the Data Protection Board of India.
  • Nomination: you may nominate a person to use these rights for you in case of death or incapacity, by writing to the Grievance Officer.
  • Withdrawing consent: you can withdraw it at any time by deleting your account; this does not affect processing done before.

9. Children

The Service is for businesses and is not meant for anyone under 18. We do not knowingly collect children's data.

10. Grievance Officer

Grievance Officer, NextWebX, [email protected]. See /legal/grievance for how complaints are handled.

11. Changes

We will tell you by email or in the app before a change in this policy that matters takes effect.