Privacy Policy

Version 2026-10-v3 · Updated 13 October 2026

Draft for legal review. Highlighted items are still to be filled in.

In short: we collect only what NOW needs to run your shop. We never sell your data. Your customers' records are yours. You can export or delete everything yourself.

1. Who we are and which laws apply

NOW is software for small businesses, run by [COMPANY], [ADDRESS] ("NOW", "we", "us"). You can reach us at [EMAIL].

We follow the Information Technology Act, 2000 and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, which apply today. We are also preparing for the Digital Personal Data Protection Act, 2023 and the DPDP Rules, 2025. Their main duties for businesses start in May 2027, and we follow them early wherever we can.

2. Two roles: you and us

Your account and payment data. NOW decides why and how this is used, so NOW is the responsible party (the "data fiduciary" under the DPDP Act, and the "body corporate" under the IT Act).
Your customers' data (names, phone numbers, udhaar balances, bills). You decide why it is collected, so you are the data fiduciary. NOW only stores and processes it for you, as your processor, under our Data Processing Agreement at /dpa.

Only add customers who know you are keeping a record of them. A sample notice you can show customers is in the Data Processing Agreement.

3. What we collect

Account: email, password (stored only as a salted hash, never in readable form), business name, business type, phone number (optional).
Business records you enter: products, prices, stock, bills and bill items, expenses, customers (name, phone, udhaar balance and the payments you record against it), item photos you choose to add (small copies, kept with the item), complaints you send us (name, mobile, optional email, order number, your messages and our replies; closed complaints are kept for up to 12 months), if you switch on NOW Store: your shop's location and delivery range, and the orders placed with you (customer name, mobile, delivery address and location, items and amount), a per-customer "agreed to offers" flag you record, your offer plans and a record of which customers you sent them to, and tax details if you turn on GST: your shop's GSTIN, address and state, the GST certificate and other documents you upload so we can approve GST for you (kept while your account is active and deleted with it), and a buyer's name and GSTIN if you enter them on a bill.
Payments: Razorpay order and payment IDs, amount, plan and status. We never see or store your card number, UPI PIN or bank login. Razorpay handles those.
Consent record: your email, the policy version you accepted and the time.
Technical data: your IP address is used briefly to limit repeated login and sign-up attempts and is kept for up to one hour. Error logs held by our hosting provider may include the page called and the error text, but never your password.

4. What we do not do

We do not sell or rent your data.
We do not use advertising or analytics trackers on NOW as of this version.
We do not ask for your location, contacts or microphone. The camera or photo gallery is used only when you tap to add an item photo or to scan a barcode. A scan reads the code on your phone and nothing is recorded or sent; an item photo is kept only if you save it.
We do not read your customers' data except to give you support you asked for, to keep the service safe, or when the law requires it.

5. Why we use your data

To create your account and run the app (needed to give you the service).
To take payment, activate your plan and keep billing records (contract and legal duty).
To keep NOW safe: stop abuse, fraud and break-in attempts.
To answer your support requests and send service messages such as payment receipts or security notices.
To meet legal duties such as tax and accounting rules.
Marketing messages (WhatsApp, SMS, email) only if you say yes, and you can say no again at any time.

6. Who else handles your data

We use a small number of providers ("sub-processors"). They may only use the data to give us their service.

Cloudflare: hosts the app and stores your shop's records.
Supabase: stores our own company records: client list, billing ledger and consent records.
Razorpay: takes your payments and subscriptions.
Google Fonts: delivers the text style used on our pages. Google may see your IP address when a page loads.
WhatsApp (Meta): only when you choose to share a bill. The share opens on your own phone.
AI provider (only if the Ask feature is switched on): when you ask a question, the question and the shop figures needed to answer it (sales, stock, udhaar names and amounts) are sent to the AI provider we choose, to write the answer. Nothing is written back to your records.

We may also share data when a court or an authorised government agency lawfully orders us to, or to protect people from fraud or serious harm. If NOW is ever sold or merged, your data moves to the new owner only with the same protection, and we will tell you first.

7. Where your data is kept

Your shop's records are in Cloudflare's database. Cloudflare may store and process them in more than one country. Our company records are in Supabase, region: [REGION]. Where data leaves India, we do it only to providers who protect it by contract, and only as the DPDP Act allows.

8. How we protect it

HTTPS everywhere, with browsers told to always use it.
Passwords are salted and hashed. We cannot read them.
Every query is limited to your own shop's records.
Login sessions are signed and expire after 14 days.
Limits on repeated login, sign-up and write requests.
Payment confirmations are checked by signature before a plan is activated.
Our company records sit behind row-level security and are opened only by our server, using a secret key.
Regular backups, and restore tests.

No system is perfectly secure. If something goes wrong, our Security page at /security explains what we do and how fast.

9. How long we keep it

Your shop data: while your account is active. When you delete your account, it is removed from our live system straight away. Backups may hold it for up to 30 days before they expire.
Payment and billing records: as long as tax and accounting laws require, generally up to 8 years.
Consent records: while your account is active and for 3 years after, as proof of what you agreed to.
Login-attempt records: up to one hour.
Inactive accounts: if you do not log in for 12 months, we email you and may archive the account after 30 days' notice.

You are responsible for keeping your own copy of bills as GST and income-tax laws require. Use Export in the app.

10. Your rights

See and download your data (Export in the app).
Correct it (edit inside the app, or write to us).
Delete it (Delete account in the app).
Withdraw your consent. This may stop us giving you the service.
Ask for a grievance to be resolved: see /grievance. We acknowledge within 48 hours and resolve within 30 days.
Nominate someone to exercise your rights if you die or cannot act, as the DPDP Act allows once it is in force.
If we do not resolve your complaint, you can approach the Data Protection Board of India once it is accepting complaints.

To use a right, write to [EMAIL] from your registered email.

11. Bill links and WhatsApp

When you share a bill, NOW creates a private link. Anyone who has the link can open that bill until it expires after 90 days. The bill shows your business name, the items, the total and the customer's name if one was added. Share links only with the right customer. You can switch a bill link off at any time from the bill, and make a new one.

12. Browser storage

NOW stores a login token and your language choice in your browser so the app works. It stores demo data only if you use the demo. These are needed for the service, so there is no cookie banner. Clearing your browser data logs you out.

13. Children

NOW is for business owners aged 18 or older. We do not knowingly collect data from children. If you think we have, write to us and we will delete it.

14. Changes to this policy

When we change this policy we update the version and date above. For important changes we tell you in the app or by email, and ask you to accept again where the law needs it.

15. Contact

Write to [EMAIL]. Grievance Officer details are at /grievance.