Privacy Policy

1. Introduction & Business Identity

DukanBILL ("DukanBILL", "we", "us", or "our") operates the software product DukanBILL Desktop and the official website at https://dukanbill.com. DukanBILL is an Indian billing, inventory management, and Point of Sale (POS) application designed specifically for Indian retailers, grocery shops, and small businesses.

We are firmly committed to user privacy and data sovereignty. This Privacy Policy outlines what information is processed, how it is used, how it is secured, and the strict technical boundaries governing our software.

1.1 Data Fiduciary Roles under the DPDP Act

DukanBILL Desktop operates as an offline-first computer software application. All retail invoices, customer credit ledgers (khata), supplier purchase registers, and product pricing entered into the desktop application reside exclusively on the merchant's local computer. DukanBILL does not access, collect, determine the purpose of, or process such local retail customer records.

For the purposes of the Digital Personal Data Protection Act, 2023 (DPDP Act), the merchant acts as the Data Fiduciary for their own retail customer records. DukanBILL operates as a Data Fiduciary solely with respect to personal data voluntarily communicated directly to DukanBILL by the merchant (such as technical support correspondence, software license key issuance, and website server access logs).

2. Desktop Application: Offline-First Architecture

DukanBILL Desktop is offline-first: your billing, inventory and customer records are stored only on your computer and are never uploaded to our servers.

• Store Master & Profile: Business name, trade name, GSTIN, PAN, shop address, contact phone, bank details, and UPI ID are saved strictly in your local database.
• Commercial Accounting: All sales invoices, retail bills, customer credit registers (khata), supplier purchase records, product catalog, barcode entries, tax rates, and inventory quantities are stored locally.
• Local Database Engine: Data is written to an embedded SQLite database (margpos.db) located in your operating system's application directory (e.g., %APPDATA%\dukanbill-desktop\ on Windows).
• Zero Cloud Harvesting: DukanBILL does not upload, synchronize, aggregate, or mirror your sales revenue, customer phone numbers, supplier balances, or inventory metrics to DukanBILL servers or any third-party cloud.
• Automatic Backups: Automatic backups are saved only to a location on your own computer or storage that you choose. We do not receive or store your backups. If you choose a folder that is synced by a third-party service (for example Google Drive), that service handles those files under its own terms.
• Local Access Control: User PINs and master administrative credentials are saved locally as cryptographically salted hashes. PINs are never transmitted over the internet.

3. Machine Identification & License Binding

To bind software licenses to a single authorized merchant computer and prevent fraudulent software replication, DukanBILL Desktop computes a pseudonymous hardware identifier known as the Machine ID.

• What is generated: The Machine ID is a one-way hash generated from basic system properties (device name, CPU model, OS platform and RAM size). The raw values are not transmitted to us; only the resulting Machine ID, which you share with us for licensing.
• Format: The output is converted into a 12-character uppercase token formatted as MPOS-XXXX-XXXX-XXXX.
• Privacy Protection: The Machine ID does not collect personal files, browser history, MAC addresses, motherboard serial numbers, or drive serial numbers. It cannot be used to reverse-engineer your system files or personal identity.
• How it is used: When you purchase or activate a license, your Machine ID is embedded in a cryptographically signed Ed25519 license token. The desktop application verifies this token locally on your machine without requiring a constant internet connection.

4. Software Update Checks

When DukanBILL Desktop checks for software updates, it sends a secure HTTPS GET request to our official public release endpoint:

• https://dukanbill.com/version.json (with fallback to official GitHub release repositories).
• This request transmits standard HTTP request headers (IP address and HTTP User-Agent) necessary for network communication.
• No business data, store sales figures, customer details, or inventory records are ever included in update check requests.

5. Third-Party Services & Network Interactions

To provide software distribution, updates, support, and direct communication, DukanBILL interacts with the following external services:

• Web Hosting & Server Infrastructure (Hostinger): Our website and update manifests are hosted on Hostinger servers, which maintain standard server access logs (including IP addresses and browser user-agents) for DDoS protection, network security, and infrastructure health.
• Software Release Distribution (GitHub): In the event that official update checks fallback to our release repositories, GitHub may receive standard HTTP client headers (IP address and user-agent) during file retrieval.
• Optional WhatsApp Invoicing (Meta Platforms / WhatsApp LLC): When you choose to share invoices with customers via WhatsApp, communication is established directly between your desktop computer and WhatsApp servers (via WhatsApp Web or standard https://wa.me/ browser links). Invoice PDFs and customer phone numbers never pass through DukanBILL servers.
• Community Support (Telegram): Participation in our official Telegram community (@dukanbill) is voluntary and subject to Telegram's terms and privacy policy.
• Typography Fonts (Google Fonts): The website loads typography fonts securely from Google Fonts CDN (fonts.googleapis.com and fonts.gstatic.com). Google may receive standard browser request headers when font assets are loaded.

6. Customer Accounts & Google Sign-In Coming Soon

To enable self-service license management, invoice history, and automated license delivery, an authenticated customer portal is available on DukanBILL.com.

• Authentication Method: Users may register and sign in using Google Identity Services (OAuth 2.0 / OpenID Connect) or email verification.
• Data Collected from Google: When you authenticate via Google Sign-In, we access only basic profile information: your unique Google account identifier (sub), primary email address (email), full name (name), and public profile picture URL (picture). We request only standard, non-sensitive OpenID profile and email scopes.
• Purpose & Use of Google User Data: Google profile data is used solely to authenticate your identity, establish your customer account, link your desktop license keys and Machine IDs, and deliver license recovery tokens.
• No Third-Party Sharing or Sale: DukanBILL does not sell, rent, trade, or transfer information received from Google APIs to third parties, advertising platforms, or data brokers. Your information is never used for surveillance, commercial profiling, or targeted advertising.
• Google User Data Policy Compliance: DukanBILL's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
• Session Security & Data Deletion: Web sessions utilize cryptographically secure random session tokens stored in HttpOnly, Secure, SameSite=Lax cookies. You can revoke access at any time via your Google Account Permissions or request immediate erasure of your web account records by emailing support@dukanbill.com or dukanbillx@gmail.com.

7. Payment Processing & Razorpay Coming Soon

To automate license purchases on DukanBILL.com, integration with an authorized Indian payment aggregator (Razorpay) is planned.

• Processing of Sensitive Payment Credentials: When payments become available, all credit/debit card numbers, Net Banking credentials, and UPI PINs will be collected and processed directly by Razorpay on PCI-DSS Level 1 compliant servers. DukanBILL will never receive, handle, or store your raw card numbers or bank credentials.
• Transaction Data Retained by DukanBILL: To confirm fulfillment and satisfy legal accounting requirements, DukanBILL will store Razorpay Order IDs, Payment IDs, payment status, transaction amounts, and the linked Machine ID.
• Current Status: Automated Razorpay checkout is not yet enabled on the live website. Manual or assisted licensing workflows may be arranged via support until automated checkout launches.

8. Purposes & Legal Grounds of Data Processing

We process personal data under the grounds recognized by the Digital Personal Data Protection Act, 2023:

1. Voluntary Provision for a Specified Purpose: Processing the Machine ID and contact email/phone that you voluntarily provide to us in order to generate, issue, bind, and service your software license.
2. Voluntary Consent: Processing inquiries and diagnostic details voluntarily communicated by you when contacting our support channels via WhatsApp, Telegram, or email.
3. Service Reliability & Security: Monitoring website availability, mitigating automated cyber-attacks, and preventing software piracy.
4. Statutory Compliance: Maintaining commercial transaction records as required under applicable Indian financial and tax laws.

9. Commercial Eligibility & Age Limitations

DukanBILL Desktop and DukanBILL.com are designed and offered exclusively for commercial business operators, retail traders, and shopkeepers. In accordance with Section 11 of the Indian Contract Act, 1872, software commercial licenses and agreements are available only to persons legally competent to contract (individuals who have attained eighteen (18) years of age).

We do not knowingly solicit, collect, or process personal data from children under 18 years of age. In compliance with Section 9 of the Digital Personal Data Protection Act, 2023, DukanBILL does not engage in tracking, behavioral monitoring, or targeted advertising directed at minors. If we become aware that personal data of a minor has been inadvertently received via support channels, we will take immediate steps to delete such information from our correspondence records.

10. Data Retention & Deletion

• Local Merchant Data: Merchant transaction records remain on your local computer until you choose to delete them. Uninstalling DukanBILL Desktop preserves your local SQLite database file (%APPDATA%\dukanbill-desktop\) to prevent accidental data loss. You retain complete sovereignty to delete or archive this file at any time.
• Support Inquiries & Correspondence: Customer communications sent via email, WhatsApp, or Telegram for technical support, printer configuration, or license activation are retained strictly for the operational duration necessary to resolve the inquiry, service the ongoing commercial license, and verify genuine purchase records.
• Commercial & Tax Records: Payment and invoice records are retained for the period required under applicable Indian tax and commercial laws.
• Web Account Records (When Operational): Once customer accounts launch on DukanBILL.com, user profiles will be retained for the duration of the merchant's active software subscription. Inactive accounts without active commercial licenses may be archived after 24 months. Users will be able to request permanent erasure of their web account credentials by contacting support at support@dukanbill.com.

11. Data Security Safeguards & Incident Management

We implement layered administrative and technical safeguards designed to protect personal data against unauthorized access, loss, or alteration:

• Encryption in Transit: All communications with DukanBILL.com are secured using modern Transport Layer Security (TLS 1.2 / TLS 1.3) with HTTPS certificates.
• Asymmetric Cryptographic Licensing: Licenses are signed using Ed25519 digital signatures. Private cryptographic signing keys are stored exclusively in an isolated directory outside the public web root.
• Zero Server Access to Private Stores: Because we do not operate a centralized cloud database for retail billing, your store data cannot be breached from our web infrastructure.
• Security Incident Protocol: In the event of a confirmed security incident affecting personal data on our web infrastructure, we will investigate the matter promptly, initiate containment measures, and notify affected users and regulatory authorities in accordance with applicable legal obligations under Indian law.

12. Privacy Rights under Indian Law

In accordance with the Digital Personal Data Protection Act, 2023 (DPDP Act) and the rules framed thereunder, as notified by the Central Government, you possess the following rights regarding personal data held by DukanBILL:

• Right to Access & Summary: You may request a summary of the personal data we hold about you (such as your support correspondence or transaction records).
• Right to Correction & Erasure: You may request correction of inaccurate data or deletion of your support correspondence, subject to statutory tax and commercial record retention requirements.
• Right to Withdraw Consent: Where data processing is based on your voluntary consent (such as voluntary support communication or community participation), you may withdraw consent at any time by contacting support. Withdrawal of consent does not affect the lawfulness of prior processing, nor does it impact offline desktop POS software operation.
• Right to Grievance Redressal: You may raise concerns or submit inquiries directly to our Grievance Desk. You also retain the right to approach the Data Protection Board of India as notified by the Central Government.
• Right to Nominate: You have the statutory right to nominate an individual to exercise privacy rights on your behalf in the event of death or incapacity, in accordance with applicable rules notified under the DPDP Act.

13. Contact & Grievance Redressal

If you have questions, feedback, or privacy-related requests, please contact us through our official support channels:

• Email Support: support@dukanbill.com / dukanbillx@gmail.com
• WhatsApp Support: +91 87578 88037
• Telegram Community: @dukanbill
• Official Website: https://dukanbill.com

14. Policy Updates & Notification Channels

We may periodically update this Privacy Policy to reflect software feature enhancements, regulatory amendments, or new service integrations. When updates are published, the effective date at the top of this document will be revised. For material changes affecting data privacy, notices will be highlighted on the official website and included in desktop software release notes (version.json). We encourage you to review this page periodically.