Privacy Policy

Last updated: 28 September 2026

This policy explains what HixapOS, operated by Shiva Ghatuwal, collects, why, who it is shared with, and the choices you have. We handle personal data in line with Indian law, including the Digital Personal Data Protection Act, 2023.

What we collect

  • Your account: name, email address and password. Passwords are stored only as a secure hash, never in readable form.
  • Your shop: shop name, type, and the phone number and address, if you enter them.
  • Your business records: sales, invoices, items, stock, purchases, suppliers, and your customers' names, phone numbers and khata balances.
  • Payments to us: the plan, amount, date and Razorpay order and payment IDs. Card, UPI and bank details are entered on Razorpay's checkout and never reach us.
  • Technical data: sign-in cookies, and the IP address and browser details that servers log with each request.

How we use it

  • to run the Service: store your records, make invoices and reports, and answer the AI assistant's questions;
  • to sign you in and send account emails, such as sign-up and password reset codes;
  • to take payments and keep the records the law requires;
  • to keep the Service secure and fix problems.

We do not sell your data, and we do not use it for advertising.

Who we share it with

Only the providers that run parts of the Service, each for that purpose alone:

  • Supabase: database, sign-in and file storage, in its Mumbai, India region.
  • Vercel: hosts the website.
  • Razorpay: processes payments.
  • Resend: sends account emails.
  • Google (Gemini): when you use the AI assistant, your question and the shop figures needed to answer it are sent to generate the reply.

When you share an invoice or a khata reminder on WhatsApp, the app opens WhatsApp on your phone with the message ready, and you send it yourself. We may also disclose data when the law requires it.

How it is kept safe

All traffic is encrypted (HTTPS). Each shop's data is separated at the database level, so no other shop can read it, and inside a shop, staff see only what their role allows.

Cookies

We use only the cookies needed to keep you signed in. There are no advertising or tracking cookies.

How long we keep it

We keep your data while your account is open. If you ask us to delete your shop, we delete its data within 30 days, except payment records we must keep by law.

Your choices and rights

You can see and correct most of your data in the app. To get a copy, have it corrected or deleted, or to withdraw your consent, write to us at shivaghatuwal123@gmail.com. We reply within 7 days.

Children

The Service is for businesses and is not meant for anyone under 18.

Grievance officer

For any concern about your data: Shiva Ghatuwal, shivaghatuwal123@gmail.com, Hyderabad, Telangana 500032, India. See also Contact us.

Changes to this policy

If this policy changes, the date at the top changes. We will tell account owners about significant changes.