Privacy Policy
Last updated: 24 May 2025
What ChitsVyapar is — and isn't.
ChitsVyapar is a SaaS record-keeping and member-management tool used by chit-fund operators to maintain their books. We are software only. We do not run chit schemes, collect deposits, hold customer funds, act as an NBFC or payment system, or guarantee any returns. Member-to-operator payments happen outside this platform; we record what you tell us happened.
ChitsVyapar ("we", "us", "our") operates ChitsVyapar (the "Service"), accessible at chitsvyapar.com. This Privacy Policy explains what personal information we collect, how we use it, and the choices you have.
This policy is intended to satisfy India's Digital Personal Data Protection Act, 2023 (DPDP Act) and applicable principles of GDPR / CCPA where relevant.
1. Who we are
Data Fiduciary: ChitsVyapar, , India.
Contact: ChitsVyapar@gmail.com · 6281030928.
2. Data we collect
From account holders (you)
- Name, email address, phone number, password (stored as a salted bcrypt hash — never in plain text)
- Authentication tokens (issued on sign-in, stored in your browser)
- Records of your activity inside the Service: groups created, members added, payments recorded
About members of your chit groups
You may add information about other people (chit group members) including their name, phone number, optional email, and payment status. You are responsible for having a lawful basis to upload this information and for informing those individuals.
Automatically collected
- IP address and device/browser metadata for security and abuse prevention
- Server logs of API requests (retained for 30 days)
3. How we use it
- To provide and operate the Service (authentication, storing your data, computing balances, sending reminders)
- To send WhatsApp / SMS reminders on your behalf, only when you explicitly trigger them
- To detect, prevent, and respond to abuse, fraud, or security incidents
- To comply with legal obligations
We do not sell personal data, share it with advertisers, or use it for behavioural advertising.
4. Lawful basis (DPDP / GDPR)
- Performance of contract — to deliver the Service you signed up for
- Consent — for non-essential features (e.g. opting in to product updates)
- Legitimate interests — security, abuse prevention, fundamental business operations
- Legal obligation — where applicable law requires retention or disclosure
5. Sharing and processors
We share data only with the following sub-processors, each under written contract:
- Google Cloud / Firebase — application hosting and Cloud Functions (asia-south1)
- MongoDB Atlas — database storage
- Resend — transactional email (password resets, etc.) when configured
- Meta WhatsApp Cloud API — when you trigger member reminders
We may disclose information when legally compelled (court order, lawful regulatory request) or to protect our rights and the safety of our users.
6. Data retention
- Account data: kept while your account is active and for 30 days after a deletion request
- Server logs: 30 days
- Backups: rolling 30-day retention
7. Security
We protect data with: TLS in transit, encryption at rest by our database provider, bcrypt password hashing, single-use time-limited password reset tokens, and access controls scoped per user. No system is perfectly secure — please use a strong unique password and tell us at ChitsVyapar@gmail.com if you suspect compromise.
8. Your rights
Subject to applicable law, you may:
- Access the personal information we hold about you
- Correct inaccurate data
- Request deletion of your account and associated data — see the Grievance & Account Deletion page
- Object to or restrict certain processing
- Request a copy of your data in a portable format
- Withdraw consent where processing is based on consent
- Lodge a complaint with the Data Protection Board of India or your local data protection authority
To exercise any of these, email ChitsVyapar@gmail.com. We will respond within 30 days.
9. Children
The Service is not directed to anyone under 18. We do not knowingly collect data from minors. If you believe a minor has provided data, contact us and we will delete it.
10. International transfers
Your data is processed in India (asia-south1 region). If our processors operate in other regions, we use standard contractual clauses or equivalent safeguards.
11. Changes to this policy
We may update this policy from time to time. Material changes will be communicated by email and/or by an in-app notice at least 15 days before they take effect.
12. Contact us
ChitsVyapar
Email: ChitsVyapar@gmail.com
Phone: 6281030928