The short version
- We collect what we need to run MudraERP for your business, and nothing for advertising.
- The invoices, items, parties and payments you enter belong to your business. We process them on your instructions.
- We never sell personal data. We use no advertising or third-party tracking cookies.
- You can ask us to show, correct or delete your personal data, and to withdraw your consent.
This policy explains how MudraERP collects, uses, shares and protects personal data when you visit our website, contact us or use the MudraERP billing, GST, point-of-sale and accounting service (the "Service"). It is written to meet the Digital Personal Data Protection Act, 2023 (the "DPDP Act") and the rules made under it, and the Information Technology Act, 2000 with the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 (the "SPDI Rules").
1Who we are
MudraERP is operated by [COMPANY LEGAL NAME], a company registered in India with its registered office at [REGISTERED ADDRESS] (CIN / GSTIN: [CIN/GSTIN]), referred to as "MudraERP", "we", "us" or "our".
For the personal data described in this policy that we decide how and why to use (for example your account details, website visits and enquiries), we are the data fiduciary under the DPDP Act.
2Scope of this policy
This policy covers three groups of people:
- Website visitors who browse mudraerp.com or send us an enquiry.
- Account users: business owners, managers, accountants, cashiers and other staff who sign in to MudraERP.
- People in our customers' records: the customers, suppliers and other parties whose details a business enters into MudraERP.
For that last group, the business using MudraERP decides what to record and why, so the customer business is the data fiduciary and MudraERP acts as its data processor. We process that data only to provide the Service under our agreement with the business. If you are a customer or supplier of a business that uses MudraERP and want to access, correct or delete your details, please contact that business first. We will help them respond.
3What we collect
Account details
Name, email address, phone number, your role in the business (owner, manager, accountant, cashier) and your password, which we store only as a secure hash.
Business details
Business name, legal name, GSTIN, PAN, address, state, invoice settings and similar details used on your invoices and returns.
Transaction data
What you enter to run your business: invoices, bills, items and stock, parties (customers and suppliers), payments, journals and day-close records.
Enquiries
When you use our contact form or email us: your name, email, phone (if given), business name and your message.
Technical data
IP address, device and browser type, pages and features used, sign-in times, and server and security logs.
Support conversations
What you tell us when you ask for help, and notes we keep to resolve the request.
Passwords and any financial information such as bank account details are treated as sensitive personal data under the SPDI Rules and protected accordingly. We do not ask for card numbers; if we accept online payments in future, a payment processor will collect card or UPI details directly.
5Why we use your data
- To provide the Service: create your account, run billing, stock, GST and accounts, and keep your data in sync across devices.
- To keep it secure: authenticate users, prevent fraud and misuse, and investigate security incidents.
- To support you: answer questions, fix problems and help you set up.
- To respond to enquiries sent through our website or by email.
- To send service emails: invitations, security alerts, and important changes to the Service or this policy.
- To meet legal obligations, including tax, accounting and lawful requests from authorities.
Legal basis. We process personal data with your consent, which you give for a specific purpose (for example by ticking the box on our contact form or by creating an account), or for a legitimate use allowed by the DPDP Act, such as using data you have voluntarily given us for the purpose you gave it, or complying with the law. Where we rely on consent you can withdraw it at any time, as easily as you gave it (see Your rights). Withdrawing consent does not affect processing already done, and some features may stop working without it.
We do not use your data for advertising, and we do not sell it.
7Where your data is stored
We store data in India wherever possible, in [HOSTING REGION]. Some service providers, such as email delivery, may process limited data outside India. We transfer personal data outside India only as permitted under the DPDP Act and never to a country the Government of India has restricted.
8How long we keep it
- Account data: for as long as your account is active.
- Accounting and tax records (invoices, bills, ledgers, GST data): for as long as Indian tax and company law requires a business to keep them, even after an account is closed.
- Enquiries: up to 24 months after our last conversation, unless you become a customer.
- Security logs: for a limited period needed to protect the Service, then deleted or anonymised.
When a business closes its account we let it export its data first, then delete or anonymise personal data within [RETENTION PERIOD AFTER CLOSURE], except where the law requires us to keep it. Backups roll over and are deleted on a fixed schedule.
9How we protect it
- Encryption in transit (HTTPS / TLS) for everything between your device and our servers.
- Passwords stored only as salted hashes (argon2); we cannot see them.
- Role-based access, so staff see only what their role allows, and each business's data is kept separate.
- Audit logs of important actions, and regular backups.
- Limited, need-to-know access for our own team.
No system is perfectly secure. If a personal data breach affects you, we will inform you and the Data Protection Board of India as the law requires, and tell you what we are doing about it.
10Your rights
Under the DPDP Act you have the right to:
- Access: a summary of the personal data we process about you, what we do with it and who we have shared it with.
- Correction and completion: fix inaccurate or incomplete data, and update it.
- Erasure: ask us to delete data we no longer need, unless the law requires us to keep it.
- Withdraw consent at any time, for processing based on consent.
- Grievance redressal: complain to us and get a response (see Grievance Officer).
- Nominate someone to exercise these rights for you in case of death or incapacity.
To use any of these rights, email our Grievance Officer at privacy@mudraerp.com from the address linked to your account, or write to the address below. We may need to confirm your identity first. Many details, such as your name and phone, you can also change yourself in the app. If your data sits in a business's records (see Scope), please ask that business; we will support them.
11Children
MudraERP is a business tool and is not intended for anyone under 18. We do not knowingly collect personal data from children. If you believe a child has given us personal data, contact us and we will delete it.
12Grievance Officer
We will acknowledge your request promptly and respond within 30 days, and in any case within the time limits set under the DPDP Act and the SPDI Rules. If you are not satisfied with our response, you may complain to the Data Protection Board of India.
13Changes to this policy
We may update this policy as the Service or the law changes. The date at the top shows the latest version. For significant changes we will tell account users by email or in the app before they take effect, and ask for fresh consent where the law requires it.
14Contact us
For privacy questions or requests, write to our Grievance Officer at privacy@mudraerp.com. For help with the app, email support@mudraerp.com. For sales and demos, email sales@mudraerp.com or use the contact form.
[COMPANY LEGAL NAME] · [REGISTERED ADDRESS]