Privacy policy

Last updated 7 October 2026

This policy explains what personal data Tap & Bill (“Tap & Bill”, “we”, “us”) collects through the website tapandbill.in, the dashboard at app.tapandbill.in and the Tap & Bill Android app (together, the “Service”), why we collect it, and the choices you have. We follow the Digital Personal Data Protection Act, 2023 (DPDP Act) and the Information Technology Act, 2000 and its rules.

1. Who this covers

Website visitors and people who ask for a demo.
Shops that use Tap & Bill: the owner and staff who log in.
Customers of those shops, whose details the shop enters when making a bill.

For customer details entered by a shop, the shop decides what to collect and why (it is the data fiduciary); we process that data for the shop to provide the Service (as its data processor).

2. Data we collect

From website visitors

Demo and contact forms: name, mobile number and, if you give them, shop name, city, shop type and message; the page you sent it from and campaign tags in the link (for example utm_source).
Technical data: our server records IP address, browser type and pages requested (standard web server logs). For spam protection we keep a one-way scrambled (hashed) form of the IP address with each form request.

From shops (owners and staff)

Account: shop name, address, phone, GSTIN, logo, bill settings; owner and staff names, mobile numbers and password (stored only as a secure hash).
Billing data: bills, items, quantities, rates, discounts, tax, payment mode (cash, UPI, card), who made each bill, cancelled bills with reasons.
Subscription: plan, trial and payment records (amount, date, method, reference).
Messages: if the shop uses WhatsApp from our server, delivery status of bill and offer messages.

About shop customers (entered by the shop)

Name, mobile number, optional GSTIN, purchase history (bills, visits, total spend) and whether the customer agreed to receive offers.

3. Android app permissions

Bluetooth (scan and connect): to find and print on your Bluetooth thermal receipt printer.
Location: older Android versions require location permission to scan for Bluetooth devices. The app does not read, store or send your location.

The app keeps your login on the phone in secure storage and keeps bills made without internet on the phone until they upload. It does not contain advertising or analytics tools. App updates are delivered through Expo’s update service, which receives basic device and app version information to send the right update.

4. How we use data

To provide the Service: save bills, create bill PDFs, print receipts, send WhatsApp messages the shop asks for, and show reports.
To run accounts and subscriptions: login, password reset codes by SMS, trial and payment status.
To respond to demo and support requests, by phone, WhatsApp or email.
To keep the Service secure: prevent spam and abuse, fix problems, keep backups.

We do not sell personal data, and we do not use shop or customer data for advertising.

Only with service providers that help us run the Service, under contract, and only as needed:

Amazon Web Services (servers and database hosting).
Cloudflare (domain name service).
Meta / WhatsApp, when a shop sends bills or offers through the WhatsApp Business API from our server. When a shop sends from its own phone, the message goes through that phone’s WhatsApp.
SMS provider (for example MSG91), to send one-time passwords for password reset.
Expo, to deliver Android app updates.
Google Fonts, which serves the fonts used on our website.

We may also disclose data when required by law or a lawful request from authorities. Bill PDF links contain a long random code; anyone who has the link (for example, the customer the shop sent it to) can open that bill.

6. Where data is stored and security

Data is stored on Amazon Web Services servers in the United States (us-east-1). We protect it with encrypted connections (HTTPS), hashed passwords, separation of each shop’s data so one shop cannot see another’s, limited administrator access, and daily backups. No system is perfectly secure; if a breach affects you we will inform you and the authorities as the law requires.

7. How long we keep data

Shop accounts: while the account exists. If a subscription ends, the account becomes read-only and data is kept until the shop asks us to delete it.
After a deletion request: removed from our live systems within 30 days; daily backups are overwritten within 6 weeks. Subscription payment records we must keep under tax law are kept for up to 8 years.
Demo requests: up to 24 months after our last contact, or earlier if you ask.
Server logs: a few weeks.

8. Your rights and choices

Under the DPDP Act you can ask to see, correct, update or erase your personal data, withdraw consent, nominate someone to act for you, and raise a grievance. Shop owners can export bills (CSV) any time and can delete their account: see Delete your account. We reply within 30 days. To make a request, email info@tapandbill.in, use the form on our contact page.

9. If you are a customer of a shop

Your details are entered by the shop you bought from. Ask that shop to correct or delete them, or to stop sending you offers. If you cannot reach the shop, contact us and we will help. Shops can send offers only to customers marked as having agreed to receive them.

10. Children

The Service is for businesses and is not meant for anyone under 18. We do not knowingly collect children’s data.

11. Cookies

Our website does not use advertising or tracking cookies. It may store small preferences in your browser and remember campaign tags for the current visit so we know which page a demo request came from. The dashboard stores your login in your browser.

12. Changes to this policy

We will update this page when our practices change and change the date at the top. For important changes we will also inform shop owners in the dashboard or by message.

13. Contact and grievance officer

For privacy questions, requests or complaints, email info@tapandbill.in, use the form on our contact page. Our grievance officer will acknowledge your complaint within 24 hours and resolve it within 15 days. If you are not satisfied, you may complain to the Data Protection Board of India.