Made in India · DPDPA 2023 compliant
Legal · DPDPA Full Disclosure

DPDPA Full Disclosure

Our complete compliance statement under the Digital Personal Data Protection Act, 2023 (India).

v1.0·Effective 21 May 2026
Section 1

Who we are

Data Fiduciary

BillSathi (बिलसाथी)
Bhopal, Madhya Pradesh, India
support@billsathi.in

We are a Data Fiduciary as defined under DPDPA 2023 §2(i) — we determine the purpose and means of processing your personal data.

Section 2

Lawful basis for processing

We process your personal data on the following bases under DPDPA 2023 §4:

Consent

You initiate contact by messaging us on WhatsApp. This constitutes consent.

Contractual necessity

Processing is required to deliver the service you have requested.

Legitimate interest

Fraud prevention, security monitoring, service improvement.

Section 3

Consent mechanism · Option D

We use DPDPA Option D consent — notice embedded in the first interaction:

  • Welcome gate notice is displayed to every new user before any data is processed.
  • Separate consent is obtained before the first voice note is transcribed.
  • Separate consent is obtained before the first photo is processed.
  • Consent is recorded with a timestamp in our systems.
  • You can withdraw consent at any time by sending "mera account delete karo" on WhatsApp.
Section 4

Data we process

Personal data processed
  • Phone number (E.164)
  • Business name
  • Business address
  • State code
  • GSTIN (Business + Pro)
  • Customer names
  • Items, quantities, prices
  • Voice notes (30 days)
  • Photos (30 days)
  • Logo, signature, seal
We do not process
  • Payment card details
  • Email address
  • Password
  • Location data
  • Aadhaar
  • PAN
Section 5

Data Processors (Sub-processors)

We engage the following named Data Processors under DPDPA 2023 §2(k):

Anthropic (Claude) — AI Extraction Provider

Processes message text to identify business items and quantities.

OpenAI (Whisper) — Voice Transcription Provider

Converts voice notes to text.

Google (Gemini 2.0 Flash) — Vision AI Provider

Extracts text from photos of handwritten documents.

Meta (WhatsApp Cloud API) — WhatsApp Business API Provider

Message transport layer.

Cloudflare (R2 + Pages) — Cloud Storage Provider

Stores PDFs and uploads, hosts public web pages.

Cross-border transfers

All processors are bound by Data Processing Agreements requiring DPDPA-equivalent protections. Some operate servers outside India (USA, Singapore, Europe). Transfers are covered under DPDPA 2023 §16 standard clauses.

Section 6

Retention schedule

Data typeWindowHow removed
Voice notes30 daysAuto-deleted
Photos30 daysAuto-deleted
Quote PDFsPermanentWhile account active
Business profile + GSTIN + logoPermanentWhile account active
Signature + seal (Pro)PermanentWhile account active
Conversation logs90 daysAuto-pruned
Security event logs1 yearAuto-deleted
Section 7

Your rights · DPDPA §11–13

Right to access · §11

Send "mera data dikhao" on WhatsApp. Structured export within 7 business days.

Right to correction · §12

Use /profile commands on WhatsApp to update profile data.

Right to erasure · §12

Send "mera account delete karo". 2-step confirm. Deletion within 24 hours. Irreversible.

Right to grievance · §13

DPO: Saransh Sharma · support@billsathi.in · +91 85912 63807. Response within 72 hours.

Right to nominate

You may nominate another individual to exercise your rights in the event of your death or incapacity. Contact our DPO to register a nominee.

Section 8

Grievance mechanism

1
Contact DPO

Email support@billsathi.in with subject "Grievance: [your issue]". DPO responds within 72 hours.

2
Escalate if unresolved in 30 days

Escalate to the Data Protection Board of India. meity.gov.in (placeholder until official Board URL is published).

Section 9

Children's data

BillSathi is a business tool intended for adults operating registered or unregistered businesses. We do not knowingly collect data from individuals under 18 years of age.

Section 10

Updates to this disclosure

Material changes will be communicated via WhatsApp before the effective date. The version history is maintained below.

Version history
v1.021 May 2026 — Initial disclosure