Privacy Policy

This Privacy Policy explains how Skyllect Private Limited ("Skyllect", "we", "us") collects, uses, shares and protects personal data when you use ManageVyapar — our website, web app, mobile app, WhatsApp messaging and website chat features (together, the "Service"). It is written to meet the Information Technology Act, 2000, the rules made under it, and the Digital Personal Data Protection Act, 2023.

1. Who Is Responsible for Your Data

• Your account and our website. For information about you as a ManageVyapar customer (the business and its users) and about visitors to our website, Skyllect decides how the data is used.
• Data your business keeps in ManageVyapar. When a business records its own customers, staff, vendors or WhatsApp contacts in ManageVyapar, that business decides why and how the data is used. We process that data only on the business's behalf and on its instructions, to provide the Service. If you are a customer of a business that uses ManageVyapar, please contact that business first about your data; we will help them respond.

2. Information We Collect

Information you give us

• Business details: business name, contact person, email, phone number, address, state, GSTIN, PAN and logo.
• User accounts: name, email, phone number, password (stored only as a secure hash), role, designation and branch.
• Support requests: what you tell us when you contact support, and our own internal notes about your account.

Information your business stores in the Service

• Customers and contacts: names, phone, alternate phone and WhatsApp numbers, email, address and pincode, who referred them, notes and tags; orders, invoices, quotations, bookings, delivery addresses, payment method and payment reference; inquiries (including event type and date), follow-ups, tasks and comments.
• Staff: attendance (dates, status, check-in and check-out times) and payroll details such as salary components, statutory deductions, advances and payslips. We do not collect staff location for attendance.
• Products, vendors and accounts: product details and photos, stock, purchase orders and bills, vendor details including GSTIN, delivery and receiving challans, job work and service jobs, and accounting records such as receipts, expenses, credit and debit notes, TDS and any photos or files attached to them.
• Messages: WhatsApp and website chat messages sent and received through the Service, including the type of any media or location a contact shares, AI-written conversation summaries, and campaign contact lists your business uploads.

Information collected automatically

• Security and activity logs: sign-ins, sign-outs and failed sign-in attempts, IP address, device and browser details, and a record of changes made in the app (an audit log).
• Website chat visitors: a random visitor ID stored in your browser so a conversation can continue.
• Payments: our subscription payments are processed by Razorpay. We receive payment status and reference details; we do not store card or bank account numbers.

Our marketing website

Our website does not use advertising or analytics cookies or trackers. It loads fonts from Google Fonts, which means your browser sends your IP address to Google when the page loads. If you tap a WhatsApp link, WhatsApp's own privacy policy applies.

3. How We Use Information

• To provide, run and support the Service — billing, invoices, stock, CRM, accounts, payroll and messaging.
• To send WhatsApp messages, campaigns and automatic updates on your business's instructions.
• To power AI features that your business turns on (see section 4).
• To manage subscriptions, payments, payment reminders and account emails such as password resets.
• To keep the Service secure, prevent misuse and investigate problems.
• To meet legal, tax and regulatory requirements and enforce our Terms of Service.

We process account data to perform our contract with you and with your consent, which you give when you create an account. We process data your business stores on its behalf, as its processor. You can withdraw consent by emailing us; this may mean we can no longer provide the Service.

We do not sell personal data, and we do not use your business's data to show advertising.

4. AI Features

When a business uses AI features — the AI assistant for WhatsApp or website chat, or AI-drafted replies for its staff — the contact's messages, the conversation summary, the contact's name, relevant order details and the business's product and store information are sent to an AI provider to write a reply. Our default provider is Anthropic; we may use OpenAI or Google as an alternative or backup. We do not store the full prompts sent to these providers. We do keep the conversation, its summary, the actions the AI took (such as inquiries it created) and usage counts and costs. AI replies can be wrong, so businesses should review important answers.

5. Who We Share Information With

We share personal data only with service providers that help us run the Service, under contracts or terms that limit how they use it:

• Amazon Web Services — file storage (photos, logos, attachments and invoice PDFs).
• Our hosting providers — servers that run the app and database.
• Meta (WhatsApp Business Platform) — to connect your business's WhatsApp number (using Meta's sign-in tools in the app) and to send and receive messages.
• Anthropic, OpenAI and Google — AI replies, only when AI features are on.
• Resend — account emails such as password resets, payment reminders and AI chat hand-over alerts.
• Razorpay — subscription payments.
• Google Fonts — fonts used by our website and apps (your device's IP address is sent to Google when fonts load).

We may also disclose information if the law or a valid government request requires it, to protect the rights or safety of our users or the public, or as part of a merger or sale of our business (with notice to you).

Shared links and photos: invoice links you send to customers open the invoice for anyone who has the link until the link is reset (contact us to reset one). Product photos, logos, campaign images and photos or files attached to bills, expenses and other records are stored at hard-to-guess addresses and can be viewed by anyone who has the address, so do not attach documents you would not want shared.

6. Data Stored Outside India

Some of our service providers store or process data outside India, including in the United States (for example, file storage and AI providers). We transfer data only as permitted by Indian law.

7. Cookies and Browser Storage

• App: a secure session cookie keeps you signed in. The app also saves your display preferences (such as theme and selected branch) in your browser.
• Website chat: stores a visitor ID in your browser so the chat can continue.
• Marketing website: no cookies.

8. How Long We Keep Data

• We keep your business's data while your account is active.
• Sign-in sessions expire after 7 days without use. Password-reset links expire after 1 hour.
• The audit log of changes made in the app is deleted after 90 days. Other technical and security records may be kept longer where needed for security or the law.
• If you ask us to delete your data, we do so within 30 days of confirming the request. If your account is closed without such a request, we delete or anonymise your business's data within 90 days, unless we must keep some of it longer to meet a legal, tax or accounting obligation, or to resolve a dispute. Copies in backups are removed as the backups expire.

Your business is responsible for keeping its own records for as long as the law requires (for example, GST records). Ask us for a copy of your data before closing your account.

9. How We Protect Data

• Data is sent over encrypted (HTTPS) connections.
• Passwords are stored only as secure hashes.
• WhatsApp access tokens and PINs are encrypted.
• Role-based permissions control what each staff member can see and do, and an audit log records changes.
• Invoice files are opened through short-lived download links.

No system is perfectly secure. If a breach affects your personal data, we will inform you and the authorities as the law requires.

10. Your Rights

Under the Digital Personal Data Protection Act, 2023, you can:

• ask for a summary of the personal data we hold about you and how we use it;
• ask us to correct, complete or update it;
• ask us to delete it, where we are not required to keep it;
• withdraw consent you gave earlier (this will not affect what was done before);
• nominate another person to exercise your rights if you die or are unable to; and
• raise a grievance with us and, if not resolved, with the Data Protection Board of India.

To use these rights, email info@skyllect.com. We will acknowledge your request within 48 hours and respond within 30 days. We may need to verify your identity first. If your data was added by a business that uses ManageVyapar, we may pass your request to that business. See also our Data Deletion page.

11. WhatsApp Messages

Businesses using ManageVyapar must have permission before messaging you on WhatsApp. To stop marketing messages from a business, reply with just the word STOP or UNSUBSCRIBE, or tap the opt-out button in the message. You may still receive messages about your own orders, bookings and enquiries.

12. Children

The Service is meant for businesses and is not intended for anyone under 18. We do not knowingly collect children's data for our own purposes.

13. Changes to This Policy

We may update this policy from time to time. We will change the "Last updated" date and, for important changes, tell account owners by email or in the app.

14. Grievance Officer and Contact

Grievance Officer: Brijesh Borad
Email: info@skyllect.com
Address: Skyllect Private Limited, 339 Golden Square, Mota Varachha (Digital Valley), Surat 394101, Gujarat, India

We will acknowledge your complaint promptly and aim to resolve it within one month.