Privacy Policy

VyaparSetu is accounting and collections software for Indian businesses. That means there are two kinds of person whose data passes through it, and the law treats them differently.

The business owner who signs in. We hold their mobile number and name so they can reach their own books. Upmarket Trader LLP is the Data Fiduciary for that information.

The customers and suppliers whose details a business enters. Names, phone numbers, email addresses, GSTINs and the invoices between them. The business decides what to collect and why; Upmarket Trader LLP only processes it on their instructions, as a Data Processor. If you are a customer of a business that uses VyaparSetu and you want your details changed or removed, that business is who to ask — though you may also write to us and we will pass it on.

• Sign-in details: mobile number, name, and which businesses an account may open.
• Customer and supplier records: name, phone, email, GSTIN, address, and the invoices, payments and credit notes between them.
• Documents uploaded or photographed for data entry, and what was read out of them.
• Bank account details and transaction lines used to match payments to invoices.
• Messaging consent: whether a customer agreed to be contacted on WhatsApp, where that consent was given, and a note of the circumstances.
• A record of every reminder sent — when, to which number, and whether it was delivered, read or replied to.
• An audit trail of significant actions taken inside the software.

Payment reminders are sent over WhatsApp only where a business has recorded that the customer agreed to receive them, and that the agreement was obtained outside WhatsApp — on an invoice, a website, in person or on a call. Consent given inside a WhatsApp conversation is not accepted.

Every message concerns an existing invoice. No marketing or promotional message is sent through this channel.

Replying STOP ends it. The reply is honoured immediately and across every business on VyaparSetu holding that number, not only the one that sent the message. Other wordings that clearly ask to stop are treated the same way.

Personal data is not sold, and is not shared for anyone else’s advertising. It reaches the following services because the product cannot do its job without them.

Records are also transmitted to government systems — the GST Network, the e-invoice portal and the e-way bill portal — when a business files a return or generates a document through VyaparSetu. That is the purpose of filing.

The database is hosted on Amazon Web Services in Tokyo. Data is encrypted in transit and at rest, and each business’s records are separated at the database level so that one business’s account cannot read another’s.

Accounting records cannot simply be deleted on request: Indian tax law requires them to be kept, and that requirement lawfully overrides an erasure request under the DPDP Act. The periods the software enforces are:

Under the Digital Personal Data Protection Act 2023 you may ask us to:

• tell you what personal data of yours we hold and who it has been shared with;
• correct anything inaccurate or incomplete;
• erase what is no longer needed — subject to the retention periods above, which we will identify if they apply;
• nominate someone to exercise these rights if you die or become incapacitated;
• raise a grievance, and escalate to the Data Protection Board if unsatisfied.

To delete an account and the data belonging to it, see deleting your data.

If personal data is exposed, affected people and the Data Protection Board are notified as the DPDP Rules require. Incidents are recorded whether or not they meet that threshold.

Grievance Officer: The Designated Partner, Upmarket Trader LLP.

Registered office address to be confirmed

info@upmarketindia.com

We answer data-protection requests within the period the DPDP Rules allow.