Privacy Policy
Zoffer Bills ("we," "our," or "us") is a business expense and billing management platform operated by Zoffer Innovations Pvt Ltd, a DPIIT-recognised startup based in Delhi, India.
This Privacy Policy explains how we collect, use, protect, and handle your information when you use Zoffer Bills through our web application or WhatsApp interface.
Information We Collect
| Data | Purpose | Retention |
|---|---|---|
| Name, email, phone number | Account creation and authentication | Until you delete your account |
| Business name, GSTIN | Invoice and expense record-keeping | Until you delete your account |
| Bills and expenses you enter | Core product functionality | Until you delete them |
| Zoho Books OAuth credentials | To sync your accounting data with Zoho Books | Encrypted at rest, refreshed automatically |
| WhatsApp messages sent to us | To process invoice images and commands | Not stored — processed and discarded immediately |
| Invoice images sent via WhatsApp | To extract bill data using OCR | Deleted from all servers immediately after processing |
| Subscription and payment status | To manage your plan and billing | Until you delete your account |
Information We Do Not Collect
- Bank account details or passwords
- Zoho Books data beyond what you explicitly trigger through Zoffer Bills
- Invoice images after OCR processing is complete
- WhatsApp message content after your command is executed
- Browsing history or device fingerprints
We do not sell, rent, or trade your data to anyone, ever.
How We Protect Your Information
Encryption at rest
Your Zoho OAuth credentials (the keys that connect Zoffer Bills to your Zoho Books account) are encrypted in our database using AES-256-GCM — the same encryption standard used by banks and financial institutions. Even if our database were compromised, these credentials cannot be read without a separate encryption key stored outside the database.
Encryption in transit
All communication between your device, WhatsApp, and our servers occurs over HTTPS/TLS. Your data is encrypted while moving across the internet.
Message and media handling
- Invoice images sent over WhatsApp are deleted from our messaging provider's servers immediately after your bill is processed.
- Message text is redacted from messaging logs after delivery.
- Images are processed in memory and are never written to permanent storage on our servers.
Webhook security
Our WhatsApp integration validates the authenticity of every incoming message using cryptographic signature verification. Forged or tampered requests are rejected automatically.
Database security
Our database runs on Railway, a US-based cloud infrastructure provider, with encrypted disk storage. Access to the database is restricted to essential engineering staff and requires authenticated credentials stored in secure environment variables.
Authentication and access control
All API endpoints that handle user data require authenticated sessions. Session cookies are configured with httpOnly, sameSite, and secure flags to prevent common web attacks. Passwords are hashed using bcrypt before storage.
Third-Party Services
We use the following external services to deliver Zoffer Bills. We have reviewed each provider's data processing terms.
| Service | Purpose | What they receive | Their privacy policy |
|---|---|---|---|
| Twilio | WhatsApp messaging | Message content and images (deleted after processing) | twilio.com/legal/privacy |
| Zoho Books | Accounting sync | Your bills and expenses (via your existing Zoho account) | zoho.com/privacy.html |
| Google Gemini | Invoice OCR | Invoice images for text extraction (not used for model training per Google's API terms) | cloud.google.com/terms |
| OpenAI | Zoff AI assistant | Your queries to the AI assistant (not used for model training per OpenAI's API terms) | openai.com/policies/privacy-policy |
| Razorpay | Payment processing | Subscription payment details | razorpay.com/privacy |
| Railway | Cloud infrastructure | Hosts our database and backend services | railway.app/legal/privacy |
We do not share your data with any other third party.
Data Retention and Deletion
| Data type | Retention period |
|---|---|
| Account data (name, email, phone, business info) | Until you delete your account |
| Bills and expenses | Until you delete them or your account |
| Zoho OAuth tokens | Encrypted, refreshed automatically, deleted on account deletion |
| WhatsApp messages | Not retained — processed and discarded in real time |
| Invoice images | Not retained — deleted from all servers immediately after OCR |
| Payment and subscription data | Until you delete your account |
| Application logs | Retained for up to 30 days for debugging, then deleted |
When you request account deletion, all your data is permanently removed from our systems within 30 days.
Your Rights
You can request any of the following at any time by emailing zofferinnovations@gmail.com:
- Export — a copy of all data we hold about you and your business
- Correction — fix any inaccurate data in your account
- Deletion — permanent deletion of your account and all associated data within 30 days
- Restriction — stop processing your data while a dispute is being resolved
We will respond to all requests within 2 business days.
Who Can Access Your Data
| Person | Role | Access level |
|---|---|---|
| Chirag (Founder) | Infrastructure and engineering | Database, logs, environment configuration |
| Kevin | Engineering | Codebase, limited infrastructure access |
No other team members have access to production data. Access is reviewed whenever team composition changes.
We may access your bill and expense records via the database to provide support, debug issues, or comply with legal obligations. We do not access your data for any other reason.
Children's Privacy
Zoffer Bills is designed for business use. We do not knowingly collect information from anyone under 18 years of age.
Changes to This Policy
We may update this Privacy Policy from time to time. When we make changes, we will update the "Last updated" date at the top of this page. For significant changes, we will notify you via email or an in-app notice.
Governing Law
This Privacy Policy is governed by the laws of India. Any disputes arising from this policy shall be subject to the exclusive jurisdiction of the courts in Delhi, India.
Contact Us
If you have questions about this Privacy Policy or want to exercise your rights, contact us:
- Email: zofferinnovations@gmail.com
- Company: Zoffer Innovations Pvt Ltd
- Location: Delhi, India
- DPIIT Recognition: Recognised Startup
Zoffer Innovations Pvt Ltd — DPIIT Recognised Startup — Delhi, India