Privacy Policy

1. Who we are

ApnaTheka is operated by Accorgminds Private Limited, a company incorporated under the Companies Act, 2013 (CIN U62099RJ2025PTC108933), with its registered office at 2nd Floor, AMJ Royal Tower, Opp. Police Line, Bikaner 334001, Rajasthan, India ("we", "us", "the Company").

This policy is published under the Information Technology Act, 2000, the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, and the Digital Personal Data Protection Act, 2023. It replaces the version dated 11 August 2026.

2. What this policy covers

It covers every surface of ApnaTheka:

• The website at accorgwines.com, including the demo and sign-up forms.
• The web application used by organizations, their companies, their shops and the accounting firms they engage.
• The ApnaTheka Shop app for Android (package com.apnatheka.shop), and the same app on iOS when it is published.
• The customer QR portal a shop can switch on, through which a customer views stock and places an order.

By using any of them you accept this policy. If you do not, please do not use the service.

3. Our role with your data

Under the Digital Personal Data Protection Act, 2023 we act in two capacities, and it matters which one applies:

4. What we collect

On the website

• When you ask for a demo or start free: your name, mobile number, email (optional), city and number of shops. The mobile is verified with a one-time code sent on WhatsApp.
• Server logs: IP address, browser and the pages requested, kept for security and troubleshooting.
• The website carries no analytics or advertising trackers.

In the web application

• Logins: name, email, mobile number or shop code, a password stored only as a salted hash, the role held, and sign-in activity.
• Business records your organization enters: companies and licences, shops and godowns, staff and their salaries, purchases and the corporation invoices behind them, sales and the daily parcha, stock, cash, bank statements you upload, vouchers and accounts.
• Invoice photos and PDFs uploaded for Smart Entry (see section 8 for how they are read).
• Saved statement passwords, if you choose to save the password of a protected bank statement — stored encrypted.
• Customer details recorded at the counter: a customer's name and mobile number, and what they bought, where the shop uses counter billing or a customer khata.
• Activity logs: which screens were opened and which vouchers were changed, by whom and when.

Payments

See section 9. We never see or store card numbers, CVVs, UPI PINs or net-banking credentials.

5. The ApnaTheka Shop app

The app is used by staff at a licensed shop. It shows nothing until a shop signs in with the login its own organization issued, and everything it shows belongs to that shop.

Permissions, and what each one is for

The app asks for nothing else: no location, no contacts, no storage, no microphone, no SMS. It contains no advertising or analytics SDK and collects no advertising identifier.

What the app keeps on the phone

• The shop's working data — bills, stock, brand and price lists, day figures — so the counter keeps working when the internet does not.
• Customer names and mobile numbers given at the counter, inside the bills that carry them.
• The login token of each signed-in shop.

The database file is encrypted with a key held in the Android Keystore; the columns that carry customer numbers and bill money are encrypted a second time with a separate key; login tokens are kept in the Keystore. Android cloud backup and device-to-device transfer are switched off for the app, and it refuses plain HTTP — data travels over TLS only.

Losing a phone

Signing out revokes that login on our servers and removes it from the phone. If a phone is lost, sold or handed on, the organization should switch that shop login off or reset its password from its own settings: every phone holding that login is signed out at once, from our side, whether or not the phone is recovered.

6. The customer QR portal

A shop may print a QR code that opens its shop page. A customer who scans it:

• Gives a name and mobile number, and declares that they are 21 or older. Date of birth is optional. The number is verified with a WhatsApp one-time code only where the shop has switched that on.
• May allow the browser to share their location once, to pick the nearest shop. It is used for that choice and is not stored.
• Is remembered on that phone for one year through an encrypted cookie, so the number is not asked again. "Switch number" on the page removes it.
• Creates orders, and where the shop offers them, holds a membership rank and credit points earned from purchases.

What the shop sees of a customer — their orders, points, rank and the messages they receive — is the shop's record, and the shop can stop messages to a customer or erase their identity from its Customer screen.

7. How we use it

• To provide the service: your books, your shops' work, your reports.
• To sign you in and keep your account secure: one-time codes, password resets, session checks, activity logs.
• To read a bill from a photo when you ask for it.
• To send the messages the service sends (section 14).
• To bill your subscription and issue tax invoices.
• To answer support requests and demo enquiries.
• To meet legal obligations — GST, income tax, excise and company law.

We do not sell personal data, and we do not use it for advertising.

8. Who we share it with

Only the services that deliver a feature you use, each under its own terms and only with what that feature needs:

We also disclose data when a court, a tax or excise authority or another public body lawfully requires it, and to a successor if the business is transferred, on the same terms as this policy. Our staff see your data only when needed to support you, and are bound by confidentiality.

9. Payments

Subscription fees can be paid online through PhonePe, or by bank transfer, UPI, cheque or cash recorded by our team. For every payment we keep the amount, date, method, the transaction or reference number, and the tax invoice. Card, UPI and net-banking credentials are entered on the aggregator's pages, never on ours.

10. How it is protected

• Every company's books live in a database of their own; no company can reach another's.
• All traffic is over TLS; the app refuses plain HTTP.
• Passwords are stored as salted hashes. One-time codes expire in minutes and are limited in attempts. Saved statement passwords are encrypted.
• Access follows a role: a person sees only the companies and screens their role allows, and every voucher change is logged with who made it.
• On the phone: an encrypted database and Keystore-held keys, as in section 5.
• We take server snapshots before every deployment and keep them for a limited time, to recover from a failure.

No system is perfectly secure. Keep your login private, and tell us at once at accorgminds@gmail.com if you suspect it has been misused.

11. How long we keep it

12. Your rights

Subject to the law, you may ask us to:

• tell you what personal data we hold about you and give you a copy;
• correct data that is wrong or out of date;
• delete your data, except what we must keep by law — the Data & Account Deletion page says how;
• stop non-essential messages;
• nominate another person to exercise these rights if you die or become incapacitated, as the Digital Personal Data Protection Act, 2023 provides.

Write to accorgminds@gmail.com with the subject "Data request". We verify that the request comes from the account holder, and reply within 30 days. If you are not satisfied, you may approach the Data Protection Board of India once it is operational.

13. Cookies and device storage

• Session and security cookies keep you signed in and protect forms. They carry no tracking.
• The portal cookie (pt_id) remembers a customer's number on their own phone for one year, encrypted.
• Browser storage on the shop terminal keeps printer settings and unsent bills so a counter keeps working offline.

We set no advertising or analytics cookies, so there is nothing to opt out of. Blocking cookies in your browser will stop the sign-in from working.

14. WhatsApp and email

The service sends only messages that belong to it: one-time codes for signing in and for the website's forms; the day-end parcha summary and a pending-parcha reminder to the people your organization names; a bill ready to accept at a shop; invoices and payment reminders; and, where a shop runs campaigns, offers to customers who have joined its portal. Every send is logged so a missing message can be traced.

Which staff receive which alerts is set by your organization in its settings. A customer's messages can be stopped by the shop from its Customer screen, or by writing to us. We do not send marketing to anyone who has not signed up.

15. Age

The service is for licensed businesses run by adults. The customer portal is for people of legal drinking age in their state, and asks for a declaration of being 21 or older. We do not knowingly collect data from anyone under 18.

16. Where data is processed

Our servers are on Amazon Web Services. The services named in section 8 may process the data sent to them outside India, under their own contractual safeguards. We keep those transfers to what the feature needs.

17. Changes

When this policy changes, the dates at the top change with it. A change that affects what we collect or share is announced by email or inside the application before it takes effect.

18. Contact and grievances