1. Who we are
ApnaTheka is operated by Accorgminds Private Limited, a company incorporated under the Companies Act, 2013 (CIN U62099RJ2025PTC108933), with its registered office at 2nd Floor, AMJ Royal Tower, Opp. Police Line, Bikaner 334001, Rajasthan, India ("we", "us", "the Company").
This policy is published under the Information Technology Act, 2000, the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, and the Digital Personal Data Protection Act, 2023. It replaces the version dated 11 August 2026.
2. What this policy covers
It covers every surface of ApnaTheka:
- The website at accorgwines.com, including the demo and sign-up forms.
- The web application used by organizations, their companies and their shops.
- The ApnaTheka app for Android (package
com.apnatheka.app), and the same app on iOS when it is published.
By using any of them you accept this policy. If you do not, please do not use the service.
3. Our role with your data
Under the Digital Personal Data Protection Act, 2023 we act in two capacities, and it matters which one applies:
| Data | Our role | What that means |
|---|---|---|
| Your account, logins, billing and the website's forms | Data Fiduciary | We decide why and how it is processed, and we answer for it. |
| The business records your organization enters — purchases, sales, stock, cash, accounts, staff, customers of your shops | Data Processor | Your organization decides. We process it only to deliver the service and on your instructions. |
4. What we collect
On the website
- When you ask for a demo: your name, mobile number, email (optional), city and number of shops, and the plan if you asked from the pricing page. You may verify the mobile with a one-time code sent on WhatsApp; the request records whether you did.
- With a demo request we keep how you reached the website: if a link with campaign tags brought you (
utm_*, or an advertiser's click ID such as Google'sgclidor Meta'sfbclid), those tags, the page that link opened and the site that sent you there; otherwise the page you sent the request from and the page you came to it from — so we can tell which of our advertising works. - Server logs: IP address, browser and the pages requested, kept for security and troubleshooting.
- The website loads no third-party analytics or advertising tags.
In the web application
- Logins: name, email, mobile number or shop code, a password stored only as a salted hash, the role held, and sign-in activity.
- Business records your organization enters: companies and licences, shops and godowns, staff and their salaries, purchases and the corporation invoices behind them, sales and the daily parcha, stock, cash, vouchers and accounts.
- Customer details recorded at the counter: a customer's name and mobile number, and what they bought, where the shop uses counter billing or a customer khata.
- Activity logs: which screens were opened and which vouchers were changed, by whom and when.
- NDA acceptances, where an NDA is in force for your login: the version you accepted, the full name you typed, the mobile number or email the one-time code went to, and when.
Payments
See section 9. We never see or store card numbers, CVVs, UPI PINs or net-banking credentials.
5. The ApnaTheka app
The app is used by staff at a licensed shop. It shows nothing until a shop signs in with the login its own organization issued, and everything it shows belongs to that shop.
Permissions, and what each one is for
| Permission | Used for |
|---|---|
| Camera | Scanning a barcode at the counter, and the selfie with an attendance punch when the company asks for one. It is optional: a phone without a camera can still be used. |
| Bluetooth | Finding and printing to the receipt printer on your counter. The app declares Bluetooth scanning with Android's "never for location" flag, so it cannot infer where you are from it. |
| Location (precise and approximate) | Only for attendance, and only when the organization has switched attendance on: the phone's position is sent with a punch in or out, and once to save the shop's own position. The app does not track where you are at any other time. |
| Notifications | Notices about the shop's work — stock in, an app order, rates changed, the day's close — sent through Firebase Cloud Messaging with a device token. Nothing else is sent, and none of it is advertising. |
| Internet and network state | Reaching our servers and a Wi-Fi printer on your shop's own network. |
The app asks for nothing else: no contacts, no storage, no microphone, no SMS. It contains no advertising or analytics SDK and collects no advertising identifier.
What the app keeps on the phone
- The shop's working data — bills, stock, brand and price lists, day figures — so the counter keeps working when the internet does not.
- Customer names and mobile numbers given at the counter, inside the bills that carry them.
- The login token of each signed-in shop.
The database file is encrypted with a key held in the Android Keystore; the columns that carry customer numbers and bill money are encrypted a second time with a separate key; login tokens are kept in the Keystore. Android cloud backup and device-to-device transfer are switched off for the app, and it refuses plain HTTP — data travels over TLS only.
Losing a phone
Signing out revokes that login on our servers and removes it from the phone. If a phone is lost, sold or handed on, the organization should switch that shop login off or reset its password from its own settings: every phone holding that login is signed out at once, from our side, whether or not the phone is recovered.
6. The ApnaTheka Liquor Booking app
ApnaTheka Liquor Booking (Android package com.apnatheka.liquorbooking) is for adult customers, aged 21 or over, of licensed shops that use ApnaTheka, and for the Sales Partners those shops appoint. It books an order for pickup: you collect it in person at the shop, show your pickup code and pay at the counter. Nothing is delivered and nothing is paid in the app.
What it collects, and what for
| Data | Used for |
|---|---|
| Mobile number (required) | Signing in with a one-time code sent on WhatsApp, and finding your customer card at the shops you join. |
| Name (optional) | Showing your name on your orders at the shop. |
| Date of birth (required) | Confirming once that you are 21 or over. It is stored encrypted on your ApnaTheka ID and used for nothing else. |
| Orders and bills | Your order history at each shop you join. Each shop keeps its own customer card and bills for you as its sales records. |
| Approximate location (optional) | Only when you allow it: sent, rounded to about 100 metres, to list the nearest shops first. It is not stored. |
| Notification token (optional) | Telling you that an order is ready or not available, and other notices about your account at a shop. |
| Your choices | The notice you accepted and each purpose you allowed or refused, with the date — kept so the shop can show what you agreed to. |
A Sales Partner also sees the customers they brought — first name and the last four digits of the mobile number only — and their own earnings.
Permissions
Internet, approximate location (optional) and notifications (optional). The app asks for nothing else: no camera, contacts, storage, microphone or SMS. It contains no advertising or analytics SDK and collects no advertising identifier. Your sign-in is kept in the Android Keystore; data travels over TLS only.
You can pause the app, sign out on every device, or delete your ApnaTheka ID from inside it — see the data deletion page.
7. How we use it
- To provide the service: your books, your shops' work, your reports.
- To sign you in and keep your account secure: one-time codes, password resets, session checks, activity logs.
- To send the messages the service sends (section 14).
- To bill your subscription and issue tax invoices.
- To answer support requests and demo enquiries.
- To meet legal obligations — GST, income tax, excise and company law.
We do not sell personal data, and we do not use it for advertising.
9. Payments
Subscription fees can be paid online through PhonePe, or by bank transfer, UPI, cheque or cash recorded by our team. For every payment we keep the amount, date, method, the transaction or reference number, and the tax invoice. Card, UPI and net-banking credentials are entered on the aggregator's pages, never on ours.
10. How it is protected
- Every company's books live in a database of their own; no company can reach another's.
- All traffic is over TLS; the app refuses plain HTTP.
- Passwords are stored as salted hashes. One-time codes expire in minutes and are limited in attempts.
- Access follows a role: a person sees only the companies and screens their role allows, and every voucher change is logged with who made it.
- On the phone: an encrypted database and Keystore-held keys, as in section 5.
- We take server snapshots before every deployment and keep them for a limited time, to recover from a failure.
No system is perfectly secure. Keep your login private, and tell us at once at accorgminds@gmail.com if you suspect it has been misused.
11. How long we keep it
| Data | Kept for |
|---|---|
| Your organization's books and logins | While the account is active, and after it closes until the account holder asks for deletion (see the Data & Account Deletion page), so that a closed account can be revived or its records produced for an audit. |
| Accounting, sales, purchase and stock records; our tax invoices and payment records | Up to 8 years — the longest period Indian company, GST and income-tax law require — even after a deletion request. They are locked away from the live product. |
| Demo and sign-up enquiries | Until the enquiry is closed, then removed on request. |
| Server and activity logs | While the account is active, for security and support. |
| On the phone | Removed when the shop signs out; uninstalling removes everything the app stored. |
12. Your rights
Subject to the law, you may ask us to:
- tell you what personal data we hold about you and give you a copy;
- correct data that is wrong or out of date;
- delete your data, except what we must keep by law — the Data & Account Deletion page says how;
- stop non-essential messages;
- nominate another person to exercise these rights if you die or become incapacitated, as the Digital Personal Data Protection Act, 2023 provides.
Write to accorgminds@gmail.com with the subject "Data request". We verify that the request comes from the account holder, and reply within 30 days. If you are not satisfied, you may approach the Data Protection Board of India once it is operational.
14. WhatsApp and email
The service sends only messages that belong to it: one-time codes for signing in and for the website's forms; the day-end parcha summary and a pending-parcha reminder to the people your organization names; a bill ready to accept at a shop; and invoices and payment reminders. Every send is logged so a missing message can be traced.
Which staff receive which alerts is set by your organization in its settings. We do not send marketing to anyone who has not signed up.
15. Age
The service is for licensed businesses run by adults. We do not knowingly collect data from anyone under 18.
16. Where data is processed
Our servers are on Amazon Web Services. The services named in section 8 may process the data sent to them outside India, under their own contractual safeguards. We keep those transfers to what the feature needs.
17. Changes
When this policy changes, the dates at the top change with it. A change that affects what we collect or share is announced by email or inside the application before it takes effect.
18. Contact and grievances
Accorgminds Private Limited
2nd Floor, AMJ Royal Tower, Opp. Police Line, Bikaner 334001, Rajasthan, India
Grievance Officer: Mr. Subhash Saran
Email: accorgminds@gmail.com · Phone / WhatsApp: +91 8619700971
This policy is governed by the laws of India; disputes are subject to the courts at Bikaner, Rajasthan.
