Privacy Policy

Last updated: October 8, 2026

This policy explains what personal data DukaanKit collects, why, who we share it with, how long we keep it, and your rights under India's Digital Personal Data Protection Act, 2023 and the Information Technology Act, 2000. It covers the website dukaankit.in, the DukaanKit POS (Windows, Mac, Android), the back-office at admin.dukaankit.in, DukaanKit CRM at crm.dukaankit.in, and the free tools.

1. Who we are

DukaanKit is operated by Arsalan Ahmed, an individual trading as DukaanKit, based in Bengaluru, Karnataka, India ("DukaanKit", "we", "us"). For the data in section 2 we are the data fiduciary (the one who decides why and how it is used). How to reach us is in section 12.

A shop's own records. When a shop uses DukaanKit to keep records about its own customers and staff (for example a customer's name and phone number on a bill or khata, or a staff member's attendance), the shop decides why that data is kept. For those records the shop is the data fiduciary and DukaanKit is its data processor: we use them only to run the service for that shop, as set out in section 6 of our Terms. If you are a customer or staff member of a shop, please contact the shop first. We will help the shop answer you.

2. What we collect and why

Account details: shop name, business type and city; the owner's name, mobile number and email; the owner's password and 4-digit PIN. We get these when you sign up at dukaankit.in/start or when we create your shop. Why: to create and secure your account and to contact you about it. Passwords and PINs are stored only as salted hashes, never in readable form.
Staff details: names, mobile numbers, roles, permissions and PINs (4 digits; an older 6-digit PIN keeps working until it is changed; stored only as hashes). Added by the owner or a manager. Why: so staff can sign in to the till and back-office with the right permissions.
Business records: menu and products, prices, stock, orders and bills, expenses, wastage, supplier details, and the names and phone numbers of customers that the shop enters. Why: to provide billing, stock, khata and reports (as the shop's processor, see section 1).
Photos you upload: product and menu pictures, wastage photos and support attachments. Why: to show them in your apps and to sort out support requests.
Location: the shop location the owner saves, and a staff member's phone location only at the moment they mark attendance. Why: to check that attendance is marked at the shop. We do not track location at any other time.
Payment details: your plan, billing period, amounts, Razorpay customer, subscription and payment-link IDs, and payment status. Why: to take payment, run auto-pay, give refunds and keep the accounts the tax law needs. We never see or store your card number, UPI PIN or bank password; Razorpay collects those.
Device details: a random device token for each till, its platform (Windows, Mac or Android), operating system version, app version and when it last connected. Why: to keep each till linked to the right shop and to let the owner switch a till off. We do not collect hardware identifiers such as IMEI or serial numbers.
App usage and health data: screens opened, where on a screen people tap (as a position, not what was typed), time on a screen, error messages, printer results and sync status. Why: to fix errors and improve the apps. See section 3.
Technical logs: IP address, browser or device type, time of each request, and sign-in attempts. Why: security, stopping fraud and abuse, rate limits and the audit trail.
Support: your messages and ticket history, attachments you send, and WhatsApp chats with our support number. Why: to answer you and keep a record of what was agreed.
DukaanKit CRM request form (dukaankit.in/crm): business name, your name, mobile, and optionally email, team size, city and a message. Why: to contact you about DukaanKit CRM. The request is saved in our own sales CRM.
DukaanKit CRM data: leads, notes, follow-ups and call logs that a CRM customer's team records, and, where the Calls app is used, call recordings and their transcripts. Why: to provide the CRM (as that customer's processor, see section 1). Transcripts are made on our own systems.
Website statistics: pages visited, buttons and tools used, rough location from your IP address, and device and browser type, through Google Analytics cookies. Why: to see which pages and tools help people. See section 8.

We do not set out to collect Aadhaar, PAN, bank account numbers, health data or children's data.

3. App usage analysis

The till and the back-office send us the usage and health data listed above.

It does not include your customers' details, amounts, item names, anything typed into the app, or PINs. Error messages are shortened, and anything that looks like an email address or phone number is removed before it is stored.
We use it to fix errors, improve screens, and suggest features or plans that may help your shop.
We may use an AI service (Anthropic's Claude) to turn totals for a shop, for example orders per hour, error counts and which features are used, into a weekly report for the DukaanKit team. It is not given customer data or names.
Usage and health records are deleted after 90 days.

4. Why we are allowed to use your data

To give you the service you signed up for: your account, billing, sync, support, security and payments. You give us this data for that purpose. We also keep some data because the law requires it, for example tax records, or to answer a lawful request.
Your consent: for the daily or weekly summary email, website statistics cookies, and contacting you about other DukaanKit products. You can withdraw consent at any time, as easily as you gave it (section 10). Withdrawing does not undo what was done before.

5. Who we share data with

We do not sell personal data or use your business data for advertising. Your business data is yours. We share data only with these service providers, who handle it for us to run DukaanKit:

OVHcloud: our servers and database. The servers are in Europe: Germany today, moving to the United Kingdom.
Vercel: hosts the dukaankit.in website (global network).
Razorpay Software Pvt Ltd: payments, auto-pay mandates and refunds (India).
Resend: sends our service emails, such as sign-in links and summaries (the recipient address and the email content). Emails are sent from its Tokyo, Japan region; Resend is a US company.
Anthropic: the weekly AI summary in section 3, totals only (USA).
Google (Analytics): website statistics (USA and global).
WhatsApp (Meta): support chats you start with us (global).
Browser push services (Google, Apple, Mozilla): delivering notifications you have switched on (global).

We may also share data when Indian law requires it, for example with a court, the police or a regulator acting under the law.

6. Data stored outside India

Our servers and some of our providers are outside India (see section 5). Indian law allows this, except to countries the Government of India restricts. If a country we use is restricted, we will move the data.

7. Security

All data travels over HTTPS/TLS encryption.
Each shop's data is kept separate in the database and checked on every request; only that shop's sign-ins can read it.
Passwords and PINs are stored only as salted hashes. Each till uses its own device token, which the owner can switch off. DukaanKit admin sign-in needs two-factor authentication.
Every change is recorded in an audit log. The DukaanKit team opens a shop's data only to support it, and every such visit is logged.
The till keeps a copy of the shop's data on the shop's own computer or phone so billing works without internet. Keep that device locked.

If a data breach happens, we will tell every affected person without delay: what happened, which data, the likely effect, what we are doing and what you can do. We will report it to the Data Protection Board of India and to CERT-In within the times the law sets.

8. Cookies and storage on your device

dukaankit.in uses Google Analytics cookies (_ga, _ga_*) to count visits and tool use. They do not contain your name, phone number or email. You can block them in your browser settings.
The site keeps two small values in your browser for this visit only: whether you have seen the intro animation, and your mobile number while you move from sign-up to payment.
The free tools (calculators, invoice and menu makers, lead planner, attendance sheet and others) save what you type only in your own browser. It is never sent to us. Clearing your browser data deletes it.

9. How long we keep data

Account and business data: while your account is active. If you ask us to delete your account, we delete it from the live database within 30 days. Copies in our rolling backups are removed within a further 30 days.
Billing and payment records: as long as tax and accounting law requires, even after the account is deleted.
Usage and health records: 90 days.
Security logs: as long as Indian law requires (at least 180 days).
CRM request form entries and support tickets: until the matter is closed, and then only as long as needed to keep a record of it.

To delete your account: WhatsApp or email us (section 12) from the owner's mobile number or email. We confirm the request with you before deleting anything.

10. Your rights

Access: ask us for a summary of the personal data we hold about you, what we do with it, and who we shared it with. This is free and does not depend on your plan. (You can also see your data in the app, and CSV export in the back-office is an extra convenience.)
Correction: most details can be edited in the app; ask us for anything else.
Deletion: ask us to delete your data when it is no longer needed or you withdraw consent. Some records must be kept by law (section 9).
Withdraw consent: switch off summary emails in the back-office (Account), block analytics cookies in your browser, or tell us.
Nominate someone to use these rights for you if you die or become unable to.
Complaints: write to our Grievance Officer (section 12). We reply within 48 hours and resolve the complaint within 30 days.
Complain to the Data Protection Board of India if you are not happy with our answer.

To use any of these rights, contact us (section 12) from the mobile number or email on the account, so we can check it is you.

11. Children

DukaanKit is for businesses. You must be 18 or older to create or own an account. Under Indian law anyone under 18 is a child. Do not add anyone under 18 as staff without their parent's or guardian's verifiable consent. If we learn that we hold a child's data without that consent, we will delete it.

12. Contact and Grievance Officer

Grievance Officer: Arsalan Ahmed, Grievance Officer, DukaanKit
Email: [email protected]
WhatsApp / phone: +91 99165 16507
Address: No. 7, 5th Main, Cross, Davis Road, Sagayapura, Bengaluru, Karnataka 560084, India

We acknowledge every complaint within 48 hours and resolve it within 30 days.

13. Changes to this policy

We will post any change on this page with a new date. For important changes we will also tell account owners by email or in the app before they apply.

Privacy · Terms · Refunds & cancellation · Shipping & delivery · Contact