# Privacy Policy — POSCountr

> How POSCountr (Aarvin Ventures) collects, uses, shares, stores and protects personal data, and your rights under India’s DPDP Act, 2023.

Source: https://www.poscountr.com/privacy-policy · Last updated: 2026-11-08

Last updated: 2026-11-07. Operated by Aarvin Ventures.

This policy explains how Aarvin Ventures handles personal data in POSCountr — our web dashboard, our iPhone, iPad and Android apps, and this website.

## The short version

- We never sell personal data — no advertising trackers
- Each business’s data is kept apart at the database
- Stored with Hetzner, delivered through Cloudflare
- Access, correct or erase your data any time

## 1. Who we are, and our role

POSCountr (“POSCountr”, “we”, “us”, “our”) is business software operated by **Aarvin Ventures**, Villa 24, Plot No 24, Affluence Villas, Haris Pranava Township, Manneguda, Ranga Reddy, Telangana 501510, India (GSTIN 36BXTPR0969J1ZJ).

We play two roles under the Digital Personal Data Protection Act, 2023 (“DPDP Act”) and the Digital Personal Data Protection Rules, 2025:

- **Data Fiduciary** for the personal data of people who hold a POSCountr account (owners, managers and kitchen staff), people who contact us, and visitors to this website.
- **Data Processor** for personal data that a business records about its own customers, suppliers and staff in POSCountr — for example a customer’s name and phone number on a bill. For that data the business is the Data Fiduciary, and we process it only on its instructions, as set out in our [Data Processing Terms](https://www.poscountr.com/data-processing).

This policy is published in accordance with the DPDP Act, the Information Technology Act, 2000, and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011.

## 2. The short version

- We collect what is needed to run billing, GST invoicing, kitchen, stock, team and accounts for your business — nothing more.
- We **never sell** personal data, and there are no advertising trackers in our apps or on this website.
- Each business’s data is kept apart at the database level; staff see only what their role allows.
- Data is stored with Hetzner Online (servers in Singapore and Germany), delivered through Cloudflare.
- You can access, correct and erase your data, withdraw consent and raise a grievance at any time.

## 3. What we collect

| Category | What it includes | From |
| --- | --- | --- |
| Owner accounts | Name, email address, password (stored only as a one-way hash), role and the business you belong to | You, at onboarding |
| Staff accounts | Name, username, 6-digit PIN (stored only as a one-way hash), role and assigned outlet | The business owner |
| Business details | Business names, GSTINs, registered states and addresses, outlets, logos, bill headers and footers, and the bank or UPI details a business chooses to print on its bills | The business owner |
| Sales and bills | Items, prices, taxes, payments, discounts, cancellations and their reasons; the customer’s name and phone number, and optionally email, GSTIN and state for B2B invoices | Staff at the point of sale |
| Memberships, subscriptions and quotations | Name and phone number of members and subscribers, plan and usage; recipient details on quotations | Staff of the business |
| Stock, purchases and suppliers | Products, stock movements, purchase orders, supplier names, GSTINs, contact details and payments | Staff of the business |
| Team and attendance | Names, worker type and daily attendance of a business’s staff | The business |
| Security and usage logs | Sign-in times, IP address, client (web or app), failed attempts, active sessions, and an audit trail of sensitive actions | Automatically |
| App and device | App version and operating system (to offer updates); the receipt printer you pair, stored on your device | Your device |
| Communications | Messages, calls and emails with us | You |

**What we don’t collect:** card or bank-account numbers of your customers (if a business uses payment terminals, those are handled by Razorpay), government ID numbers, health records, biometrics or your location.

## 4. App permissions

- **Camera — optional.** Asked for only when you open the barcode scanner. The image is processed on your device; only the decoded barcode number is used, to find the product. No photo or video is saved or sent.
- **Bluetooth — optional.** Used only to find and print to your receipt printer. It is not used to locate you.
- **Files — only what you pick.** When you attach a file (for example a way bill or a logo), only that file is uploaded.

The apps do not use the microphone, contacts, photo library or location. Declining a permission affects only the feature that needs it: products can always be searched, and bills can always be shared as a PDF. You can change permissions in your device’s settings at any time.

## 5. How we use personal data

- To provide POSCountr: sign-in, billing, invoices, kitchen tickets, stock, purchasing, memberships, subscriptions, reports, attendance and accounts export.
- To issue correct GST invoices and keep the records a business is required to keep.
- To keep accounts secure: verifying passwords and PINs, locking out repeated failed attempts, ending sessions and detecting misuse.
- To apply the limits of a business’s plan and the permissions of each role.
- To support you, onboard your business and tell you about changes to the service or your plan.
- To improve POSCountr using aggregated information that does not identify anyone.

We do not use personal data for advertising or sell it, and we do not make decisions with legal effect about anyone solely by automated means.

## 6. Legal basis

We process personal data on the basis of **consent** — given when you accept these terms, are added as staff, or contact us — and for **legitimate uses** under Section 7 of the DPDP Act, such as data you provide voluntarily for a purpose, and processing required to comply with law (for example GST record keeping).

Personal data about a business’s customers is processed on the business’s behalf; the business is responsible for having a lawful basis to record it and for giving its customers any notice the law requires.

You may withdraw consent at any time (see “Your rights”). Withdrawal does not affect processing already done, and may mean we can no longer provide the service to you.

## 7. Who we share it with

We do not sell personal data. Within a business, owners see that business’s data, and managers see the outlet they are assigned to. Outside it, we share only with:

| Provider | What they do for us | Where |
| --- | --- | --- |
| Hetzner Online GmbH | Servers, database and file storage | Singapore and Germany |
| Cloudflare, Inc. | Network security, DNS and delivery of the website and web app | Global network |
| Expo (650 Industries, Inc.) | Delivering app updates to installed apps (no business data) | United States |
| Apple and Google | App distribution through the App Store and Google Play | Global |
| Razorpay Software Pvt. Ltd. | Only if a business switches on payment terminals: creating UPI QR codes and payment links and confirming payments | India |

- **WhatsApp and other apps you choose.** When staff share a bill on WhatsApp or another app, it is sent from their own device and account; POSCountr does not send messages on anyone’s behalf.
- **Authorities.** Where required by law or a valid order of a competent Indian authority, including tax authorities.
- **A successor.** If our business is transferred, under the same protections as this policy.

## 8. Where data is stored

Data is stored with Hetzner Online (servers in Singapore and Germany), delivered through Cloudflare. Transfers outside India are made as permitted by the DPDP Act and never to a country the Government of India has restricted.

**Files and bill links.** Bill PDFs, logos and attachments are stored in object storage at long, unguessable addresses. Anyone who has such a link can open that one file, so share bill links only with the intended customer.

## 9. How long we keep it

- **Accounts:** while the account is active. A deactivated user can no longer sign in; their name stays on records they created.
- **Invoices and the records behind them:** for as long as GST law requires a business to keep them — generally 72 months from the due date of the annual return for the year — even if an account or plan ends.
- **Security logs:** up to 12 months, unless needed longer to investigate an incident.
- **After a plan ends:** the business’s data is kept, read-only and then suspended, so it can be renewed or exported. On the owner’s written request we export it within 30 days and then delete it, except what the law requires us to keep.

When we receive a valid erasure request, we delete or anonymise the personal data within 30 days, except where retention is required by law.

## 10. How we protect it

- Each business’s data is separated by PostgreSQL row-level security and four checks in the application.
- Passwords and PINs are stored only as one-way hashes; weak PINs are refused and repeated failures lock out.
- Short-lived sign-in tokens; refresh tokens stored only as hashes and rotated on every use; sessions end at once when a user is deactivated or changes credentials.
- HTTPS everywhere with HSTS and a strict content-security policy; sign-in tokens on phones are kept in the iOS Keychain or Android Keystore.
- Daily database backups with tested restores, and an audit trail of sensitive actions, including any read-only support access.

More detail is on our [Security page](https://www.poscountr.com/security). No system is perfectly secure; if we become aware of a personal-data breach we will inform affected businesses and the Data Protection Board as the law requires.

## 11. Your rights

Under the DPDP Act you may:

- ask for a summary of the personal data we hold about you and how it is processed;
- ask us to correct, complete or update it;
- ask us to erase it, subject to records we or a business must keep by law;
- withdraw your consent;
- nominate someone to exercise these rights if you die or are unable to; and
- raise a grievance with us, and then with the Data Protection Board of India.

Email [sannagiri@aarvinventures.com](mailto:sannagiri@aarvinventures.com) or message [WhatsApp +91 81258 55266](https://wa.me/918125855266). We may ask you to verify your identity. If you are a **customer of a business** that uses POSCountr, please contact that business first — it controls your data — and we will help it respond. See also [Delete your account](https://www.poscountr.com/account-deletion).

## 12. Children

POSCountr accounts are for adults (18 or over) acting for a business. We do not knowingly create accounts for children. A business that records a child’s details on a bill is responsible for doing so lawfully.

## 13. Cookies and tracking

This website sets no cookies and uses no advertising or cross-site trackers. It remembers your light/dark theme choice in your browser’s local storage, and may use privacy-friendly, cookie-free Cloudflare Web Analytics to count page views. The web app keeps your sign-in session in your browser; the mobile apps keep it in your device’s secure storage.

## 14. Changes to this policy

We will update this policy when POSCountr changes. The date at the top shows the latest version; for material changes we will also notify account holders in the app or by email.

## 15. Grievance Officer and contact

|  |  |
| --- | --- |
| Name | Sannagiri Raviteja |
| Designation | Grievance Officer, Aarvin Ventures |
| Email | [sannagiri@aarvinventures.com](mailto:sannagiri@aarvinventures.com) |
| Phone / WhatsApp | +91 81258 55266 |
| Address | Villa 24, Plot No 24, Affluence Villas, Haris Pranava Township, Manneguda, Ranga Reddy, Telangana 501510, India |

We acknowledge every grievance within 48 hours and aim to resolve it within one month of receipt. If you are not satisfied with our response on a personal-data matter, you may approach the Data Protection Board of India.