Privacy Policy

Effective Date: Sep 29th , 2026

Last Updated: Sep 29th , 2026

Legal Entity: LnP INFOTECH PVT. LTD (“BillKaro”, “we”, “us”, or “our”)

Registered Office Address: D-236, 1st Floor, Phase 8B, Sector-74, Industrial Area, Mohali, Punjab – 160055

Privacy Contact Email: info@billkaropos.com

1. INTRODUCTION AND SCOPE

This Privacy Policy governs the processing of data collected or managed by BillKaro in connection with the following platforms and services (collectively, the “Platform”):

• The BillKaro Web Admin Portal
• The BillKaro Cloud API and backend infrastructure
• The BillKaro Windows POS desktop application

1.1 B2B Platform Role

BillKaro operates primarily as a Business-to-Business (B2B) platform. Restaurant operators and retail merchants (“Merchants”) utilize the Platform to conduct business operations, manage staff, process billing, and run customer loyalty programs.

• Merchant Data: BillKaro acts as a Data Controller for personal data provided directly by Merchants and their staff for account setup, administrative access, billing, and system support.
• Customer Data: BillKaro acts as a Data Processor (or service provider) regarding end-customer data entered or processed by Merchants through the Platform. Merchants retain responsibility for ensuring that end-customer personal data is collected lawfully in accordance with applicable privacy laws.

2. INFORMATION WE COLLECT

We collect and process the following categories of information across our services:

2.1 Merchant and Staff Account Information

When a Merchant creates or administers an account on BillKaro, we collect:

• Staff Profiles: Full name, email address, phone number, assigned roles, store permissions, and staff codes. Passwords and POS security PINs are strictly stored in a secure, one-way hashed format (PasswordHash / PosPinHash).
• Store Profiles: Business name, physical store address, contact numbers, store email, tax registration identifiers (e.g., GST, FSSAI, VAT), store coordinates (latitude/longitude), and local payment payee details (such as UPI payee address and name).

2.2 End-Customer Information Processed for Merchants

When Merchants utilize the Platform to record sales, manage orders, or issue digital receipts, the following customer data may be processed:

• Contact Information: Full name, phone number, email address, and saved delivery addresses.
• Order and Transaction History: Order items, notes, payment tender types (e.g., Cash, Card, UPI), delivery status, and tokenized links for public invoices and feedback forms.
• Store Wallets: Balance logs and transaction history for store-specific digital wallets managed directly by the Merchant.

2.3 Technical and Device Data

To ensure system security, license verification, POS synchronization, and operational diagnostic monitoring, we automatically collect:

• POS Identifiers: System-assigned POS device GUIDs, computer machine names at activation, public cryptographic device keys, and the last-seen IP address.
• Diagnostics & Web Logs: Browser user-agent strings, request timestamps, and API network logs (ApiRequestLog) used strictly for system maintenance and troubleshooting.

2.4 Explicitly Excluded Capabilities

BillKaro does not collect advertising IDs (e.g., AAID, IDFA), track continuous customer GPS location, access device address books/contacts, or record raw audio/video via microphone or camera APIs.

3. THIRD-PARTY SERVICE PROVIDERS

We share data with trusted third-party service providers solely to execute core Platform functionality:

Provider / Service	Purpose	Data Transmitted
MSG91	WhatsApp & SMS Notifications	Destination phone number, customer name, order number, order total, store name, invoice/review URLs, and template text.
Cashfree	Payment Gateway (Merchant Subscriptions)	Customer ID, email, phone number, and name on checkout. BillKaro stores transaction references and basic card metadata (card brand, expiry date, last 4 digits). Full card numbers (PAN) and CVVs are never stored or processed by BillKaro.
Custom Email Server	Transactional Emails	Recipient email address, subject line, and message body content (e.g., verification emails, account notifications).
SFTP Host	POS Database Backups	Encrypted local database snapshots uploaded securely for disaster recovery.

4. DATA SECURITY, STORAGE, AND ENCRYPTION

We implement industry-standard technical and organizational security measures to protect stored and transmitted data:

• Local POS Security: Local SQLite databases on Windows POS terminals are encrypted at rest using SQLCipher. Sensitive local configurations and device private keys are secured using Windows Data Protection API (DPAPI).
• Cloud Security: Cloud API endpoints require HTTPS (TLS/SSL) and token-based authentication (JWT with refresh tokens) to secure data in transit.
• Password/PIN Protection: Passwords and POS PINs are hashed before persistence to prevent cleartext exposure.

5. RECORD RETENTION AND ACCOUNT DELETION

5.1 Soft Deletion

To prevent accidental loss of operational history and maintain financial integrity, records deleted by Merchants (such as customer profiles or staff accounts) are soft-deleted or marked inactive (IsDeleted / IsActive = false) rather than physically erased immediately.

5.2 Account Closure & Data Erasure Procedures

Merchants seeking to terminate their BillKaro subscription and request complete account closure and data deletion may submit a written request to [PRIVACY EMAIL].

• Deletion SLA: Valid merchant deletion requests will be processed within [e.g., 30 business days], subject to legal, tax, or regulatory retention requirements.
• End-Customer Requests: Restaurant guests or end-customers seeking to exercise data deletion rights must contact the respective Merchant/Restaurant directly. BillKaro will assist Merchants in fulfilling verified end-customer deletion requests where applicable.

6. USER RIGHTS AND GRIEVANCE CONTACT

Subject to applicable privacy legislation, users may have rights regarding access, correction, or deletion of their personal data.

• Merchant Rights: Merchants may update or modify store and staff profiles directly within the Web Admin Portal.
• Grievances & Inquiries: For privacy-related inquiries, grievance redressed, or rights enforcement, please contact our Privacy Officer:

Grievance / Privacy Officer: Sunil Kumar

Email: info@billkaropos.com

Address: D-236, 1st Floor, Phase 8B, Sector-74,Industrial Area, Mohali, Punjab – 160055

7. CHANGES TO THIS PRIVACY POLICY

BillKaro reserves the right to update this Privacy Policy to reflect changes in our operational practices or legal obligations. When updates are published, the Effective Date at the top of this page will be revised accordingly. Material updates will be communicated to Merchants through the Web Portal or via email.