How we handle your data

This Privacy Policy explains what personal information Bizorexa collects when you use BizDash, why we collect it, how we use it, and the rights you have under Indian law.

Last updated: 14 June 2026 · Effective from your first use of BizDash

1. Who we are

Bizorexa is a partnership firm based in Pune, Maharashtra, India. We build and operate BizDash — a desktop and mobile business operating platform for salons, restaurants and similar service businesses. Throughout this policy, "we", "us", "our" and "Bizorexa" refer to the firm. "You" and "your" refer to anyone who uses BizDash.

2. What information we collect

2.1 Information you give us directly

• Account information: Your email address, password (stored as a one-way hash — we never see your actual password), display name, and chosen business type (salon or food).
• Google sign-in: If you sign in with Google, we receive your name, email address and profile picture from Google. We do not access any other Google data.
• Business profile: Optional information you enter — business name, address, phone, GST number, PAN, logo and branding details.
• Operational data: Bills, services, customer records, employee profiles, expense records and similar information you create while running your business in BizDash.
• Payment details: When you upgrade to a paid plan, payment information (card details, UPI ID, etc.) is collected and processed entirely by our payment partner Razorpay. We never see or store your card or UPI credentials.

2.2 Information we collect automatically

• Device identifier: A one-way hash of your device's hardware ID, used to track which devices are signed in to your account (for our single-device-per-Free-plan policy).
• Session information: Login timestamps, JWT session tokens, IP address at login time. We keep this only as long as needed for security and abuse prevention.
• Usage data: Aggregate counts like bills created per month, used to enforce plan limits.

3. How we use your information

We use the information above strictly to:

• Provide the BizDash service — billing, customer management, employee management, dashboards and everything else the product does.
• Verify your identity at login and prevent unauthorised access.
• Process plan upgrades through Razorpay.
• Send transactional email (see Section 4).
• Detect and prevent fraud, abuse and security incidents.
• Comply with applicable Indian law and respond to lawful requests.

We do not sell, rent or share your personal information with advertisers. We do not use your business data (bills, customers, employees) for any purpose other than providing the service to you.

4. Email communications

Transactional email we send includes:

• Email verification: A one-time password (OTP) when you sign up, to confirm your email address.
• Password reset: A secure link or OTP when you ask to reset your password.
• Billing receipts: A receipt after each successful Razorpay payment.
• Plan-change notifications: Confirmation when your plan is upgraded, renewed, or downgraded.
• Trial expiry reminders: A heads-up a few days before your free trial ends, and at expiry.
• Account security alerts: Notifications about new device sign-ins or unusual account activity.
• Service announcements: Critical product changes, planned downtime, or policy updates that affect how BizDash works for you.

Email is delivered through Amazon Simple Email Service (AWS SES). AWS processes the email on our behalf under their published privacy commitments. We honour all bounce and complaint signals automatically — if your address bounces or you mark our message as spam, we suppress further email to you immediately.

You can stop receiving non-critical email at any time by writing to [email protected]. Critical account-security and billing email is required while your account exists; if you do not wish to receive it, you should close your account.

5. Third-party services we use

We rely on a small set of trusted vendors to operate BizDash. Each is bound by their own privacy commitments:

• Razorpay Software Private Limited — processes payments. We share your name, email and the plan you are buying. Razorpay collects payment details directly from you and never shares them with us. See razorpay.com/privacy.
• Amazon Web Services (AWS), India region — hosts our backend and processes outgoing email through AWS SES. See aws.amazon.com/privacy.
• Google LLC — if you sign in with Google, Google handles authentication. See policies.google.com/privacy.
• Render Services Inc. — provides production hosting infrastructure. See render.com/privacy.

We do not share your personal information with any other third parties except where required by law.

6. Data security

• Passwords are stored as one-way Argon2/PBKDF2 hashes — we cannot read them even if we wanted to.
• All client-server communication uses TLS encryption.
• Access to production data is restricted to authorised partners of Bizorexa.
• Authentication uses short-lived JWTs (2-hour access tokens) and refresh tokens that can be revoked.
• We follow the principle of least privilege internally and review access regularly.

No system is perfectly secure. If we ever become aware of a security incident that affects your data, we will notify you and the relevant authorities as required by the Digital Personal Data Protection Act, 2023.

7. Your rights under the DPDP Act, 2023

Under the Digital Personal Data Protection Act, 2023 (DPDP Act), you have the right to:

• Access the personal information we hold about you.
• Correct any inaccurate or outdated information.
• Erase your personal information (subject to legal retention obligations like tax-record keeping under the Income Tax Act, 1961).
• Withdraw consent for processing where consent was the legal basis.
• Nominate another individual to exercise these rights on your behalf in the event of your incapacity or death.
• File a grievance with our designated Grievance Officer (contact below), and escalate to the Data Protection Board of India if unresolved.

To exercise any of these rights, write to [email protected]. We will respond within 30 days as required by the DPDP Act.

8. Data retention

We keep your account information for as long as your account is active. After you delete your account, we retain:

• Business records (bills, invoices) for 8 years as required by Indian tax law.
• Aggregated, anonymised usage data indefinitely for product improvement.
• Everything else is deleted within 90 days of your account-deletion request.

9. Cookies and similar technologies

BizDash uses only essential session cookies (or their mobile-app equivalent) for authentication. We do not use tracking cookies, analytics cookies, or advertising cookies. Our marketing website (bizorexa.com) does not set tracking cookies either.

10. Children's data

BizDash is a business tool intended for adults. We do not knowingly collect information from anyone under 18 years of age. If you believe we have inadvertently collected information from a minor, please contact us and we will delete it.

11. Cross-border data transfers

Your data is primarily stored in the AWS Asia Pacific (Mumbai) region. Some operational logs and email delivery may be processed in other AWS regions covered by AWS's standard data-protection commitments. We do not transfer your personal data outside India for any other purpose.

12. Changes to this policy

We may update this Privacy Policy from time to time. Material changes will be notified to you by email at least 7 days before they take effect. The "Last updated" date at the top of this page always reflects the current version.

13. Contact us