Privacy Policy
Last updated: September 6, 2026
1. Who We Are
Sally ERP (“Sally”, “we”, “us”) is a cloud-based accounting and ERP platform for Indian businesses. This policy explains how we collect, use, store, and protect your personal data in compliance with the Digital Personal Data Protection Act, 2023 (DPDP Act).
2. Data We Collect
| Category | Data Points | Purpose |
|---|---|---|
| Account | Name, email, phone, password (hashed) | Authentication, communication |
| Company | Business name, GSTIN, PAN, address | Invoicing, GST compliance |
| Financial | Invoices, vouchers, bank statements, ledgers | Core ERP functionality |
| Usage | IP address, device info, activity logs | Security, debugging |
| Product usage | Which screens, reports, forms and keyboard shortcuts you use, how long, how you moved between them, which form fields take longest (their names, never what you typed), whether an action succeeded, whether an error was shown, and how long pages took to load — recorded against your account and company. Never the amounts, parties, narrations, search text or document numbers you enter. | Understanding which parts of Sally are used and where people get stuck, to improve the product |
| Payments | Subscription transactions (via Razorpay) | Billing |
| Mobile app | Photos or camera images you choose to attach, push-notification token, device model and OS version | Attaching proof to transactions, notifications, troubleshooting |
| Crash diagnostics (mobile app) | When the app crashes or hits an error: the error and its stack trace, the screen you were on, your recent steps in the app, device model, OS and app version, and your user and company id. Never your name, email, or the contents of any document. | Diagnosing and fixing crashes |
The iPhone and Android apps ask for camera or photo access only when you attach an image to a transaction or scan a barcode, and for notification permission only when you turn notifications on. The apps never record audio. Face ID and fingerprint unlock are performed entirely by your device — Sally never receives biometric data. Attachments, invoices and your sign-in token are stored on the device in the operating system's encrypted storage and removed when you sign out or delete the app.
3. How We Use Your Data
- Essential Service: Providing accounting, invoicing, GST compliance, and reporting features.
- Security: Detecting unauthorized access, fraud prevention, audit logging.
- Communication: Sending filing reminders, invoice notifications, and service updates.
- Improvement: Product usage analytics — which features are used, how people move through the app and where they get stuck — to improve Sally. Sally collects this itself, on our own servers in India; no third-party analytics service receives it, and it is never used for advertising.
4. Lawful Basis for Processing
Under the DPDP Act 2023, we process your data based on:
- Consent: For non-essential processing (marketing emails).
- Contractual necessity: To provide the ERP service you signed up for.
- Legal obligation: Retaining financial records as required by the Income Tax Act and GST Act.
- Legitimate interest: Security monitoring, fraud prevention, and first-party product usage analytics (section 2, “Product usage”). This is on by default for every account; write to the privacy address in section 14 if you want your account's usage excluded.
5. Data Storage & Security
- All data stored in AWS Mumbai region (ap-south-1) — India data residency
- Encryption at rest (AES-256 / AWS KMS) and in transit (TLS 1.2+)
- Passwords hashed with bcrypt (12 rounds), never stored in plaintext
- Sensitive credentials (GSTIN auth tokens) encrypted with AES-256 application-level encryption
- Role-based access control (RBAC) with company-scoped data isolation
6. Data Retention
| Data Type | Retention | Reason |
|---|---|---|
| Financial records | 8 years minimum | Income Tax Act requirement |
| Activity logs | 180 days | Security audit (CERT-In) |
| Product usage events | 30 days as individual events; daily totals kept indefinitely | Product improvement |
| Crash diagnostics | 90 days | Debugging mobile app crashes |
| GST API logs | 7 years | Compliance audit trail |
| Account data | Until deletion requested | Service delivery |
| Import files | 7 days | Temporary processing |
7. Your Rights (DPDP Act)
As a data principal, you have the right to:
- Access: Request a copy of your personal data.
- Correction: Update inaccurate personal information.
- Erasure: Request deletion of your account and personal data (subject to legal retention requirements).
- Withdraw Consent: Revoke consent for non-essential processing at any time.
- Grievance Redressal: Raise a complaint about data handling.
Exercise these rights via Settings → Account → Data & Privacy in the app, or email us at support@sallyerp.in.
8. Data Deletion
You can request account deletion from your account settings. Upon request:
- Account and personal data deleted within 72 hours
- Company data retained only if other members exist (ownership transferred)
- Financial records retained as required by law (anonymized where possible)
- Deletion is irreversible — we cannot recover deleted accounts
On the web go to Settings → Privacy; in the mobile app go to More → Settings → Privacy → Request Account Deletion. You confirm with your password, or — for accounts created with Apple or Google sign-in — by typing the confirmation phrase. If you can no longer sign in, see sallyerp.in/delete-account for the email-based process.
9. Third-Party Services
| Service | Purpose | Data Shared |
|---|---|---|
| AWS (Mumbai) | Hosting, storage | All data (encrypted) |
| Google OAuth | Sign-in | Email, name (from Google) |
| Apple (Sign in with Apple) | Sign-in on iPhone | Apple user ID, email or Apple relay address, name (first sign-in only) |
| Apple APNs / Google FCM (via Expo) | Mobile push notifications | Device push token, notification text |
| Sentry | Mobile app crash and error reporting | Error and stack trace, screen name, recent in-app steps, device model, OS and app version, user and company id |
| Razorpay | Subscription billing | Email, plan info |
| Sandbox.co.in (GSP) | GST filing | GSTIN, return data (encrypted) |
| NIC (Govt) | E-Invoice, E-Way Bill | Invoice data (as required by law) |
10. Cookies
We use the following cookies:
| Cookie | Type | Purpose | Duration |
|---|---|---|---|
| next-auth.session-token | Essential | Login session | 24 hours |
| sally-active-company | Essential | Active company selection | 1 year |
| sally-theme | Functional | Dark/light mode preference | Persistent |
| sally-usage-session | Functional (session storage, not a cookie) | A random id that groups the product-usage events of one browser tab so we can see the order screens were used in | Until the tab is closed |
11. Data Breach Notification
In the event of a data breach affecting your personal data, we will notify you within 72 hours via email and in-app notification, as required by the DPDP Act. We will also notify the Data Protection Board of India as mandated.
12. Children's Data
Sally ERP is a business tool not intended for individuals under 18 years of age. We do not knowingly collect data from minors.
13. Changes to This Policy
We may update this policy to reflect changes in our practices or legal requirements. Material changes will be communicated via email and in-app notification 30 days before taking effect.
14. Contact & Grievance Officer
For any privacy-related queries or to exercise your rights: