Privacy Policy — MSME Pay Clock

Effective date: 15 September 2026

Last updated: 2 November 2026

This Privacy Policy explains how Verve Visions ("we," "us," "our") collects, uses, stores, and protects information when you use MSME Pay Clock (the "Service"). It should be read alongside our Terms of Service.

This Service is built for business use. It is meant for businesses and their authorized personnel, not for personal or household use.

1. Information We Collect

1.1 Account information. When you sign up, we collect your business or entity name, email address, and mobile number (used for OTP-based login). If you subscribe, we also collect the billing name, GSTIN, address, and state used to issue GST tax invoices.

1.2 Business data you upload. To operate the Service, you upload:

· Purchase invoice data (invoice numbers, dates, amounts, vendor names, vendor GSTINs)

· Payment records (payment dates, amounts, UTR references, associated vendor GSTINs)

· Vendor classification data you confirm (Udyam category, agreement type, agreed days, and exclude reason) for each vendor GSTIN

1.3 Data we deliberately do not retain. A purchase invoice row with no vendor GSTIN is skipped at import and never enters your books. It does not generate a vendor record, cannot be classified, and is excluded from all calculations. A payment record that does not carry a matching GSTIN cannot attach to an invoice and remains unmatched. We do not try to identify a vendor from incomplete information.

1.4 Reminder contacts. Mobile numbers you add for WhatsApp upload and deadline reminders, along with their OTP verification status.

1.5 Payment information. When you subscribe to a paid plan, payment is processed by Razorpay, our third-party payment processor. We do not collect, see, or store your card, UPI, or bank account details. Those stay inside Razorpay's own secure, PCI-DSS-compliant systems. We receive only confirmation of payment status (success, failure, amount, plan) from Razorpay to manage your subscription.

1.6 Usage and log data. We may collect basic technical information such as login timestamps, IP address, browser type, and actions taken within the Service, for security, debugging, and product-improvement purposes. We also use Vercel Web Analytics for aggregate, cookieless page-view and event counts.

2. How We Use Information

We use the information above to:

· Provide the core Service — classifying vendors, computing 43B(h) exposure, generating schedules and alerts

· Send WhatsApp reminders and OTP verification codes to numbers you have added and verified

· Process and manage your subscription and billing

· Respond to support requests

· Maintain security, detect abuse, and debug issues

· Improve the Service based on aggregate usage patterns, not by reading your specific business data for purposes unrelated to providing the Service to you

We do not use your business data (vendor names, invoice amounts, payment records) to train any third-party AI model, and we do not sell it to data brokers or advertisers.

3. Vendor Classification Data

Once you confirm a vendor's Udyam category, agreement type, agreed days, and any exclude reason, that classification is stored against the vendor's GSTIN and reused for later invoices from that GSTIN without asking again. A GSTIN we have not seen before asks for classification. Invoices tied to a GSTIN still awaiting classification are excluded from your totals until you classify them. The accuracy of stored classifications depends on the information you provided at the time. Our Terms of Service explain keeping these current.

4. Who We Share Information With

We do not sell your personal or business data. We share information only with:

Hosting and database: Vercel (Mumbai), Neon (Singapore). Payments: Razorpay. WhatsApp: MSG91. Email: Resend and Google Workspace. Your CA, only when you send them a schedule. Authorities, only when legally required.

Each of our providers acts only on our instructions, for the purpose above.

5. Data Retention

We retain your business data for as long as your account is active. If you cancel your subscription or account, we retain your data for 90 days to allow export or reactivation, after which it is deleted from our active systems, consistent with our Terms of Service. If the account stays paused for 90 days, its data is deleted. We'll email you 30 days before, so you can export it. Backup copies may persist for a limited additional period as part of routine infrastructure backups before being cycled out. Tax invoices and payment records that tax law requires us to keep are retained for as long as that law requires.

6. Data Security

We use encrypted connections (HTTPS) for data in transit, and rely on our hosting provider's security measures (including automated backups and point-in-time restore) for data at rest. Access to customer data within our team is limited to what is necessary for support and operations. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

7. Your Rights

You may, at any time:

· Access and export your business data from within the Service

· Correct vendor classifications, reminder numbers, or account details yourself

· Request deletion of your account and associated data by writing to us

· Stop WhatsApp reminders by removing the number from your account

We are working to align our practices with the principles of India's Digital Personal Data Protection Act, 2023 (DPDPA), including purpose limitation, data minimization, and honoring data principal requests, ahead of its substantive provisions coming into force. The DPDPA's substantive compliance obligations take effect in May 2027 under the notified Rules. We intend to meet these principles as good practice rather than waiting until they are required.

8. Grievance Officer / Privacy Contact

Grievance officer: Brijesh Kumar, Founder.

For any privacy-related questions, requests, or grievances, write to hello@msmepayclock.in.

We will acknowledge and respond to privacy requests within 30 days.

9. Cookies and Tracking

We use only essential cookies and session tokens necessary to keep you logged in and the Service functioning. We use Vercel Web Analytics for aggregate, cookieless page-view and event counts. We do not use third-party advertising or cross-site tracking cookies.

10. Children's Privacy

The Service is intended for business use by adults acting on behalf of their organization. We do not knowingly collect data from individuals under 18.

11. International Data Transfers

Application servers run in India (Mumbai). The database is stored in Singapore. Payment, messaging, and email providers may process data in other regions under their own safeguards.

12. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated by email or in-product notice before taking effect. Continued use of the Service after changes take effect means you accept the updated policy.

13. Contact

Questions about this Privacy Policy: hello@msmepayclock.in