Privacy Policy
1. Who we are
This Privacy Policy explains how Appstowork Dot Com (“we”) handles personal data in connection with ATW Collectrix (the “Service”), in line with the Information Technology Act, 2000 and rules, and the Digital Personal Data Protection Act, 2023 (“DPDP Act”).
We act in two roles:
- Data fiduciary / controller for information about our customers and their staff who use the Service (account, billing and support data).
- Data processor for the business data our customers load into the Service, such as their debtors’ and suppliers’ details and invoices synced from TallyPrime. For that data our customer decides why and how it is used, and we process it on their instructions (see our Data Processing Addendum).
2. Information we handle
| Category | Examples | Whose data |
|---|---|---|
| Account data | Name, work email, role, phone, hashed password, two-factor settings, last sign-in | Customer staff |
| Licence and billing data | Company name, GSTIN, licence key, plan, invoices, payment status | Customer |
| Tally business data | Debtor and creditor names, contact details, addresses, GSTIN, ledger balances, bills, receipts, salesman groups | Customer’s debtors / suppliers |
| Communication data | Reminder and statement delivery logs (channel, time, status), promise-to-pay notes | Customer and debtors |
| Configuration secrets | SMTP and WhatsApp credentials you enter, stored encrypted; sync tokens | Customer |
| Technical and audit data | IP address, browser type, request logs, audit trail of changes made in the Service, sync-agent heartbeats | Customer staff |
| Support data | Messages and tickets you send to us | Customer staff |
We do not intentionally collect sensitive personal data such as health, biometric or children’s data. We do not receive card or bank-login credentials through the dashboard.
3. How we use it
- To provide, secure and support the Service (sync, ageing, statements, reminders, reports, writeback).
- To authenticate users, apply role and customer-access rules, and keep an audit trail.
- To issue invoices, manage licences and prevent misuse.
- To answer support requests and send service notices (security, maintenance, policy changes).
- To improve reliability and fix bugs, using logs and aggregated usage information.
- To comply with legal obligations and defend legal claims.
We do not sell personal data and do not use customer business data for advertising.
4. Basis for processing
We process account and billing data to perform our contract with the customer, on the user’s consent where the DPDP Act requires it, and for legitimate uses permitted by law such as security and legal compliance. For business data of debtors and suppliers, the customer is responsible for having a lawful basis and for giving any required notice to those people.
5. Who we share it with
- Infrastructure providers that host our servers, database and backups, under confidentiality and security obligations.
- Channels you connect: when you send a statement or reminder, the content goes through your own SMTP email provider and/or WhatsApp gateway that you configured, and then to your customer. If you switch on online payments, your customer’s name, contact details and the amount due are sent to your own Razorpay account to create the pay link, and Razorpay tells us when it is paid. These providers have their own privacy terms.
- Payment and invoicing providers, if and when we add online billing for our subscription fees.
- Professional advisers, courts and authorities where required by law or to protect rights and safety.
- A successor business in a merger or sale, with notice to you and the same protection for your data.
Our staff access customer data only where necessary for support or security, and such access is logged.
6. Security
We use measures appropriate to the risk, including: HTTPS for data in transit; PBKDF2-hashed passwords; optional two-factor authentication (mandatory for platform administrators); encryption at rest for stored third-party credentials; per-company data isolation and role-based access; rate limiting; a strict content security policy in the dashboard; and an audit trail of changes. No system is perfectly secure. If a personal data breach affects you, we will notify the affected customer without undue delay and the authorities where the law requires.
7. Cookies and local storage
The dashboard does not use advertising or tracking cookies and no third-party analytics scripts. To keep you signed in, your browser stores a signed session token and basic profile details (name, role) in its local storage. Signing out removes them. Fonts, icons and scripts are served from our own domain.
8. Where data is stored and international transfers
Data is stored on servers operated by our hosting provider. If data is processed outside India, we will do so only as the DPDP Act and any government restrictions permit. The sync agent sends data from your PC to our servers over HTTPS.
9. How long we keep it
- Business data synced from Tally: while your subscription is active. You can replace or delete a company’s data in Settings.
- After subscription ends: available for export for 30 days, then deleted from live systems and later from backups.
- Audit and delivery logs: kept for as long as needed for security and accountability, and then archived or deleted.
- Invoices and tax records: kept for the period required by Indian law.
10. Your rights
Under the DPDP Act you may: obtain a summary of the personal data we process and who we share it with; ask us to correct, complete or update it; ask us to erase it (subject to legal retention); withdraw consent where processing is based on consent; seek grievance redress; and nominate another person to exercise these rights if you die or become incapacitated.
If your details were uploaded by one of our customers (for example you are a debtor receiving a statement), please contact that business first, as it decides how your data is used. You can also write to us and we will help route or fulfil your request. Write to support@appstowork.com. We respond within a reasonable period and, in any case, within the time the law allows.
11. Children
The Service is for businesses and is not directed at children. We do not knowingly collect personal data from anyone under 18.
12. Changes to this policy
We will post updates on this page with a new effective date and notify customers of material changes.
13. Grievance officer and contact
For privacy questions, requests or complaints, contact our Grievance Officer:
Appstowork Dot Com
Email: support@appstowork.com
Phone: +91 9698309555
If you are not satisfied with our response, you may approach the Data Protection Board of India once it is operational, as provided under the DPDP Act.