Privacy Policy

Vinimay is a billing, inventory and GST software product operated by the team behind vinimay.in. Our registered correspondence address is Malkauli, Bagaha 2, West Champaran, Bihar 845105, India. You can reach us at contact@vinimay.in or +91 70045 16734.

This Privacy Policy applies to the Vinimay website (vinimay.in), the web application (app.vinimay.in), and the Vinimay Android and iOS applications (together, "the Service").

Account information: When you sign up, we collect your name, email address, and — if you provide it — your mobile phone number. Your password is stored only as a bcrypt hash and cannot be recovered or read by anyone, including us.

Business records: Everything you enter to operate your shop — companies, warehouses, stock items, invoices, purchase records, payments and party ledgers. This is your data. We do not analyse it for advertising purposes and we never sell it.

Customer and supplier details: The party information you enter — name, phone number, email address, GSTIN and postal address. You are responsible for having a lawful basis to hold this data; we hold it solely to show you your own accounts and to print your invoices.

Device and session data: For each signed-in device we record a device label, operating system, browser, app version, IP address, and an approximate city derived from that IP. This is what powers the Active Sessions screen in your settings, and lets you sign a device out remotely.

Account change history: When your name, email or mobile number is changed, we record the old and new value along with the device and IP that made the change. This lets you distinguish a change you made from one you did not authorise.

AI assistant messages: If you use the AI Assistant, the messages you send and the actions it takes are kept as an audit record so any mistaken action can be traced back. The assistant is off by default and only active when you switch it on.

Payment transaction data: When you subscribe to a paid plan, your name, email and phone number are passed to our payment processor (see Section 4) to complete the transaction. We do not store card numbers, UPI credentials or other sensitive payment credentials on our servers — these are handled entirely by the gateway.

• To provide and operate the Service — billing, inventory, reports and all other features you use.
• To authenticate your identity and keep your account secure.
• To process subscription payments and manage your plan.
• To send you transactional emails: verification codes, password resets, payment receipts and security notices.
• To let you audit your own account through Active Sessions and Account Change History.
• To troubleshoot technical problems and respond to your support requests.
• To comply with applicable laws, including GST regulations that require books of accounts to be retained.

We do not use your data for targeted advertising. We do not use your business records to train AI models.

Exactly four external services receive any of your information, each for a single purpose:

Your business records are kept for as long as your account remains open, because they are your statutory books of accounts. We do not expire them when a subscription lapses — you drop back to the free plan and everything stays exactly where it is.

Sign-in and account-change records are kept so you can audit your own account at any time.

When you request account deletion, we permanently erase your account, all companies under it, all parties, items, invoices, payments and ledgers within 30 days of confirming the request, and we notify you when it is done.

All data in transit between your device and our servers is encrypted using TLS (HTTPS). Data at rest is stored on managed cloud infrastructure with access controls limited to the personnel who need it to operate the Service.

Passwords are hashed with bcrypt before storage and are never readable in plaintext by anyone — including our own team. Sensitive payment credentials are never stored by us; they are handled on the payment gateway's own PCI-DSS–compliant infrastructure.

If you believe your account has been accessed without your permission, change your password immediately and sign out all active sessions from Settings → Active Sessions. Then write to us at contact@vinimay.in so we can investigate.

You have the right to:

• Access — request a copy of the personal data we hold about you.
• Correction — update your name, email or mobile number from Settings → Edit Profile at any time.
• Deletion — request that your account and all data under it be permanently erased (see Section 8).
• Portability — export your party ledgers, invoices and reports as PDF or CSV at any time from within the app.
• Objection — write to us if you believe we are processing your data in a way that is inconsistent with this policy.

To exercise any of these rights, email us from the address registered to your account at contact@vinimay.in. We will respond within 7 business days.

To delete your entire account and everything under it:

1. Email contact@vinimay.in from the address your account is registered to, with the subject line "Delete my account".
2. We will reply to confirm it is you — typically within 2 business days.
3. Once confirmed, we will permanently erase your account, all companies, warehouses, parties, items, invoices, payments and ledgers within 30 days.
4. You will receive a confirmation email when the deletion is complete.

If you want to export your books before deletion, say so in the same email and we will send them to you first.

The Vinimay website (vinimay.in) does not set tracking or advertising cookies. It is a static marketing site with no analytics script embedded.

The Vinimay app (app.vinimay.in) uses a session cookie to keep you logged in. No third-party tracking or advertising cookies are set by the app.

The Service is intended for use by businesses and is not directed at persons under the age of 18. We do not knowingly collect personal information from minors. If you believe a minor has provided us with data, please contact us and we will delete it promptly.

If we make material changes to this policy — for example, adding a new third-party service or changing how long we retain data — we will update the "Last updated" date at the top of this page and notify registered users by email at least 7 days before the change takes effect.

Continuing to use the Service after the effective date of a change constitutes your acceptance of the revised policy.

This Privacy Policy is governed by the laws of India, including the Information Technology Act, 2000 and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011. Any disputes arising from this policy shall be subject to the exclusive jurisdiction of the courts of Bengaluru, Karnataka, India.